Subject: [saag] Bitten by MD5

From: Vishwas Manral <[email-masked]>
Date: Tue, 12 Jun 2012 11:15:28 -0700

Hi folks,

Thought this would be interesting to the group, especially since we have
talked of issues with MD5 hash collisions in the past. This is about Flame
and its use of MD5:
http://mobile.techworld.com/news/security/3363162/flames-windows-update-hack-used-world-class-cryptanalysis-say-researchers/?cmpid=TD1N17&no1x1&olo=daily%20newsletter

Thanks,
Vishwas

---

From: Stephen Kent <[email-masked]>
Date: Wed, 13 Jun 2012 14:31:20 -0400

At 11:15 AM -0700 6/12/12, Vishwas Manral wrote:
>Hi folks,
>
>Thought this would be interesting to the group, especially since we 
>have talked of issues with MD5 hash collisions in the past. This is 
>about Flame and its use of MD5:
><http://mobile.techworld.com/news/security/3363162/flames-windows-update-hack-used-world-class-cryptanalysis-say-researchers/?cmpid=TD1N17&no1x1&olo=daily%20newsletter>http://mobile.techworld.com/news/security/3363162/flames-windows-update-hack-used-world-class-cryptanalysis-say-researchers/?cmpid=TD1N17&no1x1&olo=daily%20newsletter
>
>Thanks,
>Vishwas

The MD5 collision attack, as noted in the report details, does not 
appear to be really new and it could have been mitigated by following 
cert issuance guidelines that have been published for several years.

I don't think there is anything noteworthy about this aspect of Flame, for
folks who have tracked progress in this area for a while.

Steve

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 13 Jun 2012 12:20:07 -0700

On Jun 13, 2012, at 11:31 AM, Stephen Kent wrote:

> The MD5 collision attack, as noted in the report details, does not appear to be really new and it could have been mitigated by following cert issuance guidelines that have been published for several years.
> 

The fact that the guidance had been published for many years, but Microsoft ignored it, seems noteworthy.

--Paul Hoffman

---

From: Stephen Kent <[email-masked]>
Date: Wed, 13 Jun 2012 16:04:09 -0400

At 12:20 PM -0700 6/13/12, Paul Hoffman wrote:
>>appear to be really new and it could have been mitigated by 
>>following cert issuance guidelines that have been published for 
>>several years.
>>

agreed.

Steve

---

From: Santosh Chokhani <[email-masked]>
Date: Fri, 15 Jun 2012 14:23:02 -0400

When I read this blog, I come away with the impression that the way MSFT determines a certificate is a valid code signing certificate makes the attack possible on XP and older platform even without hash collision attack.

To my knowledge, Windows is happy to declare a digital signature certificate as code signer if there is no EKU, if there is "anyEKU" or if there is code signing EKU.  Of course, there are other caveat such as CA certificate also meet this EKU requirement, but these caveats are generally always true.

http://blogs.technet.com/b/srd/archive/2012/06/06/more-information-about-the-digital-certificates-used-to-sign-the-flame-malware.aspx?Redirected=true

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul Hoffman
Sent: Wednesday, June 13, 2012 3:20 PM
To: Stephen Kent
Cc: IETF Security Area Advisory Group
Subject: Re: [saag] Bitten by MD5

On Jun 13, 2012, at 11:31 AM, Stephen Kent wrote:

> I don't think there is anything noteworthy about this aspect of Flame, 
> for folks who have tracked progress in this area for a while.

--Paul Hoffman

_______________________________________________
saag mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/saag