Weak sigs found on one in seven SSL sites
Survey highlights serious spoofability
One in seven digital certificates that stamp the authenticity of secure web sites use a vulnerable signature algorithm, according to a new survey. The shortcoming underlines the need to drop the insecure signing mechanism before its shortcomings are exploited in more convincing phishing attacks.
Netcraft reports that 14 per cent of the SSL Certificates it analysed during a recent survey were signed using an MD5 Algorithm recently discovered to be not just weak but vulnerable to practical attack. Last month security researchers at the Chaos Communication Congress showed how a fake certificate with the same digital signature (hash) as a valid certificate might be created. The issue arises because two different inputs to the weak MD5 hashing algorithm can produce the same output.
This "hash collision" creates a means for potential attackers to submit a normal certificate requests to a certificate authority (CA) before producing a second certificate with the same signature but different domain details. Worse still it might be possible to forge counterfeit credentials for websites providing they are signed using MD5, at least according to research presented at the CCC last month*.
The MD5 hash collision weakness has been known of for months, but it's only much more recently that security researchers have outlined how flaws in the MD5 checksum algorithm undermine the confidence of SSL certificates.
Netcraft's December 2008 SSL Survey found 135,000 valid third party certificates using potentially weak MD5 signatures, around 14 per cent of the total number of valid SSL certificates in circulation. Most (128,000) of the vulnerable SSL certs were signed by RapidSSL (owned by VeriSign since 2006).
A small number of certificates from Thawte and VeriSign also made use of the flawed algorithm, although most of their certificates were rubberstamped by the more secure SHA1 algorithm.
"Other affected CAs are likely to follow suit, as SHA1 is well established and is already in use for the majority of SSL certificate signing, so it should be simple to switch to using this more secure alternative," Netcraft reports. "Once it is impossible to obtain new certificates signed with MD5, this attack will be neutralised."
Extended Validation (EV) SSL websites are all signed by SHA1 or better signatures, so didn't appear as a problem in Netcraft's study.
But even the use of SHA1 digital signing offers no long-term guarantee. "Although there are no attacks as advanced as those against MD5, it is likely that SHA1 will also be increasingly threatened by collision attacks as research in this area continues," Netcraft continues. "There are more secure cryptographic hashes available, however, so we can expect to see CAs start to phase in newer, stronger hashes over the next few years."
One option, Netcraft adds, is for browser packages to distinguish certificates signed with MD5 from more secure algorithms "so that users can exercise caution". Given the confusion already generated by browser warnings about legit websites with out of date certificates, for example, we doubt such subtle warnings would be effective. ®
*According to Netcraft, the MD5 attack requires a collision between two newly created certificates deliberately created by the attacker that are bound together mathematically. The risk is not that existing domains can be spoofed, but much more than hackers might be able to create cryptographically identical pairs of valid and invalid domains, it reckons.
However, according to researchers from Centrum Wiskunde & Informatica in the Netherlands, EPFL in Switzerland, Eindhoven University of Technology in the Netherlands and independent labs in California who presented at CCC last month, the attack creates a means to spoof existing domains.
As Cat (the hacker) said.....
This is mine.
This is mine,
This is mine,
And this is mine,
And all this is mine!
Problem with EV certs is they cost companies a lot more. Fine for big businesses but a small business or individuals running a secure connection that needs certs is going to find EV certs prohibitively expensive.
As I understand it......
If the MD5 of the certificate details (common name etc. and public key) matches another certificates MD5 then the signatures (the encrypted MD5) will match assuming they are signed by the same CA certificate, no big surprise.
The critical thing here is if you could manufacture a certificate that you could predict the MD5 for, then just attach the signature of a certificate with an identical MD5 that has been signed already and presto it appears your manufactured certificate has been validly signed.
The MD5 weakness (attack) is that you *can* predict the MD5 under some curcumstances, it doesn't matter that we are now issuing SHA-1 certificates, the issue is that our browsers still allow MD5 based signatures, paypal uses SHA-1 but if somebody could create a spoof paypal (or whatever) certificate, install it on a server it could look valid.
Of course this does also mean the domain name still has to match the IP so either needs a DNS compromise or typo domain (www.paypa1.com etc.) or there will be a certifcate warning.
When I first worked with certificates (over 10 years ago), I wondered why use a hashed signature at all, why not additionally encrypt the whole server certificate (common name etc and public key) with the CA private key as a signature, OK there's a speed penalty and the certificate is twice the size, but becomes as unbreakable as RSA itself, I spoke to a techie at Verisign and he said that MD5 was as good as it needed to be, I guess it was.... then.
When I sue for using my idea of using the whole certificate as a basis of the signature (when SHA-1 is broken), remember you heard it here first ;-)