full-disclosure - how would browser vendors deal with $O(10^k)$ fake certs?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun, 10 Apr 2011 18:55:17 +0300
From: Georgi Guninski <guninski@...inski.com>
To: full-disclosure@...ts.grok.org.uk
Subject: how would browser vendors deal with $O(10^k)$
	fake certs?

how would browser vendors deal with $O(10^k)$ fake certs?

recently, most browser vendors panicly issued binary updates because of $O(10^1)$ fake server certs.

what does analytic number theory says about replacing the constant $1$ by a variable $k$?

i.e.:

what would do most browser vendors do if they find $O(10^k)$ fake server certs (possibly from different RA) {one assume $k$ is not **that** big} [god forbid CA certs]?

appears to me getting the certs is one time cost to the attacker, while checking 10^k c3rt s3r34l numbers (as in the panic patch) requires loop to 10^k?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/