Spoofing HTTP server certificates

[Jeff Weinstein]

In article <199510020737.AAA27256 at ix7.ix.netcom.com>, stewarts at ix.netcom.com (Bill Stewart) writes:
> At 12:52 AM 10/2/95 -0400, Greg Miller <gmiller at grendel.ius.indiana.edu> wrote:
> >	Since there has been a lot of talk about the "man in the middle" 
> >attack on the secure web servers, has anyone actually considered the 
> >processing time required to fake a certificate from scratch?
> >	I haven't really familiarized myself with how the certificates 
> >are generated, etc, but it's my understanding that they are signed with RSA.
> 
> While I haven't seen Verisign's various public keys posted to the net,
> and didn't see them anywhere on their web page, I assume they're at least
> 508 bits long, and the ones for better-than-personna certification
> (or at least Class 3) ought to be ~1024 bits long, unless they're limiting
> themselves to 512 bits to support software that's limited by ITAR stupidity
> (which would be a shame, but is certainly possible.)

  You can see the certificate(including public key) for RSA/Verisign's
sercure server authority by looking at:

	http://home.netscape.com/newsref/ref/rsa-server-ca.html

  It is a >1000 bit key.

	--Jeff

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw at netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.