TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Duplicate Signature Key Selection Attack in Let's Encrypt

71 点作者 kkl超过 9 年前

3 条评论

niksmac超过 9 年前
Fortunately, it was mitigated before Let&#x27;s Encrypt was publicly trusted.. <a href="http:&#x2F;&#x2F;www.ietf.org&#x2F;mail-archive&#x2F;web&#x2F;acme&#x2F;current&#x2F;msg00611.html" rel="nofollow">http:&#x2F;&#x2F;www.ietf.org&#x2F;mail-archive&#x2F;web&#x2F;acme&#x2F;current&#x2F;msg00611.h...</a>
jmhodges超过 9 年前
To be clear, the challenge types in question where removed from Let&#x27;s Encrypt production config during the private beta period (when we had a strict whitelist of domains allowed to be issued for), had mitigations for them in while they were out, and we deleted the code for them entirely the other day (in <a href="https:&#x2F;&#x2F;github.com&#x2F;letsencrypt&#x2F;boulder&#x2F;pull&#x2F;1247" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;letsencrypt&#x2F;boulder&#x2F;pull&#x2F;1247</a> )
mynewtb超过 9 年前
Wait, what good is a signature then if you can craft it? I may have misunderstood, would appreciate a dumbed down answer.
评论 #10725680 未加载