Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite
1

I believe that VeriSign has issued a big share of world's SSL certificates. Many corporations and governments use them. Is it possible for a person that has access to Verisign private keys to sneak a couple and start many undetectable man-in-the-middle attacks? Isn't it too much of a power for a single person to (potentially) have access to the big share of worlds' secret information?

I'm new to the field of security, pardon me if this question is silly.

share|improve this question

1 Answer

up vote 6 down vote accepted

Big CA are supposed to implement thorough controls to prevent or at least detect wrongly issued certificates. Procedures applied by Verisign are described in their certification practice statement. See in particular their "procedural controls" and "personnel controls", pages 28 to 31 (as of version 3.8.4 of the document, published March 1st, 2011): some tasks require collaboration of several employees who check each other, there are background verification (criminal status, debt...), a lot of logs are produced and audited... To a large extent, these procedures are quite similar to the procedures for launching a nuclear attack, and, frankly, I think that a few hundred nuclear warheads are just a tad more worrisome than a couple fake certificates.

share|improve this answer
Thank you, that was an intresting read. Why do you believe 'these procedures are quite similar to the procedures for launching a nuclear attack'? – Oleg Ostroumov Mar 1 at 0:39
8  
I could tell you, but I would have to kill you afterwards. – Thomas Pornin Mar 1 at 1:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.