4

I believe that VeriSign has issued a big share of world's SSL certificates. Many corporations and governments use them. Is it possible for a person that has access to Verisign private keys to sneak a couple and start many undetectable man-in-the-middle attacks? Isn't it too much of a power for a single person to (potentially) have access to the big share of worlds' secret information?

I'm new to the field of security, pardon me if this question is silly.

7

Big CA are supposed to implement thorough controls to prevent or at least detect wrongly issued certificates. Procedures applied by Verisign are described in their certification practice statement. See in particular their "procedural controls" and "personnel controls", pages 28 to 31 (as of version 3.8.4 of the document, published March 1st, 2011): some tasks require collaboration of several employees who check each other, there are background verification (criminal status, debt...), a lot of logs are produced and audited... To a large extent, these procedures are quite similar to the procedures for launching a nuclear attack, and, frankly, I think that a few hundred nuclear warheads are just a tad more worrisome than a couple fake certificates.

  • Thank you, that was an intresting read. Why do you believe 'these procedures are quite similar to the procedures for launching a nuclear attack'? – Oleg M Mar 1 '13 at 0:39
  • 9
    I could tell you, but I would have to kill you afterwards. – Thomas Pornin Mar 1 '13 at 1:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.