Subversion of CA
If the CA can be subverted, then the security of the entire system is lost for each user for whom the CA is attesting a link between a public key and an identity.
For example, suppose an attacker, Eve, manages to get a CA to issue to her a certificate that claims to represent Alice. That is, the certificate would publicly state that it represents Alice, and might include other information about Alice. Some of the information about Alice, such as her employer name, might be true, increasing the certificate's credibility. Eve, however, would have the all-important private key associated with the certificate. Eve could then use the certificate to send digitally signed email to Bob, tricking Bob into believing that the email was from Alice. Bob might even respond with encrypted email, believing that it could only be read by Alice, when Eve is actually able to decrypt it using the private key.
A notable case of CA subversion like this occurred in 2001, when the certificate authority VeriSign issued two certificates to a person claiming to represent Microsoft. The certificates have the name "Microsoft Corporation", so could be used to spoof someone into believing that updates to Microsoft software came from Microsoft when they actually did not. The fraud was detected in early 2001. Microsoft and VeriSign took steps to limit the impact of the problem.
In 2011 fraudulent certificates were obtained from Comodo and DigiNotar, allegedly by Iranian hackers. There is evidence that the fraudulent DigiNotar certificates were used in a man-in-the-middle attack in Iran.
In 2012, it became known that Trustwave issued a subordinate root certificate that was used for transparent traffic management (man-in-the-middle) which effectively permitted an enterprise to sniff SSL internal network traffic using the subordinate certificate.
Read more about this topic: Certificate Authority
Famous quotes containing the words subversion of and/or subversion:
“In a democracy—even if it is a so-called democracy like our white-élitist one—the greatest veneration one can show the rule of law is to keep a watch on it, and to reserve the right to judge unjust laws and the subversion of the function of the law by the power of the state. That vigilance is the most important proof of respect for the law.”
—Nadine Gordimer (b. 1923)
“In a democracy—even if it is a so-called democracy like our white-élitist one—the greatest veneration one can show the rule of law is to keep a watch on it, and to reserve the right to judge unjust laws and the subversion of the function of the law by the power of the state. That vigilance is the most important proof of respect for the law.”
—Nadine Gordimer (b. 1923)