<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
On 01/05/2009 06:16 AM, Peter Williams:
<blockquote
cite="mid:BFBC0F17A99938458360C863B716FE4639819EDE17@simmbox01.rapnt.com"
type="cite">
<pre wrap="">
Eric
Are you comfortable with the truth of the following wording:
"This attack method could allow an attacker to generate additional digital certificates with different content that have the same digital signature as an original certificate."
Ae you telling me that no exploitation of that attack method actually occurred, as expressed above?
That is: noone "generate(d) additional digital certificates with different content that have the same digital signature as an original certificate."
If so I hereby apologise.</pre>
</blockquote>
I think that the real life exploit hasn't happened yet and no real
damage occurred. I think there is a difference if a research group or
security specialist finds an exploit than a vulnerability is actually
exploited.<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>