<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
On 02/14/2012 06:46 AM, From Francisco Corella:
<blockquote
cite="mid:1329194773.93431.YahooMailNeo@web125504.mail.ne1.yahoo.com"
type="cite">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255,
255); font-family: times new roman,new york,times,serif;
font-size: 12pt;">I guess you mean that if the relying party
downloads a certificate in<br>
the body of an HTTP response with a content-type header whose
value is<br>
a MIME type indicating that the body contains a certificate, and
if<br>
Firefox "finds a valid key pair" then Firefox will import the<br>
certificate automatically. Did I guess right?<br>
</div>
</blockquote>
<br>
Yes.<br>
<br>
<blockquote
cite="mid:1329194773.93431.YahooMailNeo@web125504.mail.ne1.yahoo.com"
type="cite">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255,
255); font-family: times new roman,new york,times,serif;
font-size: 12pt;">Well, depending on the details, that could be
a security hole. If the<br>
valid key pair that Firefox finds consists of the publick key in
an<br>
existing certificate and the associated private key, Firefox
could end<br>
up replacing the existing certificate with one downloaded by an<br>
attacker that binds the public key to the attacker's identity.<br>
</div>
</blockquote>
<br>
No, if an attacker could do that it'd be too late anyway, then he
probably could impersonate the entire internet. "Finding" a public
key that would match a private key is kind of impossible (with
sufficient key size). But I'm not sure if this is the right forum
for such crypto stuff.<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>