Compromised CA
14 July 2009
A lot of people don't realize how sensitive and delicate PKI is in practice- this is the technology behind much of internet security (e.g. SSL). Though we can theorize that it would take 100's of thousands of years to brute-force an security system, that's never the attack vector (or point of vulnerability) on such a system. This does actually happen; the German healthcare system suffered such a problem when it's CA (certificate authority) lost it's keys after a
power outage. Now, they must start from scratch, reissuing over 80 million smart cards. While it may seem overzealous to reissue that many cards- after all, the CA key was lost, not stolen- it's important to realize that without the CA's key that is impossible to issue new Certificate Revocation Lists (CRLs), create new Registration Authorities (RAs), etc. The PKI system instantly become useless. You have to start over.
