Yes, these vulnerabilities are real. The world of security is about reducing, not eliminating, risks and threats. What Mr. Kaminsky pointed out is that many PKI certificate common names are still being created using old hash functions -- MD5 and MD2 -- which are known to have exploitable weaknesses, instead of the stronger SHA-2 family of hash functions (SHA-224, SHA-256, SHA-384 and SHA-512).
Does this mean that PKI is no longer a trusted method of protection? No. As with any security technology, it's up to IT and security personnel to ensure that their protection and authentication technologies are kept up-to-date and that they follow the latest configuration and deployment recommendations such as those outlined by the OASIS Public Key Infrastructure Adoption (PKIA) Technical Committee or the NIST Federal PKI program (FPKI).
It's a fact that there are people out in the world actively working on gaining access to your information. PKI certificates, as an encryption/decryption method for protecting this information, are prime targets of attack, but they will still work well if the technology is kept current.
For more information:
- Learn more about security, authentication and implementation for PKI and digital certificates.
- Should PKI be used for laptop encryption? Read more.
Related Q&A from Randall Gamby, Contributor
Is your remote desktop access software really secure? Randall Gamby offers advice for conducting a remote access audit to validate security.continue reading
Expert Randall Gamby discusses risk-based authentication, and whether that type of user identification system is right for the enterprise.continue reading
Expert Randall Gamby discusses various types of single sign-on, specifically the approaches of Ping Identity's SSO and Symplified SSO.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.