pem-dev
[Top] [All Lists]

Re: Multi-recipient security hole?

1992-08-18 04:52:00
I recently came across the following in some notes from a cryptography
lecture.  I wonder if it has been properly dealt with in the PEM procedures?

Yes, this attack was known about. It was one of the reasons for using
2^16 + 1 instead of 3 as the recommended exponent in X.509. (Although X.509
is somewhat reticent about the reasons for the choice!)

PEM part II references X.509 for certificate-based key management and hence 
implementors who follow up the references will come across this recommendation.
Now that you mention it, I agree that it probably should be given greater
prominence in the PEM RFCs themselves (probably part III).

Michael Roe
Cambridge University Computer Lab

<Prev in Thread] Current Thread [Next in Thread>