If you wondered what that image in my last post was, I should tell you that is a piece of disappointment. Basically, in PKI you trust a certificate authority (CA) to help you verify the trustworthiness of others. If this CA does not do a good job, then you may have ended up trusting identities you did not have a reason to. If you trust someone once and they disappoint you, it is their fault. But if you trust that party twice, then it is your fault.

However, sometimes it has nothing to do with CAs and it has more to do with the fact that hackers, crackers, and researchers are quickly catching up with cryptography technology. (i.e. MD5 considered harmful today) One of my friends believed that none of the hackers or crackers have access to enough of equipment to perform these kinds of attacks on cryptography algorithms. These guys used 200 Sony Playstations, and they ended up breaking MD5, huh? Tell me what they can do with 250,000 computers? Well, John Schiefer went to jail for owning that many zombies...

 Anyways, now all CAs who issued certificates with MD5 are renewing them for free. It is not a big deal that MD5 is cracked, as long as people stop using it and are aware of consequences of using it in the future. Let's assume that they break 3DES tomorrow. And four years ago, a guy got bored playing his old video games over and over. So he made some zombies and captured some encrypted network traffic. You think that guy is going to be bored tomorrow? If so, any packet that was captured by him and it was encrypted by 3DEs will be vulnerable. Under the assumption of that he did not want to make 10,000$ a day and quit capturing useless encrypted network packets. Forward secrecy and backward secrecy is something, I will write a bit about in my next post hopefully.