Messages in this thread | | | Date | Mon, 25 Feb 2013 15:42:36 +0000 | From | Matthew Garrett <> | Subject | Re: [GIT PULL] Load keys from signed PE binaries |
| |
On Mon, Feb 25, 2013 at 03:33:12PM +0100, Florian Weimer wrote: > * Matthew Garrett: > > > I don't think that's a problem. Just put the original binary hash in the > > certificate before signing it, and extend the X.509 parser to refuse > > certificates that have a tag that's present in dbx. > > Why would Microsoft put a hash of something into dbx which they > haven't signed? Wouldn't this make them subject to a > denial-of-service attack on their platform if they revoke something > with surprising consequences?
? The entire point is that the key is in a binary that Microsoft have signed.
-- Matthew Garrett | mjg59@srcf.ucam.org
| |