Messages in this thread | | | From | Florian Weimer <> | Subject | Re: [GIT PULL] Load keys from signed PE binaries | Date | Mon, 25 Feb 2013 15:33:12 +0100 |
| |
* Matthew Garrett:
> I don't think that's a problem. Just put the original binary hash in the > certificate before signing it, and extend the X.509 parser to refuse > certificates that have a tag that's present in dbx.
Why would Microsoft put a hash of something into dbx which they haven't signed? Wouldn't this make them subject to a denial-of-service attack on their platform if they revoke something with surprising consequences?
| |