I was looking at FOAF+SSL and wondering if its possible to spoof the modulus of the browser certificate so that the FOAF and browser certificate's modulus match?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
I'm not sure exactly what you are asking. In the scenario, there are two certificates: Romeo's FOAF certificate and Juliet's SSL certificate. However Romeo's certificate is used in two different ways: once to authenticate (over mutually authenticated SSL) and once as posted on a domain he controls.
I believe your question may be, if an active adversary saw Juliet request the certificate information from Romeo's domain (as specified in the cert's alt name), could the adversary modify the response to match a bogus FOAF certificate it provided? The answer is yes, since this connection is not over SSL!
The real question is what happens in step 6? Does Juliet look in her friends databases for the URL or for the public key? If it is the former, there seems to be a security vulnerability. If it is the latter, it is ok, since an adversary has to substitute their own public key to form the HTTPS connection (which requires them to know the corresponding private key).
I once experimented with FOAF but don't know anything about FOAF+SSL beyond this article.