Comodo Certificates Impregnable to Black Hat Vulnerabilities

You and your customers can count on Comodo certificates. Neither the "Null Character Attack" nor to the "MD2 Vulnerability" recently revealed at the Black Hat Briefings in Las Vegas can affect Comodo products.

Moxie Marlinspike's "Null Character Attack" tricks a vulnerable certificate authority (CA) into issuing a certificate that includes a \0 character (NULL) within the domain name. This allows the attacker to fool a vulnerable web browser into trusting the certificate for a domain name that the CA did not validate. Unlike ISPCA's, Comodo's CA systems have never been vulnerable to this attack.

Dan Kaminsky's "MD2 vulnerability" warns that pre-image attacks against the MD2 hash algorithm are likely to become possible within months. This would allow an attacker to construct trusted certificates that appear to have been issued by a CA certificate that has an MD2-based digital signature. Comodo have never used the MD2 algorithm, so our CA systems and our customers' certificates will not be affected.