Message-ID: <20100422233438.15109.qmail@...1287...>
Date: Fri, 23 Apr 2010 01:34:38 +0200
From: Peter Stuge <peter@...1287...>
References: <20100422111337.7ABB521DCF7@...1353...>
	<4BD07777.5030805@...1114...>
	<201004221829.13824.dave_br@...1278...>
	<201004222153.28610.dave_br@...1278...>
MIME-Version: 1.0
In-Reply-To: <201004222153.28610.dave_br@...1278...>
Subject: Re: [Openvpn-devel] [PATCH] revocation
List-Id: <openvpn-devel.lists.sourceforge.net>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/openvpn-devel>, 
	<mailto:openvpn-devel-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=openvpn-devel>
List-Post: <mailto:openvpn-devel@lists.sourceforge.net>
List-Help: <mailto:openvpn-devel-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/openvpn-devel>, 
	<mailto:openvpn-devel-request@lists.sourceforge.net?subject=subscribe>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
To: openvpn-devel@lists.sourceforge.net

Davide Brini wrote:
> the serial number is just an (almost) arbitrarily large number. Why
> would a CA choose such a serial number?

In order to avoid a chosen-prefix collision that works among other
things by predicting the serial number of certificates generated by
the CA.

http://www.win.tue.nl/hashclash/rogue-ca/
https://documents.epfl.ch/users/l/le/lenstra/public/papers/lat.pdf


//Peter