I'm implementing the ACME protocol to automatically renew certificates and the claims in the article don't make sense to me.
In the attack by Eve, it is claimed that Eve recovers the account. Unless she knows the private key of the account, this is not possible because there is no function in the ACME protocol to recover an account.
The attack also suppose that the special file stored in `/.well-known/acme-challenge/` is downloaded by Eve. But this file is usually automatically deleted after the certificate renewal is completed. It's not even clear from the explanation what Eve could do with this file.
The whole security of the ACME protocol relies on the assumption that nobody except the owner of the domain name can return a special crafted data when `http://<domain>/.well-know/acme-challenge/<token>` is requested with the GET method. Cryptographic signatures aren't really needed here.
Any key pair can be used to renew any certificate with any associated private key. I thus don't understand the point the author of this article is trying to make.
In the attack by Eve, it is claimed that Eve recovers the account. Unless she knows the private key of the account, this is not possible because there is no function in the ACME protocol to recover an account.
The attack also suppose that the special file stored in `/.well-known/acme-challenge/` is downloaded by Eve. But this file is usually automatically deleted after the certificate renewal is completed. It's not even clear from the explanation what Eve could do with this file.
The whole security of the ACME protocol relies on the assumption that nobody except the owner of the domain name can return a special crafted data when `http://<domain>/.well-know/acme-challenge/<token>` is requested with the GET method. Cryptographic signatures aren't really needed here.
Any key pair can be used to renew any certificate with any associated private key. I thus don't understand the point the author of this article is trying to make.
EDIT: if MITM is assumed for a GET request to `http://<domain>/.well-know/acme-challenge/<token>`, then the attacker can indeed generate it's own certificates for that domain.