Yet another Hacker News

Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

120 points hkc 1 hour ago 51 comments

positive-spite 1 hour ago | parent

That's some criminal negligence right there.

8 bits is crazytalk!

joshuat 59 minutes ago | parent

“4”

hey chatgbg what is a “private key”

Hamuko 36 minutes ago | parent

Maybe they were counting on the fact that usually the right answer to “I’m thinking of a number between 1 and 10” is “7”.

Agentlien 2 minutes ago | parent

As someone from Gothenburg, Sweden (often referred to as gbg) I shall answer:

A private key is a tiny number you don't need to share publicly because it is easy enough to guess.

bombcar 1 hour ago | parent

Of COURSE it's easy to crack, 4 isn't even prime!

joshuat 58 minutes ago | parent

It’s really impressive no one caught their three previous private key values

bcvvvy 51 minutes ago | parent

I suspect they did but it wasn't publicised.

DavidSJ 39 minutes ago | parent

In their defense, they were probably targeting the Mersenne prime 2^2 - 1 and just made a typo.

throw0101a 9 minutes ago | parent

> In their defense, they were probably targeting the Mersenne prime 2^2 - 1 and just made a typo.

There are two hard problems in computer science: naming things, cache invalidation, and off-by-one errors.

delibes 19 minutes ago | parent

https://xkcd.com/221/

walrus01 12 minutes ago | parent

Hey, that's the same combination I have on my luggage!

WalterGR 59 minutes ago | parent

“eMudhra intermediate CA compromise” | 947 points | 19 hours ago | 408 comments

Qision 56 minutes ago | parent

It feels like they chose the private keys by hand.

PalmPilotProMax 50 minutes ago | parent

Artisanal cryptography. Hand-picked private keys salted with organically sourced nonces.

donandon 46 minutes ago | parent

Made with love

tclancy 35 minutes ago | parent

Brooklyn-based. Guy in overalls and a waxed mustache hands out the bits.

muvlon 8 minutes ago | parent

My bet is on one of

- A sequence number being accidentally used as the private key or

- The private key being generated securely but then accidentally truncated to 8 bits (e.g. writing a single char into a zeroed buffer when you should've memcpy'd from a char*).

The sequence number idea is supported by the fact that two of the G3B private keys are consecutive numbers. I ran a quick Monte Carlo simulation and if I got it right, sampling 8 keys from [0,255] uniformly at random (as in the truncation scenario), you'd expect them to contain 2 consecutive numbers only about 18% of the time.

walrus01 8 minutes ago | parent

A long time ago one time pads used to be chosen by hand by women picking numbered lottery balls out of a spherical tumbling machine on a table.

naabozaurus 54 minutes ago | parent

hey, at least it was easy to remember...

jlmorton 53 minutes ago | parent

In retrospect, having 100 trusted certificate authorities might have been excessive.

tclancy 35 minutes ago | parent

In retrospect, not having a tiny competency check may have been an oversight.

maeln 51 minutes ago | parent

eMudhra explanation : https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11

Kind of hard to understand how a bug would have generated a second pair of key so bad, and how would human would have ended up using them. Never attribute to malice what can be attributed to stupidity, but sometimes you wonder.

sobkas 35 minutes ago | parent

Any sufficiently advanced malice is indistinguishable from stupidity.

dist-epoch 24 minutes ago | parent

And an equal amount of stupidity in the whole ecosystem, apparently there are no "unit-tests" for trivial failure modes, like 8 bits of entropy, before adding a CA to the trusted list.

What next, googling the public key finds a 2 year old pastebin with the private key?

silvestrov 12 minutes ago | parent

Even just a human glancing at the private key should do it.

Don't they even test script changes on a staging server? How could there be such a script error in production that was not caught in testing/staging?

This sounds very like a fundamental organization error, not an innocent whoopsie. It should lead to a permanent ban of the organization.

siwatanejo 46 minutes ago | parent

https://xkcd.com/221/

Qision 29 minutes ago | parent

Literally the tutorial they used

TazeTSchnitzel 45 minutes ago | parent

Could HN start feeding submissions through Pangram so us human readers don't have to suffer with reading the nauseating AI-prose?

jadamson 35 minutes ago | parent

It reads fine to me. If it is AI, I'd like to know which one so I can use it too.

TazeTSchnitzel 31 minutes ago | parent

I think it's a hybrid text. The section about how elliptic curve keys work is particularly aggravating. Unfortunately it's also the only section that gave me new information.

stratos123 18 minutes ago | parent

It reads okay to me too, yet Pangram says it's mixed - the "What a private key actually is" section is AI, so is 'Why "it cannot be contained"' and some others.

hypfer 34 minutes ago | parent

This is not a good write-up. Yesterday's discussion did contain better data, less self-Promotion and actually asked why it happened, instead of just saying "number small".

tclancy 33 minutes ago | parent

I will say, there’s something almost reassuring when something goes boom that badly and the story is really silly. It’s like [horrific human-caused disaster] but it’s because of a Three Stooges episode.

sscaryterry 29 minutes ago | parent

I wouldn't be surprised if we learn in the near future, that this was deliberate.

yoavm 25 minutes ago | parent

Why would it be?

sscaryterry 14 minutes ago | parent

Do I honestly need to enumerate what you can do if you have the keys for a CA?

swiftcoder 2 minutes ago | parent

Yeah, but if you are the one issuing the CA's private key, you already, by definition, have the keys to that CA. You don't need to make stupid keys in that scenario

edent 20 minutes ago | parent

I'm not so sure. If you wanted to be deliberate, you'd choose a plausible value that you could control.

No one is going to suspect `98761316832165974216498789746` is anything other than random. But `000000000000000123` looks suspicious.

sscaryterry 16 minutes ago | parent

Why are many of them, suspicious?

skywhopper 13 minutes ago | parent

Sounds more like extremely sloppy procedures. Which depressingly I doubt are unusual among CAs.

dist-epoch 25 minutes ago | parent

> and no TLS certificates chaining to these CAs ever showed up in CT

Why are browsers trusting CAs which issued zero certificates since their creation 1 year ago?

skywhopper 9 minutes ago | parent

These are intermediate roots, signed by trusted root certs, so the trust from your OS or browser is implicit to the roots it trusts.

supernes 24 minutes ago | parent

Two more things to note about impact assessment: Flatpak uses the selected runtime's baked-in trust store (I think), so any apps may be susceptible even if you update the system package. Containers also don't inherit the host's trust store and use the one from the base image.

dbcooper 15 minutes ago | parent

All the numbers were under 384. Surely they couldn't have ...

glimshe 10 minutes ago | parent

"Hah! 0x000...0 is the most secure private key I could use because nobody will think of trying that! Too obvious! Just like my 1234 bank pin!"

tniemi 9 minutes ago | parent

Someone used the Dilbert random number generator. https://www.random.org/analysis/