floof.org
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)

4 times the SECP384-R1 base point is (0x138251cd52ac9298c1c8aad977321deb97e709bd0b4ca0aca55dc8ad51dcfc9d1589a1597e3a5120e1efd631c63e1835, 0xcacae29869a62e1631e8a28181ab56616dc45d918abc09f3ab0e63cf792aa4dced7387be37bba569549f1c02b270ed67)

https://repository.emsign.com/certs/EMOVTLSCAG3C.crt

for the non-cryptographers at the back of the room: the private key is 4, just the number 4, nothing more

Certificate:<br>    Data:<br>        Version: 3 (0x2)<br>        Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3<br>        Subject: C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C<br>        Subject Public Key Info:<br>            Public Key Algorithm: id-ecPublicKey<br>                Public-Key: (384 bit)<br>                pub:<br>04:13:82:51:cd:52:ac:92:98:c1:c8:aa:d9:77:32:<br>1d:eb:97:e7:09:bd:0b:4c:a0:ac:a5:5d:c8:ad:51:<br>dc:fc:9d:15:89:a1:59:7e:3a:51:20:e1:ef:d6:31:<br>c6:3e:18:35:ca:ca:e2:98:69:a6:2e:16:31:e8:a2:<br>81:81:ab:56:61:6d:c4:5d:91:8a:bc:09:f3:ab:0e:<br>63:cf:79:2a:a4:dc:ed:73:87:be:37:bb:a5:69:54:<br>9f:1c:02:b2:70:ed:67<br>                ASN1 OID: secp384r1<br>                NIST CURVE: P-384<br>
This entry was edited (2 weeks ago)
Link to source
1 2
R
R • mastodon (AP)
h-how????
Link to source
R
R • mastodon (AP)
someone finally beat sony at ecdsa fuckups?
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@r yes, somehow
@R
Link to source
nyan
nyan • mastodon (AP)
are you fucking kidding me?
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@nyanbinary I wish I was
@nyan
Link to source
nadja
nadja • mastodon (AP)
OH COME THE FUCK ON, WHAT IS THIS, AMATEUR HOUR?!
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@dequbed evidently, it is
@nadja
Link to source
Ellie
Ellie • hometown (AP)
@dequbed ONE JOB. They had one fucking job. -.-
@nadja
Link to source
nadja
nadja • mastodon (AP)
@elliewithcolor wanna bet this is the result of whatever scuffed migration from RSA they implemented going "we want our exponent to be small because that's good practice. But hey there's no exponent here. Oh well, let's just pick this random number and keep it small, that's the industry standard practice after all!"
@elliewithcolor
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@dequbed @elliewithcolor given what their cert repo looks like, could well be an LLM based cockup https://repository.emsign.com
@nadja @elliewithcolor
Link to source
M Schommer
M Schommer • mastodon (AP)

@elliewithcolor @dequbed
Well. It is… the simplest number to do a prime number refactoring on.
But we *can* do a prime number refactoring on it.

(If that's too easy for you, increase the refactoring difficulty. Use 6 instead of 4.)

@nadja @Ellie
This entry was edited (2 weeks ago)
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@musevg @elliewithcolor @dequbed primality has nothing to do with this, this is EC not RSA
@nadja @M Schommer @Ellie
Link to source
R
R • mastodon (AP)
i see you doing ninja-edits (for better scicomm?)
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@r yes, actually
@R
Link to source
hexchen
hexchen • gotosocial (AP)
...they did WHAT?
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@hexchen XKCD 221
@hexchen
Link to source
cpresser
cpresser • mastodon (AP)
ELI5? I have almost zero knowledge in crypto and don't understand it.
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)

@cccpresser the private key for a certificate that can attest for other websites (super super secret) is the number 4

yes its as stupid as it sounds

@cpresser
Link to source
Мя 
Мя  • mastodon (AP)

@cccpresser cryptography, basically, is doing math with input data, and a secret number. You want secret number to be big and random, so no one could guess it and undo your math

number 4 is, obviously, neither big nor very random...

@q

@210561 ✨ [Q] @cpresser
Link to source
rzeta0
rzeta0 • mastodon (AP)

@mo @cccpresser
I'm no expert so tell me where I'm wrong:

1. If you have a large range from which to choose a number randomly then 4 is entirely possible.

2. The criterion is a number hard to factor.

Is that right?

@Мя  @cpresser
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@rzeta0 @mo @cccpresser 2 is only true for RSA keys, this is ECDSA
@Мя  @cpresser @rzeta0
Link to source
Mae
Mae • akkoma (AP)
damn mustve gotten really unlucky with their rng
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@Mae all their private keys are <256, this isn't some RNG accident
@Mae
Link to source
1 1
Ivo Jansch
Ivo Jansch • mastodon (AP)
@q
@210561 ✨ [Q]
Link to source
1 3
artemist
artemist • mastodon (AP)

I checked their other intermediates; they are 115, 155, 56, 66, 156, 237, and 230.

I think they used a real RNG but only requested one byte

Link to source
Phil M0OFX
Phil M0OFX • hometown (AP)
@artemist This has all the energy of being a certificate issuance serial number
@artemist
Link to source
Marta
Marta • mastodon (AP)
Ok, so 4 is the answer (even more stupid that 42, I do agree). But what was the question? Whose door does it open?
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@martaczc HTTPs certificates
@martaczc
Link to source
jendrik @ 40c3
jendrik @ 40c3 • mastodon (AP)
I thought that small numbers like that would be automatically rejected or something? Maybe I'm misremembering. Or was that RSA?
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@jendrik that’s RSA
@jendrik @ 40c3
Link to source
OverSoft
OverSoft • mastodon (AP)
How has no-one ran into this yet? Or was this so stupid that no-one even bothered to try because “nobody could’ve chosen a key this simple”?
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@OverSoft nobody could’ve possibly been that stupid!
@OverSoft
Link to source
JP 🔜 40C3
JP 🔜 40C3 • mastodon (AP)
WHAT DO YOU MEAN ITS 4???!????????
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@jplexer its 4, the secret number is 4
@JP 🔜 40C3
Link to source
Graham Sutherland / Polynomial
Graham Sutherland / Polynomial • mastodon (AP)
/cc @da_667 guess it's time to add anything signed by this entire CA to the IoCs list lol
@PinkAntiMaterielRifle
Link to source
Phil Ashby :marmite: 🍵
Phil Ashby :marmite: 🍵 • mastodon (AP)
@gsuberland @da_667 Mozilla ban hammer in 3,2,1...
@Graham Sutherland / Polynomial @PinkAntiMaterielRifle
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@phlash @gsuberland @da_667 already distrusted
@Graham Sutherland / Polynomial @Phil Ashby :marmite: 🍵 @PinkAntiMaterielRifle
Link to source
GhostOnTheHalfShell
GhostOnTheHalfShell • mastodon (AP)

If I remember correctly back in the day when I was sticking my nose into PKI 1024 key was considered minimal.

Am I misunderstanding something here?

Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@GhostOnTheHalfShell that's RSA not EC, very different
@GhostOnTheHalfShell
Link to source
Cliff Barbier
Cliff Barbier • mastodon (AP)
Earnest question from ignorance: Is this something that can be scanned for? If so, why isn't it something being scanned for? Because no one thought anyone would be silly enough to do it?
Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@cliffb_infosec because nobody thought anyone would do it
@cliffb_infosec
Link to source
Cliff Barbier
Cliff Barbier • mastodon (AP)

But it CAN be scanned for?

Sorry if the answer is obvious to you, but I know the workings of PKI better than I know encryption implementations... But I DO know that the devil is in the implementation details.

Link to source
210561 ✨ [Q]
210561 ✨ [Q] • mastodon (AP)
@cliffb_infosec it can be scanned for, and almost certainly will in future
@Cliff Barbier
Link to source
Pippin
Pippin friendica
@Cliff Barbier @210561 ✨ [Q] I guess kind of in the same way airports didn't specifically scan shoes until one idiot tried to rapidly combust their shoes on a plane, and now we'll have to take our shoes off every time until the heat death of the universe.
@Cliff Barbier
Link to source
1