Comment on PSA: eMudhra Intermediate CA Compromise

artyom@piefed.social ⁨2⁩ ⁨hours⁩ ago

• rtxn@lemmy.world ⁨1⁩ ⁨hour⁩ ago

  The encryption that SSL/TLS provides (that puts the “secure” in HTTPS) uses a public–private key pair and a mathematical function that is easy to calculate, but difficult to calculate its inverse. Generating the key pair requires a cryptographically secure random number that is impossible or very difficult to guess, which must be kept secret at all times. If this random number is leaked or guessed by a malicious actor, the private key can be reconstructed and used to impersonate a website or break the encryption.

  One of the factors that determine the security of the key is the size of the number, i.e. the number of digits. In this case, a proper key should’ve had a length of 384 bits (or 116 decimal digits). In reality, the keys that eMudhra used had eight bits, which can only represent 256 possible values, and can be easily guessed even by brute force. The specific private keys were the numbers 4, 56, 66, 115, 155, 156, 230, and 237.

  source

  • Triumph@fedia.io ⁨1⁩ ⁨hour⁩ ago

    ... Eight? Eight???

    source

    • rtxn@lemmy.world ⁨1⁩ ⁨hour⁩ ago

      Four… Fucking… Pixels?

      The working hypothesis is that this was some sort of debug or test key that was never meant to be used in production, being used in production.

      source
    • Skullgrid@lemmy.world ⁨1⁩ ⁨hour⁩ ago

      www.youtube.com/watch?v=87H6m2v4zNs

      source
• thenextguy@lemmy.world ⁨2⁩ ⁨hours⁩ ago

  Not possible.

  source