Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

 (scotthelme.co.uk)

51 points | by hkc 1 hour ago

10 comments

  • jlmorton 14 minutes ago
    In retrospect, having 100 trusted certificate authorities might have been excessive.
  • bombcar 23 minutes ago
    Of COURSE it's easy to crack, 4 isn't even prime!
    [-]
    • DavidSJ 0 minutes ago
      In their defense, they were probably targeting the Mersenne prime 2^2 - 1 and just made a typo.
    • joshuat 19 minutes ago
      It’s really impressive no one caught their three previous private key values
      [-]
      • bcvvvy 13 minutes ago
        I suspect they did but it wasn't publicised.
  • WalterGR 21 minutes ago
    Related: https://news.ycombinator.com/item?id=50166579

    “eMudhra intermediate CA compromise” | 947 points | 19 hours ago | 408 comments

  • positive-spite 33 minutes ago
    That's some criminal negligence right there.

    8 bits is crazytalk!

    [-]
    • joshuat 20 minutes ago
      “4”

      hey chatgbg what is a “private key”

  • siwatanejo 7 minutes ago
    https://xkcd.com/221/
  • Qision 17 minutes ago
    It feels like they chose the private keys by hand.
    [-]
    • PalmPilotProMax 11 minutes ago
      Artisanal cryptography. Hand-picked private keys salted with organically sourced nonces.
      [-]
  • maeln 12 minutes ago
    eMudhra explanation : https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11

    Kind of hard to understand how a bug would have generated a second pair of key so bad, and how would human would have ended up using them. Never attribute to malice what can be attributed to stupidity, but sometimes you wonder.

  • naabozaurus 15 minutes ago
    hey, at least it was easy to remember...
  • TazeTSchnitzel 6 minutes ago
    Could HN start feeding submissions through Pangram so us human readers don't have to suffer with reading the nauseating AI-prose?