4 times the SECP384-R1 base point is (0x138251cd52ac9298c1c8aad977321deb97e709bd0b4ca0aca55dc8ad51dcfc9d1589a1597e3a5120e1efd631c63e1835, 0xcacae29869a62e1631e8a28181ab56616dc45d918abc09f3ab0e63cf792aa4dced7387be37bba569549f1c02b270ed67)

https://repository.emsign.com/certs/EMOVTLSCAG3C.crt

for the non-cryptographers at the back of the room: the private key is 4, just the number 4, nothing more

Certificate:
    Data:
        Version: 3 (0x2)
        Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3
        Subject: C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                pub:
04:13:82:51:cd:52:ac:92:98:c1:c8:aa:d9:77:32:
1d:eb:97:e7:09:bd:0b:4c:a0:ac:a5:5d:c8:ad:51:
dc:fc:9d:15:89:a1:59:7e:3a:51:20:e1:ef:d6:31:
c6:3e:18:35:ca:ca:e2:98:69:a6:2e:16:31:e8:a2:
81:81:ab:56:61:6d:c4:5d:91:8a:bc:09:f3:ab:0e:
63:cf:79:2a:a4:dc:ed:73:87:be:37:bb:a5:69:54:
9f:1c:02:b2:70:ed:67
                ASN1 OID: secp384r1
                NIST CURVE: P-384

@q are you fucking kidding me?

@nyanbinary I wish I was

@q h-how????

@q OH COME THE FUCK ON, WHAT IS THIS, AMATEUR HOUR?!

@dequbed evidently, it is

@q someone finally beat sony at ecdsa fuckups?

@r yes, somehow

@q i see you doing ninja-edits (for better scicomm?)

@q ...they did WHAT?

@hexchen XKCD 221

@dequbed @q ONE JOB. They had one fucking job. -.-

@elliewithcolor @q wanna bet this is the result of whatever scuffed migration from RSA they implemented going "we want our exponent to be small because that's good practice. But hey there's no exponent here. Oh well, let's just pick this random number and keep it small, that's the industry standard practice after all!"

@dequbed @elliewithcolor given what their cert repo looks like, could well be an LLM based cockup https://repository.emsign.com

@r yes, actually

@q ELI5? I have almost zero knowledge in crypto and don't understand it.

@cccpresser the private key for a certificate that can attest for other websites (super super secret) is the number 4

yes its as stupid as it sounds

@Mae all their private keys are <256, this isn't some RNG accident

@q

@q yeah it seems all of their certs got one (1) byte of randomness in their private key. frankly bizarre. how do you even fuck that up

@q I checked their other intermediates; they are 115, 155, 56, 66, 156, 237, and 230.

I think they used a real RNG but only requested one byte

@q Ok, so 4 is the answer (even more stupid that 42, I do agree). But what was the question? Whose door does it open?

@martaczc HTTPs certificates

@q I thought that small numbers like that would be automatically rejected or something? Maybe I'm misremembering. Or was that RSA?

@jendrik that’s RSA

@q How has no-one ran into this yet? Or was this so stupid that no-one even bothered to try because “nobody could’ve chosen a key this simple”?

@OverSoft nobody could’ve possibly been that stupid!

@cccpresser cryptography, basically, is doing math with input data, and a secret number. You want secret number to be big and random, so no one could guess it and undo your math

number 4 is, obviously, neither big nor very random...

@q

@mo @cccpresser @q

I'm no expert so tell me where I'm wrong:

1. If you have a large range from which to choose a number randomly then 4 is entirely possible.

2. The criterion is a number hard to factor.

Is that right?

@rzeta0 @mo @cccpresser 2 is only true for RSA keys, this is ECDSA

@q WHAT DO YOU MEAN ITS 4???!????????

@jplexer its 4, the secret number is 4

@q /cc @da_667 guess it's time to add anything signed by this entire CA to the IoCs list lol

@gsuberland @q @da_667 Mozilla ban hammer in 3,2,1...

@phlash @gsuberland @da_667 already distrusted

@q

If I remember correctly back in the day when I was sticking my nose into PKI 1024 key was considered minimal.

Am I misunderstanding something here?

@GhostOnTheHalfShell that's RSA not EC, very different

@q

Earnest question from ignorance: Is this something that can be scanned for? If so, why isn't it something being scanned for? Because no one thought anyone would be silly enough to do it?

@cliffb_infosec because nobody thought anyone would do it

@q

But it CAN be scanned for?

Sorry if the answer is obvious to you, but I know the workings of PKI better than I know encryption implementations... But I DO know that the devil is in the implementation details.

@cliffb_infosec it can be scanned for, and almost certainly will in future

@elliewithcolor @dequbed @q
Well. It is… the simplest number to do a prime number refactoring on.
But we *can* do a prime number refactoring on it.

(If that's too easy for you, increase the refactoring difficulty. Use 6 instead of 4.)

@musevg @elliewithcolor @dequbed primality has nothing to do with this, this is EC not RSA