Conversation

Charlotte lotteheartplural/Cinny cinny_heart_plural thetadelta ursaminor treblesand

if you ever feel like an imposter, just remember that your cryptographic keys are probably both less leaked and more random than eMudhra’s CA keys that up until recently could be used to issue trusted TLS certs for most sites

3
22
43

Charlotte lotteheartplural/Cinny cinny_heart_plural thetadelta ursaminor treblesand

Edited 3 hours ago

how do you even recover from “our really shitty hand-rolled ecdsa accidentally only includes 1 byte of randomness as the least significant byte” as a company that sells encryption to governments

3
14
31

@charlotte it's time to add Honest Achmed's root CA to all stores

0
0
0

@charlotte I feel so much better now! blobPikaLaugh blobPikaScream

0
0
0

@charlotte waiting for the revelation that the insecurity was government enforced

2
0
0

@philpem @charlotte yeah i'm only about 99.999999% sure this was the case honestly

1
0
0

@vxo @philpem i am sure the same government could have made them reveal a reasonable private key also

1
0
0

@vxo @philpem baseless conspiracy theories are not welcome here, this is a mistake one reasonably could have made (ideally not in this fucking situation though) while a government in a position to enforce such a limitation on elliptic curve key generation to a security level of 8 bits (!) would have also been able to demand the private key or demand the company to sign stuff with said private key. this way anyone could have found and exploited the backdoor easily, which is not what authoritarian governments would want

1
0
1

@philpem @charlotte idk, wouldn't it be much more plausibly deniable to use a strong key and quietly give the government a copy? or at least only compromise one of the keys in this way?

even the argument of "well this way it looks like a genuine fuckup" doesn't really work I think, as I can't imagine anyone being willing to add them back to the trust store after this

0
0
1

@charlotte MPEG-LA will probably suggest they issue bogus DMCA takedown requests against the number four.

0
0
0

@charlotte @philpem ooooh thank you for that, I didn't realize just how wide open the barn door was on that. Yeah, that sounds entirely more like careless logic error than plant!

freaking Master lock-ass generator

0
0
0