Conversation
Edited 11 days ago

honestly? call me crazy but I don't think it's coincidence that the private key was literally 4. I think that's the clearest hint we have that this was either testing infra or a backdoor. (but yes, it could still be coincidence, of course).

https://xkcd.com/221/

edit: this is actually not to say eMudhra/EmSign was in some way malicious, it could've been planted by some spy employee, or be the result of some supply chain attack, etc, it just, comes across incredibly sus I guess.

3
1
0

okay for those who aren't in on the news yet, here's a short summary:

A certificate authority named eMudhra (also brand EmSign) has had a whole chain of their certificates bruteforced/leaked, seemingly because they were extremely trivial keys that were mere simple numbers (like 4).

I guess it could've been human error by taking e.g one character (as byte) from a string and setting that as key, which seems.. unlikely?

Their official answers are here: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11 (thanks @nspace )

0
2
0

@anthropy correction since i have seen the backdoor bullshit elsewhere:

there are several affected keys, all of them have a private key smaller than 256. they just accidentally used 1 byte instead of 24

1
0
1

@charlotte honestly I am not ruling that out because if they had to set some byte array and they just copied one byte instead of all the bytes it could happen.

it just .. still feels sus in a world like that I guess, it would make building backdoors easier, and you could as person just write it down easily to extract it from the company.

but perhaps I'm wording it a bit overzealous, it's more like a suspicion than "I presume the worst", it's just.. such a suspicious coincidence I guess.

1
0
0

@anthropy it’s not a backdoor, whoever would have put it there wouldn’t want other parties to abuse it too (which is trivial in this case)

1
0
0

@anthropy (and basically there are better ways to backdoor the ca, for example just exfiltrating the generated key or forcing them to sign stuff you want)

0
0
0