One of eMudhra's certificate authority private keys is the number 4.
Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their
There was a similar case — generalising from Debian OpenSSL incident seems to be not too hard for an entity with no issues spending energy on out-there checks just in case.
Of course, Debian incident was still using a PRNG on top of weak initialisation, but there were RSA keys so non-coprime distinct public keys were a giveaway.
I think some of the generic attack algorithms are slow but fast in the extreme cases (like here)? So running them with a timeout is a reasonable generalisation of «there are some weirdly weak keys around»
That’s a good point. I’m well aware of this issue but OTOH it was 15 years ago and I din’t have it around in my mind; I had it not long ago while maintaining the openssl ubuntu package (as not to do the same) but not anymore once being from a different context. This could be enough that the first rationale step becomes to bruteforce a bunch of values even though it’s not a perfect match as the range of private keys didn’t start at 0 but at some time shifted by some amount.
There was a similar case — generalising from Debian OpenSSL incident seems to be not too hard for an entity with no issues spending energy on out-there checks just in case.
Of course, Debian incident was still using a PRNG on top of weak initialisation, but there were RSA keys so non-coprime distinct public keys were a giveaway.
I think some of the generic attack algorithms are slow but fast in the extreme cases (like here)? So running them with a timeout is a reasonable generalisation of «there are some weirdly weak keys around»
score 1 · canonical
That’s a good point. I’m well aware of this issue but OTOH it was 15 years ago and I din’t have it around in my mind; I had it not long ago while maintaining the openssl ubuntu package (as not to do the same) but not anymore once being from a different context. This could be enough that the first rationale step becomes to bruteforce a bunch of values even though it’s not a perfect match as the range of private keys didn’t start at 0 but at some time shifted by some amount.
score 1 · canonical