One of eMudhra's certificate authority private keys is the number 4.
Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their
That’s a good point. I’m well aware of this issue but OTOH it was 15 years ago and I din’t have it around in my mind; I had it not long ago while maintaining the openssl ubuntu package (as not to do the same) but not anymore once being from a different context. This could be enough that the first rationale step becomes to bruteforce a bunch of values even though it’s not a perfect match as the range of private keys didn’t start at 0 but at some time shifted by some amount.
That’s a good point. I’m well aware of this issue but OTOH it was 15 years ago and I din’t have it around in my mind; I had it not long ago while maintaining the openssl ubuntu package (as not to do the same) but not anymore once being from a different context. This could be enough that the first rationale step becomes to bruteforce a bunch of values even though it’s not a perfect match as the range of private keys didn’t start at 0 but at some time shifted by some amount.
score 1 · canonical