HN

Need help?
<- Back
Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

hkc

Comments (209)

  • jasonjayr
    > It's fortunate that the steps required here aren't particularly complicated for the devices you can update, and the advice essentially boils down to 'update them'. The problem is the devices you can't update or update easily.> Update everything that ships a CA bundle: your OS ca-certificates package, certifi, Node, Homebrew, and rebuild your container images once the base images pick up the change.> Devices you can't update are the hard part. Routers, printers, TVs, appliances with frozen firmware will trust these certificates until expiry, which is July 2039...Quick -- we need to MITM all the smart TVs so they can be jailbroken in one fell swoop!
  • russfink
    > One of eMudhra's certificate authority private keys is the number 4.https://imgs.xkcd.com/comics/random_number.png
  • john_strinlai
    new email from wayne, who is the original reporter:"I've had more than a few emails asking on how this was discovered. The simple answer is: https://github.com/google/paranoid_cryptoYeah, out of the box. CCADB was intended to be a quick corpus test before looking at subscriber certificates...I've done a far more thorough check of all existing CCADB certificates, thankfully no more hits. Most of my time has been spent going over the basics that everyone assumed someone else had already done - a critical mistake to ever make near security.So unless someone has significantly more computational resources or access to more cryptanalysis research the low-hanging fruit has been caught so far."https://groups.google.com/a/mozilla.org/g/dev-security-polic...
  • jlmorton
    In retrospect, having 100 trusted certificate authorities might have been excessive.
  • WalterGR
    Related: https://news.ycombinator.com/item?id=50166579“eMudhra intermediate CA compromise” | 947 points | 19 hours ago | 408 comments
  • charles_f
    I reckon that was an attempt to fend off the enemy. "Everyone expects us to set 196 bits of entropy, but you know what they won't expect? A single byte!"
  • Ambroos
    My oven (which has a camera and WiFi, don't ask, it's a great oven otherwise and doesn't exist without WiFi) received a software update this morning. I can't help but wonder if it's related.
  • bombcar
    Of COURSE it's easy to crack, 4 isn't even prime!
  • seanalltogether
    Quick question for the crypto experts. I thought that the goal of a true random number generator was that all values between 0 and MAXCOUNT are equally likely, and therefore all private keys between those values are equally likely. Is this not true? If people are going to attempt to brute force your key, don't you want the floor to start at 0? If the floor is higher, won't the brute force start higher too?
  • irusensei
    Okay hear me out. People are complaining about unpatcheable IOT device and thats indeed concerning. But can’t we use the bad keys to generate seemingly value certificates that can be used to jailbreak these devices?EDIT: seems its already happening? https://x.com/otomir23/status/2112697830687047918
  • jesuswasjew
    This does not look like blunder; more like espionage. The bigger guys are throwing emudra under the bus.
  • supernes
    Two more things to note about impact assessment: Flatpak uses the selected runtime's baked-in trust store (I think), so any apps may be susceptible even if you update the system package. Containers also don't inherit the host's trust store and use the one from the base image.
  • nmeofthestate
    I wonder how someone stumbled upon this - maybe leaked by someone inside eMudhra?Since there's nothing to indicate that the private key was all zeroes and one non-zero lsbyte, and presumably nobody would try to brute-force a private key.
  • tclancy
    I will say, there’s something almost reassuring when something goes boom that badly and the story is really silly. It’s like [horrific human-caused disaster] but it’s because of a Three Stooges episode.
  • tniemi
    Someone used the Dilbert random number generator. https://www.random.org/analysis/
  • TazeTSchnitzel
    Could HN start feeding submissions through Pangram so us human readers don't have to suffer with reading the nauseating AI-prose?
  • megous
    Well, so what now? It's not like I have these in my system CA store, they're just intermediaries cross-signed by sectigo.
  • childintime
    1. So there was no certification of the certifiers?2. This is stupidity that rises to the level of being malicious. There is no excuse, this was a fraud. Their business was literally to promise security and.. make a profit. Nothing was ever delivered.
  • positive-spite
    That's some criminal negligence right there.8 bits is crazytalk!
  • mnx
    I made test.key4.lol if you want to quickly check if your device/browser is vulnerable still.
  • Qision
    It feels like they chose the private keys by hand.
  • Gabrys1
    This has a big upside: I can now MITM any Android app / IOT device without any suspicious set up on the device? (given it'll run on the unupdated OS and that cert revocation is not ON).
  • maeln
    eMudhra explanation : https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11Kind of hard to understand how a bug would have generated a second pair of key so bad, and how would human would have ended up using them. Never attribute to malice what can be attributed to stupidity, but sometimes you wonder.
  • jesuswasjew
    My izzat is down right now.
  • kyleomalley
    Question: what about the other trusted roots? Has anyone tested them?I’ve tested most of them (from historical archives) and have automated testing any new CA certificates that show up in CT.I’m calling the check “luggage code entropy” (1 byte).It was a mistake to trust so many root CAs and misapply the same level of trust where clearly it is impossible to independently verify and most of the accountability is smoke and mirrors. We need to be asking “why” here, the stated reason needs to be much more than “because webtrust audit” and “we recorded the entire operational process for key material handling on YouTube with this open source implementation of key ceremony tooling and have underwritten the strength of the private key with a few $mm dollars, to be paid out to the rest of the roots for the shared reputational damage to the entire ecosystem should we fuck up (intentional or otherwise).
  • eviks
    > recovered all of them from their public certificates on my laptop just now, and it took less than a second.Why wasn't this second spend by the parties accepting those certificates as valid before they were accepted?
  • bandrami
    Shakti de. This should be firm-ending for them but I fear it won't be.
  • hypfer
    This is not a good write-up. Yesterday's discussion did contain better data, less self-Promotion and actually asked why it happened, instead of just saying "number small".
  • ligarota
    Man in the middle just for the love of the game
  • dbcooper
    All the numbers were under 384. Surely they couldn't have ...
  • sscaryterry
    I wouldn't be surprised if we learn in the near future, that this was deliberate.
  • dist-epoch
    > and no TLS certificates chaining to these CAs ever showed up in CTWhy are browsers trusting CAs which issued zero certificates since their creation 1 year ago?
  • sylware
    The CA concept itself is flawed, unless normal users were able to cherry pick the CA they do trust, dream. And even with that, they must keep in mind that many authorities and/or mafias have very probably rogue certificates for browser invisible man-in-the-middle.
  • m3kw9
    This has to be a backdoor planted by hackers, mess with the key gen, say is all good. Must be known since issuance.
  • joelkoen
    Someone else has published usable .key files here: https://github.com/Fluepke/emudrahahahahaha
  • anon
    undefined
  • koolba
    What the chances there’s another CA key out there with something like unix time as the key?
  • siwatanejo
  • anon
    undefined
  • AlexITC
    Another very unfortunate even next to the php, fun times we are living in.
  • naabozaurus
    hey, at least it was easy to remember...
  • anon
    undefined
  • freebsd_lovefes
    [dead]
  • anon
    undefined