Hacker News new | past | comments | ask | show | jobs | submit
nunez | on: eMudhra to exit global SSL/TLS certificate business
That's INSANE

Like, that had to be malicious right? ssh-keygen won't generate a key like this, and neither will openssl or whatever Microsoft is doing behind their CA server.

persedes | parent | next
It's 0x0000000000000000000....4, but no, just good ol' human failure (and a bunch of extra f-ups along the way)
xienze | parent | next
The other keys were 56, 66, 115, 155, 156, 230, 237. I honestly think whoever did this thought the "384" in 384-bit meant they had to choose numbers between 0-384.
loading story #50199014
loading story #50216352
jms703 | parent | next
You should read the report from mozilla.
collinrapp | root | parent
I assume you’re referring to [1]? If so, I just did after seeing your comment. I couldn’t help but chuckle at the demonstration of how easy it would be for someone to obtain the private keys themselves using an LLM, even though it’s easy to crack without one….

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

alias_neo | parent | next
Maybe it was just a mistake and they intended to generate a `--bitsize 4` thinking it was in kilobyte units.

shrug

I think they're just absolutely inept and should never be trusted with anything security related as an organisation if this is a mistake they could make.

alienbaby | parent
Getting any number as your key is as likely as getting any other number, I thought? 4 is as likely as 64257383994662784857722891857 etc ..?
loading story #50198944
OkayPhysicist | root | parent | next
Sure, but the probability of getting "4" as opposed to some number that might as as well be equivalent to latter as far as a causal reader is concerned is insanely small.
nunez | root | parent
and it's more surprising that the program that was used to generate the key isn't like "uhhh no"
loading story #50198699