upvote

points

by sscaryterry14 hours ago |
comments
upvoteby edent13 hours ago|
next
[-]
I'm not so sure. If you wanted to be deliberate, you'd choose a plausible value that you could control.

No one is going to suspect `98761316832165974216498789746` is anything other than random. But `000000000000000123` looks suspicious.

reply
upvoteby K0balt12 hours ago|
parent|
next
[-]
But that would be obviously intentional. Much more plausible deniability with 0x4.
reply
upvoteby sscaryterry13 hours ago|
parent|
prev|
[-]
Why are many of them, suspicious?
reply
upvoteby kenniskrag13 hours ago|
parent|
next
[-]
The probability of getting a 0 is the same for every digit. However, in my opinion, the probability of getting a number that starts with two zeros is 1/10 * 1/10, and the probability of getting a number that starts with the same two digits is 10 * 1/10 * 1/10.

But the probability to receive one number or the other are the same.

reply
upvoteby matsemann13 hours ago|
parent|
prev|
[-]
By random chance you probably wouldn't get that many zeros. Of course, one could say it's just as random as any other string, but..
reply
upvoteby sscaryterry13 hours ago|
parent|
[-]
Not a mathematician, but I'm sure the probability of them all being below 384 is going to be in the order of 0.000000001% if not less :)
reply
upvoteby betterunix29 hours ago|
parent|
next
[-]
Sure, if they were actually sampling 384 bits. Sounds like they sampled a lot less than that; maybe someone though "384 bits" meant "in the range [0, 383]" or whatever.
reply
upvoteby kenniskrag13 hours ago|
parent|
prev|
[-]
10 times the amount of digits is the possible number space.

smaller than 384 means 384 numbers (including 0) divided by the amount of possible numbers (see above) imho

reply
upvoteby SAI_Peregrinus11 hours ago|
parent|
[-]
It's a 384-bit curve, so between 0 and 2^384 which has about 115 decimal digits.
reply
upvoteby hannob13 hours ago|
prev|
next
[-]
Makes no sense.

If it was deliberate, one would use keys that only the person abusing it has. Not keys everyone can guess if they get a hint.

reply
upvoteby bombcar12 hours ago|
parent|
[-]
Deliberate deniability - if you leak a real key, it's pretty obvious you leaked a real key.

Here, you didn't leak anything, you just fucked up.

reply
upvoteby yoavm14 hours ago|
prev|
next
[-]
Why would it be?
reply
upvoteby sscaryterry13 hours ago|
parent|
[-]
Do I honestly need to enumerate what you can do if you have the keys for a CA?
reply
upvoteby swiftcoder13 hours ago|
parent|
[-]
Yeah, but if you are the one issuing the CA's private key, you already, by definition, have the keys to that CA. You don't need to make stupid keys in that scenario
reply
upvoteby sscaryterry13 hours ago|
parent|
[-]
In case it wasn't obvious. The NSA and many other organisation would find this extremely useful.
reply
upvoteby yoavm13 hours ago|
parent|
[-]
But it doesn't make sense. Sure they'd find it extremely useful to have the key, but it doesn't need to be a weak key for it to be useful. If anything, it makes it less useful to them.

If I'm going to ask you or force you to share your password with me, there's no reason I'd ask you to set the password to 4. We might as well agree that the password would be D#!(s9fj0jalk!4af095SF42 , and it's much more likely our collaboration will continue working for years.

"Never attribute to malice that which is adequately explained by stupidity"

reply
upvoteby skinfaxi11 hours ago|
parent|
[-]
A weak key means use is unattributable.
reply
upvoteby NetMageSCW8 hours ago|
parent|
[-]
A secret strong key is also unattributable.
reply
upvoteby skywhopper13 hours ago|
prev|
next
[-]
Sounds more like extremely sloppy procedures. Which depressingly I doubt are unusual among CAs.
reply
upvoteby sscaryterry13 hours ago|
parent|
[-]
As far as I know, to become a CA, with the requirements and ceremonies involved, this type of mistake must never happen. Assuming malice instead of ignorance is reasonable here. The entire premise of a CA, is trust.
reply
upvoteby woodruffw12 hours ago|
parent|
next
[-]
There are a lot of CAs that are essentially grandfathered into root programs (and there’s no “one” root program, every OS and verifier gets to choose their own inclusion policies). They might need to jump through hoops to stay in any given program, but being there in the first place is not a strong indicator of quality.
reply
upvoteby chrisjj6 hours ago|
parent|
prev|
[-]
> The entire premise of a CA, is trust.

No need for trustworthiness, then. /s

reply
upvoteby betterunix29 hours ago|
prev|
[-]
I would be shocked if this was anything other than a bug. A CA already has the power to issue MITM certificates, so what reason would a CA have to deliberately generate bad keys?

In all likelihood it is code that reads 1 byte from /dev/random, or reads 32 bytes but writes it into a 1 byte array, or something to that effect.

reply