This question seems to be answered in another comment now: https://news.ycombinator.com/item?id=50180284
replyI suspect that they read the article last Friday about Claude finding the origin of the ECDSA constants. That was only a few hours before Google received the vulnerability report.
replyThe two cases are very similar. The only difference is that the weak randomness was harmless in the earlier story, and here it’s devastating.
Of the thousands of people bored with a swarm of AI agents, is it not plausible that somebody would just say "hey, let's do a vibe check to see whether any CAs are trivially crackable"?
reply> and presumably nobody would try to brute-force a private key.
replyWhy not? There are examples of RNGs providing very poor entropy which might be a reason to check it (looking at you Sony).
Just seems weird for anyone to focus on trying to crack private keys starting with absurd 8-bit values that "nobody would use for a private key", let alone bother to do it at all, given the search space.
replyI would not expect anyone to be on the lookout continuously, but like the researcher doing a "yolo" and trying. There are enough people out there that it is likely to happen at least once in a while. Or for instance someone looking for a firmware exploit in a downstream device.
replyAnd here you learn why security is often just theater (not saying a proper elliptic key is theater)...
replyIt took less than a second to factor this key. Why not attempt, say, to factor every CA, with a budget of less than a minute each?
The reward/risk ratio is skewed so heavily in favor of trying, the only reason not to is this idea that it is "impossible".
It's clearly not, hence, the theater. Your locks don't have to work, they often only have to look like they work...
Factoring is for RSA. The best non-quantum attack against ECDSA is meet-in-the-middle brute force, with sqrt complexity. With RSA you can check if any keys in the world have any low factors and that might be interesting to do, even if you don't get any complete keys. With ECDSA the search is all or nothing and without an obvious starting point.
replydeleted
reply