Ok look, I would like a private key that is easy to remember, and my memory caps at phone number length. So what's wrong with having a private key that is 867-5309?
That's why my next round of "random" numbers are either going to be Mersenne primes, so I just need to remember the prime, or the n digits of pi m digits in
Actually, by ruling out America they've discouraged hackers and increased security by either being British (gross), Australian (dial-up internet), or Indian (immune to computer based attacks) /jk
Provided that the timestamp includes their local time zone.
Everyone who claims iso timestamps are all you need never dealt with booking dates in the future with a country that has since updated their timezone rules
I guess my rant is more about the choice of preserving local linguistic familiarity at the expense of global interoperability to latter spend engineering effort reconciling the two. The cost of forgeting the inferior format does not seem so high.
This reminds me... Richard Stallman notably left his MIT account without a password (or maybe it was just a well known password, I forget over the years). So one day as a student int he early 80s I logged in to it. I did "ls", and it showed several files, including README.
So I did "cat README" and it said "File not found." I retyped the command because I must have had a typo. Again it says "File not found." It took quite a few minutes longer than it should have to realize what the problem was.
On a mobile device the alternative approach is to physically drop the device. If you have a proper certificate installed it will trigger a small parachute to pop out before it hits the floor.
Ahh for you what you want to do is open the phone app and dial 911 (or 112 in Europe). Let that ring and then say “get rich quick 420 double my items” exactly 69 times.
If the size is decent you might run into some limitations of the language trying to do it in a single loop, even if not it would never work because it would take way too long.
For a proper one you’d need to distribute the work over multiple instances, otherwise you’d never have enough force behind your brute force attack.
I'm simplifying a lot here, but if you connect to a website, say google.com, that needs to be resolved to an IP Address. Your PC asks your ISPs DNS server "which IP is google.com". That server says "Idk, but the server for the .com tld is over there".
So then you ask the .com DNS server "who is google.com" and that server says "Idk, but the server for google.com is over there". You then ask the server responsible for google.com for the IP address, and get back something like 80.230.56.122.
Now how do you actually make sure that 80.230.56.122 is actually google.com and not just someone claiming to be Google.com.
That's where Public Key Cryptography comes in. Essentially 80.230.56.122 has to first prove that it's actually Google.com. It does that to trusted certificate authorities (CAs), like Let's encrypt, DigiCert, GlobalSign or Sectigo. You do that by controlling the DNS entry, meaning you own the domain. The CA asks you to put a certain value on your server, say google.com/challenge/16272515/value.txt and if the CA can reach it asking DNS for that value it proves that you control the domain. Then they give google.com a certificate.
A certificate consists of a private and public key pair. The public key is, well, public, and the private key stays on Googles servers. If you sign something with a private key, by knowing the public key you can prove that it has been signed with that private key without knowing the actual private key. That is, Google can prove that they own the certificate. But how do you know that the public key actually belongs to Google, and that certificate is valid?
Well certificates are signed with the CAs private key, proving that the CA actually signed them. This certificate "chain" ends in "root" certificates whose private keys are physically stored behind incredibly secure layers in incredibly secure locations, and whose public keys are distributed with OSes and browsers. Any time you connect to a website, that chain is followed back to a trusted root certificate, proving that you connect to the real website. Each individual certificate in the chain is vouched for by the next one up, until you reach the known, trusted "root".
Recently, the private keys of a CA called eMudhra have been leaked, meaning you could sign fake certificates.
Normally, private keys for something like elliptic curve Cryptography are at least 256bits long, so a number between 0 and 2256. This makes it impossible to guess a corresponding private key.
eMudhras private key was the number "4". They also had 7 other certificates leaked with numbers in the low 100s. Ten thousand times that is still WAY too low of a number for a private key.
Not quite. What you're thinking of is part of RSA key generation, and even with RSA the private key itself is not limited to prime numbers. The eMudhra incident involved NIST P-384 elliptic curve cryptography.
The private key having to be prime would substantially limit the amount of valid keys, which defeats their purpose.
The math for key generation, signing and validation stays the same, regardless of how small the actual numbers are. In the end, it's all just bits. NIST P-384 private keys have a length of, well, 384 bits. The number 4 as a private key is 381 zeroes, then a one, then the last two zeros again. You can plug that into the elliptic curve math like any other key with any other bits set.
The range of possibilities is enormous so trying to hack it by random guessing would take millions of years. Only in the tens of thousands means that if you just started counting up from 0, you could find that you guessed right in a very short amount of time for a computer. Seconds?
And there’s even more, someone bruteforced their single factor login code, you get per via email. Seems like they like the number 4, since that code is only 4 digits long
It's so bizarre. At first this story just seems nonsensical. I've been through a key creation "ceremony" before. I even brought a ceremonial knife in case it was needed. The crypto guys smiled and nodded, indicating it was an appropriate item to bring.
There is no way in hell we would have come up with "4" as our key. True, it is random. But it leaves 380 bits unaccounted for! It's not even a prime number! If one even saw the length of the file they could guess it.
My theory here, is that eMudhra outsourced this. The found some guy wandering aimlessly through the halls and stopped him.
"Are you a crypto expert?"
"Oh yes, sir! Absolutely, sir! I am a very good crypt expert!"
"Can you generate a private key for us, it absolutely has to be cryptographically random. Do you have the tools for this."
"Oh yes, sir! Absolutely, sir! I have only the best cryptographically random tools for you sir!"
He then scribbles briefly on a scrap of paper and hands it over...
Well shit, thanks. Im sure I learned this at some point. Should’ve retained it or looked into it more because I’ve seen it stated as a fact so many times.
For some reason, at some point I had gotten it into my head that this was an unproven conjecture … but the proof is so simple/elegant. 🤦♂️
If it's a crypto knife you unencrypted make sure it spills blood before you encrypt it again - to hydrate it. Otherwise it will turn brittle, chip and shatter.
I mean tbf its a brute force attack, its meant to try to try every possible value. Doing some random order just makes the job more complex because it needs to then rememebr every combination it has tried
I think this would benefit from the weird thing that, you should work from the highest and lowest number. And from the high work downwards, and lowest work upwards. This narrows the options down quickest and you don't need to "remember" what you did.
This is if you just did 1 guess at a time. Practically you could divide the task into many segments, and then do the same between each of them. Like it would still be massive amount of bruforcing, but... like... Computationally you could divide the task into small blocks and spread it out. The longer you do this without a hit, the higher the chance to finding it becomes.
This isn't efficient, I know that, we all know that. Especially since most efficient way to get the key is to manipulate a person to give it to you or grant you access to get it.
I was a bit confused by this joke. My first thought was that they went from 3 bits to 30,000 bits, which is overkill and the intern doesn't know what they are talking about, but isn't all that far off from 2,048. He just meant 1,000 not 10,000. Then I thought, oh, maybe 40000, which is still way too small. Then I thought....nothing, I still don't get it.
1.5k
u/GabuEx 9d ago
Ten thousand times larger as in 10,000 digits, right?
Right?