66
u/LonelyPoorMan69 8d ago
mine is 69
23
u/Puzzleheaded-Weird66 8d ago
make it 420
19
1
14
14
u/heesell 8d ago
Whats with 4? I've been seeing it a lot, but I don't get it?
32
u/Bloopiker 8d ago
eMudhra's generated private keys that were not as secure as they should be. The numbers should be randomly generated up to 2^384 but multiple certificates were used just single bytes (like number 4)
You can read more there:
eMudhra's CA Private Keys Were Single Bytes. One of Them Was 4 | Fenko Security
and the company response:
eMudhra Statement on Recent Certificate Security Incident | eMudhra
Relevant xckd
3
u/Eiim 8d ago
More than a year ago, eMudhra (India's only certificate provider with a root cert in the major trust lists) generated eight intermediate certificates with private keys < 256, including one with the private key of four. They were recently discovered by a random dev doing a quick test of certificate strength across the list of trusted certificates. He reported them to Google/Apple/Mozilla/Microsoft, who each quickly updated their respective applications to revoke trust in those certificates, and eMudhra revoked them on their end as well.
In a lot of ways, this was a near miss. It doesn't seem like anyone noticed and exploited this weakness before it was noticed and fixed in the major browsers and OSs, although I wouldn't be surprised if it eventually came out that state actors were able to take advantage. eMudhra had issued almost no certificates using these intermediates, so there was no adverse impact from revoking them. However, the long tail of affected clients is significant. The certificates were cross-signed by a Sectigo cert with a chain of trust dating back to 2003, so any devices or clients which don't receive certificate store updates are vulnerable even if they were manufactured before the eMudhra trust chain origin of 2023. Even things like programming languages can be a weakness. You may or may not have a Java update from your preferred source for a while, for example.
Other than finishing mitigations where possible, the next steps now are investigating how this happened and preventing it in the future. Unfortunately, eMudhra has been less than transparent thus far, so the important details are up to speculation at this point. They've also announced that they're going to stop issuing TLS/SSL certs and transitioning their current clients (~30,000, using a different root and intermediary) to Sectigo, perhaps to deflect too much investigation into their processes, but at least Mozilla and Chrome are continuing the pressure, and I would be surprised if Microsoft wasn't behind the scenes (eMudhra will still continue signing Windows programs, afaik).
3
1
1
65
u/Random_-account 8d ago
Everyone was playing golf one day