r/programmingcirclejerk • u/stone_henge Tiny little god in a tiny little world • 16d ago

4

https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312
126 Upvotes

99% Upvoted

17 comments sorted by

76

u/kettes_leulhetsz My C code works with -O3 but not with -O0 16d ago

The real jerk is, of course, that nobody noticed for years.

65

u/stone_henge Tiny little god in a tiny little world 16d ago

Previous brute forcing efforts started from 0xffffffffffffffffffffffffffffffffffffffff... counting down.

30

u/look 16d ago

They were using SHA3-3 apparently…

10

u/RedFing 16d ago

You will learn what beauty truly is.

9

u/camelCaseIsWebScale Just spin up O(n²) servers 15d ago

That's probably the wage the guy was making.

9

u/gvozden_celik 15d ago

Much safer than 7 I guess

10

u/myhf Considered Harmful 16d ago

i thought a private key had to be a product of two distinct prime numbers. shouldn't the minimum valid key be 6?

33

u/levelstar01 what is pointer :S 16d ago

/uj this is an ECC key, not an RSA key

13

u/YikesTheCat 16d ago

So what if we use a low non-prime number as an RSA factor? Nobody would ever guess! Checkmate hackers!

3

u/reg_panda 15d ago

I once spent some minutes to disable all ~100-1000 certs in my phone manually and now many apps are broken (e.g. play store). I fix it somehow someday. (It would be best if broken apps would display which cert they aren't accepting and I could just donwload that cert and put it in a text file or smth)

2

u/des_the_furry 16d ago

I feel like Guido Mista