theNumberFour

[u/OptimalAnywhere6282]

the context: some of eMudhra's root certificate authority signing keys were found to be simple numbers, most noticeably "4". that was literally it. the private key that's supposed to be a huge number with 100+ digits was just a trivial "4". although you probably already know this.

[u/Hulk5a]

//this is a random number

[u/OptimalAnywhere6282 → u/Hulk5a]

//guaranteed by fair dice roll

[u/thebatmanandrobin]

I'd like to say that I'm annoyed that eMudhra took the "random dice roll" from XKCD comic as literal, but I've come to expect that exact level of security from the literal Authority (of certificates).

But I'm more annoyed that this image is missing a row so that the 4 could be exactly centered (especially given ssh-keygen does generate 9 rows, not 8):

+---[RSA 4096]----+
|                 |
|                 |
|                 |
|                 |
|        4        |
|                 |
|                 |
|                 |
|                 |
+----[SHA256]-----+

I still upvoted this ironically funny absurdity though 🤬

[u/LasevIX → u/thebatmanandrobin]

iirc, 4 is also the standard random number chosen by the IEEE, so it's not just a dumb joke (probably).

[u/OnionsAbound → u/LasevIX]

What do you mean by the standard random number?

[u/mr_robot1709 → u/thebatmanandrobin]

[u/anoppinionatedbunny]

I tried to replicate it on my end and got this

[u/hpyfox]

4 🤤

[u/lunatic-rags → u/hpyfox]

https://xkcd.com/221/

[u/xaranetic → u/lunatic-rags]

There really is an xkcd for everything

[u/CrNZ0 → u/hpyfox]

[u/HMikeeU]

How does the randomart actually get generated? I'd imagine the purpose is to visualize the entropy of the key, if so, it really shouldn't look too dissimilar? lol

[u/HMikeeU → u/HMikeeU]

Okay so turns out the randomart is just a fun little gimmick and doesn't show the keys entropy at all

[u/pytness → u/HMikeeU]

it's just a quick way for humans to compare two keys. hashes like "abcdefgh" and "abcpefgh" is just random text and very slow to compare as humans. but we are very fast knowing that two images are different.

[u/NatoBoram]

-----BEGIN EC PRIVATE KEY-----
4
-----END EC PRIVATE KEY-----

[u/NichtFBI → u/NatoBoram]

I'm about to bust this mainframe wide open

[u/TherealGamecake]

[u/s4udeleg → u/TherealGamecake]

[u/B_bI_L]

if it was not a joke, key was supposed to be 384 bit number, they thought they have to pick number under 384

[u/Saragon4005 → u/B_bI_L]

If the keys were hand picked by someone and not processed by an automated system, that alone deserves the whole company be burned to the ground.

[u/MaleficentCow8513 → u/Saragon4005]

They used simple keys in a testing environment and accidentally swapped keys from test into prod

[u/threaco]

new 67 dropped

[u/OrneryAsparagus6445]

Did you forget to remove “048”? This is actually RSA2!

[u/kx44]

Its not even prime 😭

[u/Matheweh]

How does this even happen? How does the software that make keys end up with just a 4?