90
The Internet goes on high alert after discovery of 8 compromised TLS certs (arstechnica.com)
submitted 9 hours ago by to c/cybersecurity@sh.itjust.works
8 comments fedilink hide all child comments
 

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 8 hours ago* (last edited 8 hours ago)

As noted, most browsers have already blocked the intermediate certificates

Doesn’t this require a browser update? Or they already check these certs with some external service which now knows to reject these certs?

Edit: from this link https://ifin.network/t/emudhra-intermediate-certificates-compromised/909

Chrome and Firefox browsers now have updated trust stores that revoke these CAs

Are those trust stores automatically updated? Or does this actually require downloading a browser update? Like a new (minor) version of the software distribution?

  • permalink
  • fedilink
  • source
    •