88
The Internet goes on high alert after discovery of 8 compromised TLS certs (arstechnica.com)
submitted 8 hours ago by to c/cybersecurity@sh.itjust.works
6 comments fedilink hide all child comments
 

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

all 6 comments

sorted by: hot top controversial new old
[–] 4 points 2 hours ago (2 children)

Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

Wtaf

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
    • [–] 5 points 7 hours ago* (last edited 6 hours ago)

    As noted, most browsers have already blocked the intermediate certificates

    Doesn’t this require a browser update? Or they already check these certs with some external service which now knows to reject these certs?

    Edit: from this link https://ifin.network/t/emudhra-intermediate-certificates-compromised/909

    Chrome and Firefox browsers now have updated trust stores that revoke these CAs

    Are those trust stores automatically updated? Or does this actually require downloading a browser update? Like a new (minor) version of the software distribution?

  • permalink
  • fedilink
  • source
    •
    [–] [S] 7 points 8 hours ago (1 child)

    Anybody else just got troubles with this? At work, we’re just finding out if the certs were trusted and where exactly.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •