4gate

eMudhra Intermediate CA Compromise

eMudhra Intermediate CA Compromise

Sophie Schmieg (@sophieschmieg@infosec.exchange)

All shitposting aside, though, if we go off the explanation the CA has given then some reformating script accidentally dropped most of the bytes or never requested them from the HSM or similar. A couple of years ago, we had a similar worry with Tink. In particular, we wanted to have a cheap test that catches obviously non-random values with high confidence. I added three little statistical test back then, which are run as unit test in every presubmit on everything that is supposed to look like a uniform random string. The tests are not constant time, so you cannot run them over your actual keys as is, but they are very reliable to test tooling that is supposed to handle and transform key material. They are tuned aggressively to detect non-randomness only up to 10 standard deviations, which makes the test extremely non flaky, at the cost of missing some events. But as I said, they're designed to be unit tests, that run with high frequency, so false positives would be very bad in that scenario. There are multiple ways to test this, some more principled than others, and somewhat depending on other requirements, but this is what I added to Tink back then: The first test is a z test that checks that every bit in the input string has a probability of 0.5 of being set. I.e. it sums all bits and checks whether the result is within 10 standard deviations of half of the length of the string. The second test is a cross correlation test that takes two bit strings, xors them, and runs the first test on the result. In other words it checks whether two independently drawn strings agree at half the positions. The third test is the most expensive one to run, but also the most powerful of these tests and tests the autocorrelation of a string. It rotates the string, shifting each bit by one and putting the last bit to the front, and then runs the cross correlation test on that string with the original string, for each possible shift. This test detects repetitions of sequences within a string, and will e.g. detect that a string contains only printable ASCII, although at the setting of 10 standard deviations it will require a couple of sentences before firing. https://github.com/tink-crypto/tink-cc/blob/3c94644e5b2dffacd66764da13083a97ee782d15/tink/util/test_util.h#L136

Are elliptic curve keys corresponding to small private keys bad keys? · Issue #38 · badkeys/badkeys

An elliptic curve private key is usually1 a number between 1 and the curve's order minus one. The corresponding public key is the private key times the group's generator. In particular, if ...

ira grachevskaya from the hit vn Z.A.T.O. // I Love the World and Everything In It (@49016@catgirl.cloud)

omfg they're ALL FUCKING <255 4 EM OV TLS CA - G3C OV TLS 56 EM EV TLS CA - G3C EV TLS 66 EM OV CS CA - G3B Code signing 115 EM EV TLS CA - G3B EV TLS 155 EM OV TLS CA - G3B OV TLS 156 EM DV TLS CA - G3B DV TLS 230 EM DV TLS CA - G3C DV TLS 237 EM OV CS CA - G3C Code signing