smiletolerantly@awful.systems to Selfhosted@lemmy.worldEnglish · 1 day agoPSA: eMudhra Intermediate CA Compromiseemudhra.we-have-a-problem.comexternal-linkmessage-square24linkfedilinkarrow-up196arrow-down10file-text
arrow-up196arrow-down1external-linkPSA: eMudhra Intermediate CA Compromiseemudhra.we-have-a-problem.comsmiletolerantly@awful.systems to Selfhosted@lemmy.worldEnglish · 1 day agomessage-square24linkfedilinkfile-text
minus-squareErr(()).unwrap()@lemmy.worldlinkfedilinkEnglisharrow-up10·1 day agoFour… Fucking… Pixels? The working hypothesis is that this was some sort of debug or test key that was never meant to be used in production, being used in production.
minus-squaretigerhawkvok@startrek.websitelinkfedilinkEnglisharrow-up7·1 day agoI’m honestly skeptical about even this. I tried to generate an 8 bit key and got rsa_gen_set_params:key size too small. And like, you need to go deliberately out of your way to not use OpenSSL.
minus-squareSteveTech@aussie.zonelinkfedilinkEnglisharrow-up4·19 hours agoThey were proper 384bit certs, just the upper 376 bits were 0 in all the listed certs. So it’s different to setting the key size in OpenSSL, and they were most likely rolling their own crypto.
minus-squareSkullgrid@lemmy.worldlinkfedilinkEnglisharrow-up1arrow-down1·1 day agohttps://www.youtube.com/watch?v=87H6m2v4zNs
… Eight? Eight???
Four… Fucking… Pixels?
The working hypothesis is that this was some sort of debug or test key that was never meant to be used in production, being used in production.
I’m honestly skeptical about even this. I tried to generate an 8 bit key and got
rsa_gen_set_params:key size too small.And like, you need to go deliberately out of your way to not use OpenSSL.
They were proper 384bit certs, just the upper 376 bits were 0 in all the listed certs. So it’s different to setting the key size in OpenSSL, and they were most likely rolling their own crypto.
https://www.youtube.com/watch?v=87H6m2v4zNs