Sony says it can fix private key crack
thinq.co.uk
Sony says it can fix private key crack
1–10 of 26 posts
Re: Sony says it can fix private key crack
#2My guess? The suits at Sony, being as incompetent now as they always have been, still haven't realized the seriousness of their situation.
I'd love to be privy to the email exchanges that must be going on there between their engineers and management...
Alternatively they do have a solution, and it's something to the effect of "nuke it from orbit"/"if we can't have it, nobody can". They already tried to take that approach with OtherOS, so this should get entertaining if that's the case.
Re: Sony says it can fix private key crack
#3Let's say they update the hardware to include a new public key. They now have the issue that existing signatures don't verify properly. You can mitigate this by having a list of existing valid signatures which can use the old key, but that can't be the best way. Can anyone come up with another?
Re: Sony says it can fix private key crack
#4My guess? The suits at Sony, being as incompetent now as they always have been, still haven't realized the seriousness of their situation. I'd love to be privy to the email exchanges that must be going on there between their engineers and management... Alternatively they do have a solution, and it's something to the effect of "nuke it from orbit"/"if we can't have it, nobody can". They already tried to take that appr…
My sentiment exactly, wonder if the solution includes something akin to the rootkit they deployed once before.
Re: Sony says it can fix private key crack
#5Let's say they update the hardware to include a new public key. They now have the issue that existing signatures don't verify properly. You can mitigate this by having a list of existing valid signatures which can use the old key, but that can't be the best way. Can anyone come up with another?
I don't see why that wouldn't be the best way. How many signatures would there be to check? A couple of thousands?
I do not know how firmware gets signed on PS3, but an alternative could be that all software already is signed with a second key. If so, having new firmware check for that key would close the hole. If they used the same broken algorithm, not for long, though.
Re: Sony says it can fix private key crack
#6Let's say they update the hardware to include a new public key. They now have the issue that existing signatures don't verify properly. You can mitigate this by having a list of existing valid signatures which can use the old key, but that can't be the best way. Can anyone come up with another?
That seems like a perfectly good solution to me. Storing a hash of each signature is say 256 bytes and supposing an upper limit of 10,000 signatures, the database file is pretty small. (Better hope they sign the signature database though)
Re: Sony says it can fix private key crack
#7If I can resurrect my PS3 and run *nix natively on it with graphics and full blown access to the co-processors I'd buy a second one for gaming.
The main problem is the memory limitations of 256MB+256MB but with careful configuration it can be just OK.
I wouldn't be surprised if this ends up making the PS3 ubiquitous leaving all the other consoles behind. Even in spite of the poor higher management coming from old media (the ones pissing off traditional developers, forcing Blu-Ray and that insane rootkit.)
http://en.wikipedia.org/wiki/Howard_Stringer
http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootki...
Re: Sony says it can fix private key crack
#8They can simply check the date it was signed:
if (dateSigned() < 1293775200) {
// Verify with old PubKey
} else {
// Use new PubKey
}
What is the big deal here?
Re: Sony says it can fix private key crack
#9They can simply check the date it was signed: if (dateSigned() < 1293775200) { // Verify with old PubKey } else { // Use new PubKey } What is the big deal here?
[deleted]
Re: Sony says it can fix private key crack
#10They can simply check the date it was signed: if (dateSigned() < 1293775200) { // Verify with old PubKey } else { // Use new PubKey } What is the big deal here?
That doesn't close the hole because I can sign my homebrew or resign my pirated material with an older date. They would have to whitelist all previous content and issue a new key in hardware somehow.