Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trusted certificate authority Certigna leaks its private key

thinq.co.uk

Post reply on HN
Print view View original

21–30 of 30 posts

Re: Trusted certificate authority Certigna leaks its private key

#21

Post by JoeAltmaier »

ordinary wrote: post #18
jvehent wrote: post #15

This would actually be a problem.... if the private key was good for anything. Certigna's response says it is not: "Certigna has issued a response claiming that the file represented a 'test' certificate that had long since expired. "The private key available on the server corresponds to a test certificate used on our website certigna.fr," the company claimed. "It is impossible to generate new valid user certificates…

Just some sensationalist reporting without proper fact-checking, then. Again.

Somebody stole a key from a Certificate authority server? Sensationalist? yeah, sounds pretty sensational.

"They only stole junk from my house. So Your stuff is safe, somehow"

Anyway, they Did fact-check - and the company didn't respond. So they reported what appeared to be a significant breach. Then, when the company responded, they reported that too. Which has a name, which is "Responsible Journalism"

Re: Trusted certificate authority Certigna leaks its private key

#22

Post by binarymax »

verroq wrote: post #17
Robin_Message wrote: post #14

That level of blurring is almost certainly insufficient to actually redact the information, as discussed in http://dheera.net/projects/blur.php (discussed here http://news.ycombinator.com/item?id=1939607 )

I don't think so, it'd take way too long to dictionary attack/bruteforce the missing 64 x 9 characters of the blurred image. Which gives 64 ^ (64 x 9) combinations judging from the base64 encoding. That is assuming you have the blurring algorithm and font perfect.

No - we already know that the same blurring algorithm was used for all the characters. The font can be found and matched quickly and you only need to calibrate the blur for one character. The blurring algorithm will give you a pixel perfect representation for character match so its more on the order of 64 * 600 (600 is the approx number of chars blurred). This could be cracked in a day or less by someone motivated enough.

Re: Trusted certificate authority Certigna leaks its private key

#24

Post by slavak »

JoeAltmaier wrote: post #21
ordinary wrote: post #18

Earlier quoted context omitted.

Just some sensationalist reporting without proper fact-checking, then. Again.

Somebody stole a key from a Certificate authority server? Sensationalist? yeah, sounds pretty sensational. "They only stole junk from my house. So Your stuff is safe, somehow" Anyway, they Did fact-check - and the company didn't respond. So they reported what appeared to be a significant breach. Then, when the company responded, they reported that too. Which has a name, which is "Responsible Journalism"

Except the key is apparently worthless, and thus it makes sense nobody was very particular about securing it properly. More like "They only stole the old bicycle I left unlocked in my front yard."

Making sure that the leaked private key matches the CA's public key isn't particularly difficult. This is still poor fact checking - company's response, or lack thereof, notwithstanding.

Re: Trusted certificate authority Certigna leaks its private key

#25

Post by RichieB2B »

Robin_Message wrote: post #14

That level of blurring is almost certainly insufficient to actually redact the information, as discussed in http://dheera.net/projects/blur.php (discussed here http://news.ycombinator.com/item?id=1939607 )

No unblurring required. Just some 3DES brute forcing. http://pastebin.com/aJ5rzVY0

Re: Trusted certificate authority Certigna leaks its private key

#26

Post by smackfu »

JoeAltmaier wrote: post #21
ordinary wrote: post #18

Earlier quoted context omitted.

Just some sensationalist reporting without proper fact-checking, then. Again.

Somebody stole a key from a Certificate authority server? Sensationalist? yeah, sounds pretty sensational. "They only stole junk from my house. So Your stuff is safe, somehow" Anyway, they Did fact-check - and the company didn't respond. So they reported what appeared to be a significant breach. Then, when the company responded, they reported that too. Which has a name, which is "Responsible Journalism"

I don't think it's a good analogy. You have procedures for protecting sensitive data. This was not sensitive data, even if it appeared to be to a naive viewer, so the procedures were not followed. This does not imply anything about the security of sensitive data.

Re: Trusted certificate authority Certigna leaks its private key

#27

Post by jerf »

JoeAltmaier wrote: post #21
ordinary wrote: post #18

Earlier quoted context omitted.

Just some sensationalist reporting without proper fact-checking, then. Again.

Somebody stole a key from a Certificate authority server? Sensationalist? yeah, sounds pretty sensational. "They only stole junk from my house. So Your stuff is safe, somehow" Anyway, they Did fact-check - and the company didn't respond. So they reported what appeared to be a significant breach. Then, when the company responded, they reported that too. Which has a name, which is "Responsible Journalism"

Beware of metaphors when trying to understand computer issues. What happened (assuming this is the truth) is that a useless key was left on a public server in a public directory, and it could be downloaded by anybody, at which point it is useless. There is no helpful physical analogue to this situation. Just understand it as it is directly, it's not that complicated.

Your metaphor clouds the issue, it does not bring understanding. "Breaking in" to a computer network doesn't give you access to a "whole house", and what occurred wasn't a break in, there's no part of that metaphor that actually helps you understand the situation.

At best this shows a bit of carelessness, but then, a useless, expired key doesn't necessarily require much care in handling, either. The only damage here is PR, if what the company says is true.

Re: Trusted certificate authority Certigna leaks its private key

#28

Post by verroq »

binarymax wrote: post #22
verroq wrote: post #17

Earlier quoted context omitted.

I don't think so, it'd take way too long to dictionary attack/bruteforce the missing 64 x 9 characters of the blurred image. Which gives 64 ^ (64 x 9) combinations judging from the base64 encoding. That is assuming you have the blurring algorithm and font perfect.

No - we already know that the same blurring algorithm was used for all the characters. The font can be found and matched quickly and you only need to calibrate the blur for one character. The blurring algorithm will give you a pixel perfect representation for character match so its more on the order of 64 * 600 (600 is the approx number of chars blurred). This could be cracked in a day or less by someone motivated en…

How do you know that blurring one character produces the same effect as blurring two characters close together?

Re: Trusted certificate authority Certigna leaks its private key

#29

Post by jrockway »

verroq wrote: post #28
binarymax wrote: post #22

Earlier quoted context omitted.

No - we already know that the same blurring algorithm was used for all the characters. The font can be found and matched quickly and you only need to calibrate the blur for one character. The blurring algorithm will give you a pixel perfect representation for character match so its more on the order of 64 * 600 (600 is the approx number of chars blurred). This could be cracked in a day or less by someone motivated en…

How do you know that blurring one character produces the same effect as blurring two characters close together?

You don't need to know this. You make an image of the text for every combination possible, apply the blur algorithm, and see which one is a pixel-perfect match for to the image on the web site.

Or rather, you don't do this, you write a program to do it :)

Re: Trusted certificate authority Certigna leaks its private key

#30

Post by verroq »

jrockway wrote: post #29
verroq wrote: post #28

Earlier quoted context omitted.

How do you know that blurring one character produces the same effect as blurring two characters close together?

You don't need to know this. You make an image of the text for every combination possible, apply the blur algorithm, and see which one is a pixel-perfect match for to the image on the web site. Or rather, you don't do this, you write a program to do it :)

But you'll have to go through 64 ^ (64 x 9), combinations which will take years which was what I said in the first post.
Post reply on HN