Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I've factored the RSA keys of a Certificate Authority from the 90s

mcpherrin.ca

Post reply on HN
Print view View original

101–110 of 132 posts

Re: I've factored the RSA keys of a Certificate Authority from the 90s

#101

Post by smaudet »

jimmaswell wrote: post #46
CursedSilicon wrote: post #37

Earlier quoted context omitted.

Let's flip it, then Is the "anti AI mob" in the room with us right now? If not, why did you feel the need to lament it?

This entire comment section is almost entirely people bemoaning AI output, calling AI a "slop machine", and you posted your regressive religious screed against it as if it were something to be proud of, seemingly to the approval of others. nearly every comment section with AI involved is like this, and many comment sections where AI is not involved. It deserves pushback.

You seem to be representative of this mob - I merely said that the post was bad, and welcomed some actual commentary.

There's no need for pushback, there was no technical information realy shared in the OP (no work shown or explained).

And I think the fact that the work was done by the aforementioned slop machine is telling....

But how dare I point this out, time to grab the pitchforks... bemused smile

Re: I've factored the RSA keys of a Certificate Authority from the 90s

#102

Post by alexpotato »

I owned the "broker FTP" service at a hedge fund.

There was a project in 2021 to talk to the banks and brokers that we connected and ask them to upgrade their keys and ciphers to modern versions.

IIRC, the oldest key/cipher was from the late 2000s so it wouldn't surprise me if someone is using RSA keys from the 90s somewhere.

You can read more about how hedge funds use FTP here: https://x.com/alexpotato/status/1809579426687983657?s=20

Or listen to patio11 and I talk about these systems in general here: https://www.complexsystemspodcast.com/episodes/two-banks-can...

Re: I've factored the RSA keys of a Certificate Authority from the 90s

#104

Post by mcpherrinm »

Sophira wrote: post #83
WatchDog wrote: post #45

Earlier quoted context omitted.

If it were vulnerable to XSS, why would you even want it properly signed by a CA? People almost never inspect the certificates of working websites, the only time they might look at it is when it fails validation.

I actually do like to view certificates of working sites, because it can be interesting to see what's listed in the Subject Alternative Names field. It can lead to some interesting observations about what sites are linked.

Netscape of this era predates the Subject Alternative Name :)

Re: I've factored the RSA keys of a Certificate Authority from the 90s

#105

Post by tptacek »

CGMthrowaway wrote: post #90
hnmullany wrote: post #75

I was the product manager with responsibility for root certificates in the Netscape 4.51 browser. It's crazy to see someone factor it 25 years later. Just to reply to some people in the comments. Yes, we knew export grade encryption was weak - that was the point - that the NSA could decrypt it - and the govt. required us to do it anyway. FWIW - we had the goal of expanding the list of root authorities in the 4.5x rel…

Did you have any personal interaction with NSA or their proxies?

The point of export cryptography is not needing any personal interactions.

Re: I've factored the RSA keys of a Certificate Authority from the 90s

#106

Post by upofadown »

mitxela wrote: post #93
upofadown wrote: post #67

Earlier quoted context omitted.

My article: 2048 Bit RSA and the Year 2030 https://articles.59.ca/doku.php?id=em:20482030 We don't have any way to predict when and if 2048 bit RSA would be factorable at this time. We would need a breakthrough in hardware and/or algorithms. The common estimation that it is equivalent to the difficulty of brute forcing symmetrical 112 bit encryption seems to be based on some sort of straightforward extrapolation. It…

Which isn't a very good margin in cryptography, where we usually aim for things like "longer than the universe's lifetime if every atom was a CPU". But RSA is really slow so we have to compromise encryption speed with cracking speed.

What does the speed of RSA have to do with anything?

Re: I've factored the RSA keys of a Certificate Authority from the 90s

#107

Post by tptacek »

strenholme wrote: post #81
CursedSilicon wrote: post #19

Earlier quoted context omitted.

A while back I helped a friend (read: dumped a bunch of compute power into it) brute force the SSL keys for Sega's "Phantasy Star Online" Dreamcast game. They used a similar kind of custom (and flawed) TLS implementation in their game(s) which allowed signing new certificates after brute forcing. The benefit to this is that users can now play these games without needing to burn a new CD with either the SSL certs swap…

“Rolling your own crypto libraries is always a bad idea” Absolutes like this aren’t absolutely true. It’s interesting because in a related comment, someone claimed that I was “rolling my own crypto” https://news.ycombinator.com/item?id=37368245 >>>a few odd coding decisions, such as rolling your own crypto (RNG) Let me give some context here. MaraDNS is a DNS server that’s been around for a very long time, since 2001…

Forget whether you "roll your own" or not, userspace RNGs are a bad idea. The advice to rely on getrandom or urandom is as much about the superior security properties of a kernel RNG as they are about whether you'll fuck up AES somehow.

Re: I've factored the RSA keys of a Certificate Authority from the 90s

#108

Post by rustyminnow »

kyleomalley wrote: post #70
mcpherrinm wrote: post #15

Earlier quoted context omitted.

(As the author of the post) I've written and worked on a few TLS implementations, so it wasn't terribly interesting to me. And I have to go to work tomorrow and solve real, modern CA problems :) But in short, I wanted to use Go, and it doesn't support SSLv3, the SSLv2 Client Hello, or the 40-bit RC4-MD5 export-grade cipher suites which I wanted to support too. I was more shocked that I managed to get stock OpenSSL to…

Strange seeing how people have such a hard time seeing others using AI and seem to want to complain about it instead of just, well, asking AI why something was likely done a way. It works both ways my dudes, experts don’t need to explain every last detail, prompt a bot with the context until you understand. From my prospective, the outputs of a bot aren’t the interesting bits, it’s the input prompt that should warran…

I asked my AI for a rebuttal to your argument and it came up with some pretty good points.

Since inputs are more interesting than outputs I've included my prompt; you should submit it to your AI to see why you're wrong.

> I'm debating with someone online. Can you come up with a counter argument? Here's what they said:

Re: I've factored the RSA keys of a Certificate Authority from the 90s

#109

Post by AnthonyMouse »

cyanydeez wrote: post #91
jetbalsa wrote: post #80

Earlier quoted context omitted.

Its a shame that Microsoft ate Netscape's lunch so early on. I still use Firefox and have fond memories of Netscape (v7) when growing up.

Its a shame public internet is npt viewed as a public utility

How do you imagine that would work for something like this?

Suppose you live in South America, register a domain from a registry in Canada and then have users accessing it from Ukraine. Are we going to give every local government a global root certificate? Have a single one in California or Texas that every other country is somehow forced to use? Or make it so people in Europe can't access sites in Asia and vice versa?

The existing system is more than the usual amount of messed up but that seems like one of the things that could actually make it worse.

Re: I've factored the RSA keys of a Certificate Authority from the 90s

#110

Post by cyanydeez »

AnthonyMouse wrote: post #109
cyanydeez wrote: post #91

Earlier quoted context omitted.

Its a shame public internet is npt viewed as a public utility

How do you imagine that would work for something like this? Suppose you live in South America, register a domain from a registry in Canada and then have users accessing it from Ukraine. Are we going to give every local government a global root certificate? Have a single one in California or Texas that every other country is somehow forced to use? Or make it so people in Europe can't access sites in Asia and vice vers…

same way every public utility works. It's great until a capitalist buys your government and forces you to sell it back to them while they rent seek.
Post reply on HN