Actalis: Insufficient Serial Number Entropy • Hacker News Board

Re: Actalis: Insufficient Serial Number Entropy

#11

Post by tialaramex » Thu, Aug 01, 2019, 11:57 AM UTC

kevingadd wrote: post #8

Aside from the necessity of enforcing good security policy here, it's brutal to observe the situation Actalis was stuck in based on the thread's ongoing comments. They clearly got themselves into bad/unsustainable deals with big customers where they made promises that couldn't be fulfilled in these circumstances, so their choices were to (likely) lose those customers + harm their customers' users, or to risk getting…

Not a bug, but let's say a "shortcoming". EJBCA felt they'd clearly documented what this did, their users not so much.

And the defence against this stuff is curiosity - which is internal process. If you issue lots of certificates (say, more than a dozen) and you find that the "64-bit" integers in them actually only vary in 63 bits you ought to be suspicious. If Actalis (or other CAs) had declared "Hi, we found out about this after two weeks when we looked at our serial numbers more closely" instead of waiting for the problem with EJBCA to get called out explicitly I'd have _way_ more sympathy.

Likewise if you're sure you are implementing 3.2.2.4.6 Agreed‐Upon Change to Website, curiosity would suggest it's worth taking a look at some of those agreed upon changes and how they were verified, and how some failed. No failures at all? Well that's weird, let's look more closely - oh, we're counting 404 errors as success. Oops. (Yes a real public CA did this and in their case they did find it before someone else reported it).

Re: Actalis: Insufficient Serial Number Entropy

#12

Post by tialaramex » Thu, Aug 01, 2019, 12:06 PM UTC

y0ghur7_xxx wrote: post #10

londons_explore wrote: post #4

On one hand, this incident was a massive amount of work by probably thousands of people to replace all the revoked certificates. Certificates which are perfectly good for communication and do not pose any significant security risk. On the other hand, allowing a CA to violate the BR's without pain will just encourage others to do so.

> Certificates which are perfectly good for communication and do not pose any significant security risk. Is it so? I remember that in 2008 someone was able to create a rouge CA certificate because of the predictability of serial numbers[1]. It was a different time: we still used md5, but are you sure the limited entropy used to generate serial numbers does not pose any security risk? [1] https://www.win.tue.nl/hashcl…

The difference here is one bit. The BRs say you must use at least 64-bits of entropy, EJBCA out of the box used 63-bits. A bad guy might need to spend say $40 trillion to make a bogus cert instead of $80 trillion. No bad guys have $40 trillion so it's irrelevant. And that would be if we were still using SHA-1 (which is broken, and so the entropy is all that would keep you safe against collision attacks) but in fact Actalis and other CAs are only issuing with SHA-256 which isn't broken.

This is a Brown M&M ‡. It doesn't actually matter in terms of security, 63-bits, 65-bits, it's never going to make a real difference. But we wrote 64-bits in those rules, if we can't trust you to obey that rule, who says you got the really important parts right?

‡ https://www.snopes.com/fact-check/brown-out/

Re: Actalis: Insufficient Serial Number Entropy

#13

Post by mghilardi » Thu, Aug 01, 2019, 12:06 PM UTC

kevingadd wrote: post #8

Aside from the necessity of enforcing good security policy here, it's brutal to observe the situation Actalis was stuck in based on the thread's ongoing comments. They clearly got themselves into bad/unsustainable deals with big customers where they made promises that couldn't be fulfilled in these circumstances, so their choices were to (likely) lose those customers + harm their customers' users, or to risk getting…

I think Actalis found itself between a very hard rock and an even harder place. I am italian and I have worked with some public entities similar to the ones Actalis provided certificates to. There is a private network "SPC" of public italian organizations, with many machine-to-machine HTTPS web services that MUST by law provide updates to the central government with quite strict deadlines.

On such networks, certificate pinning is very common and possibly even recommended, contrary to the "Basic Requirements" and recommendations of CAs.

Failing to respect such deadlines causes penalties to the local governments, and in grave cases may even be a crime: "public service interruption" which would initiate a trial, with more fines and possibly jail time.

Thus Actalis had to choose between:

1. follow the CAs "Basic Requirements" that force CAs to quickly revoke certificates when a problem is discovered. Then most of the certificates would be revoked before the public customers managed to replace them - disrupting their operativity, risking penalties for the missed deadlines and possibly trial and jail time for "public service interruption". To avoid this, they would then need to demonstrate in a public trial that the public customers were well informed that certificates could be revoked and re-issued at any time with very short warning time, and they did everything they could to avoid the "public service interruption", both pre-emptively (when negotiating the sell of certificates and educating the customers) and re-actively (when the serial numbers vulnerability was discovered). Quite a hard path.

2. contact the customers, push them to quickly replace the compromised certificates, and revoke them only afterwards, thus avoiding service disruptions.

They chose 2. Unluckily italian public organizations are very slow, which in the end caused Actalis to miss their BR deadlines by a long shot.

Re: Actalis: Insufficient Serial Number Entropy

#14

Post by obituary_latte » Thu, Aug 01, 2019, 12:09 PM UTC

I kind of feel for Actalis. It seems like they were caught between a rock and a hard place seeing as their customers were not/could not respond as quickly as hoped and revoking the certs could negatively impact end-users by preventing them from for example obtaining prescriptions etc. The language is dense for me but it also sounded like there was a reasonable explanation in the BR for the exception (paraphrasing: ‘negatively impacting a large swath of internet users’) but it didn’t seem to assuage the concern of Ryan. I hope the Actalis guy didn’t lose his job.

Re: Actalis: Insufficient Serial Number Entropy

#15

Post by wereHamster » Thu, Aug 01, 2019, 1:06 PM UTC

tialaramex wrote: post #12

y0ghur7_xxx wrote: post #10

Earlier quoted context omitted.

> Certificates which are perfectly good for communication and do not pose any significant security risk. Is it so? I remember that in 2008 someone was able to create a rouge CA certificate because of the predictability of serial numbers[1]. It was a different time: we still used md5, but are you sure the limited entropy used to generate serial numbers does not pose any security risk? [1] https://www.win.tue.nl/hashcl…

The difference here is one bit. The BRs say you must use at least 64-bits of entropy, EJBCA out of the box used 63-bits. A bad guy might need to spend say $40 trillion to make a bogus cert instead of $80 trillion. No bad guys have $40 trillion so it's irrelevant. And that would be if we were still using SHA-1 (which is broken, and so the entropy is all that would keep you safe against collision attacks) but in fact A…

It's not that Actalis has not tried to obey, or purposefully withheld information or tried to mislead the community. The disagreement is on how strict the interpretation of the BR should be.

Would Van Halen abort a concert if there was a single brown M&M in a bowl of 1000? Probably not because even though it's a violation of their contract, they got their point across, it still means the organisers had read through the full contract and tried to obey.

Reading through the discussion, I wish I could be as strict as Ryan Sleevi is in demanding that browsers fix their incompatibilities with the web's BR (ehm.. standards). Chrome, there's this bug where this element is placed one pixel off from where it should be (it's by no means critical and does not impact users of any website in any meaningful way, but according to the CSS Box Model Module Level 3 spec, paragraph suchandsuch it's wrong). How about you fix it by next week or I'll uninstall you from all systems on the world.

Re: Actalis: Insufficient Serial Number Entropy

#16

Post by bjpbakker » Thu, Aug 01, 2019, 1:11 PM UTC

obituary_latte wrote: post #14

I kind of feel for Actalis. It seems like they were caught between a rock and a hard place seeing as their customers were not/could not respond as quickly as hoped and revoking the certs could negatively impact end-users by preventing them from for example obtaining prescriptions etc. The language is dense for me but it also sounded like there was a reasonable explanation in the BR for the exception (paraphrasing: ‘n…

From the thread is becomes painfully clear how horrible Actalis is set up to act as a CA. Instead it seems they chose to break the BR by default. Almost 5 months to reissue a little over 250k certificates is not what you may expect from a CA that a major browser should trust.

The argument that there might be some end-users unable to renew their prescription seems mostly used to gain sympathy. Also this will most probably not be “a large swath of internet users”.

I do hope Actalis step up their game and regain some trust. Or it may become the next symantec.

Re: Actalis: Insufficient Serial Number Entropy

#17

Post by obituary_latte » Thu, Aug 01, 2019, 1:27 PM UTC

bjpbakker wrote: post #16

obituary_latte wrote: post #14

I kind of feel for Actalis. It seems like they were caught between a rock and a hard place seeing as their customers were not/could not respond as quickly as hoped and revoking the certs could negatively impact end-users by preventing them from for example obtaining prescriptions etc. The language is dense for me but it also sounded like there was a reasonable explanation in the BR for the exception (paraphrasing: ‘n…

From the thread is becomes painfully clear how horrible Actalis is set up to act as a CA. Instead it seems they chose to break the BR by default. Almost 5 months to reissue a little over 250k certificates is not what you may expect from a CA that a major browser should trust. The argument that there might be some end-users unable to renew their prescription seems mostly used to gain sympathy. Also this will most prob…

I agree it's on them to get it right. It just seem extenuating circumstances at least played a roll. I think I quoted the wrong part of the BR - it was adjacent to the large amount of users part - but was more along the lines of negatively impacting safety or security or somesuch.

Re: Actalis: Insufficient Serial Number Entropy

#18

Post by undecisive » Thu, Aug 01, 2019, 2:17 PM UTC

bjpbakker wrote: post #16

obituary_latte wrote: post #14

I kind of feel for Actalis. It seems like they were caught between a rock and a hard place seeing as their customers were not/could not respond as quickly as hoped and revoking the certs could negatively impact end-users by preventing them from for example obtaining prescriptions etc. The language is dense for me but it also sounded like there was a reasonable explanation in the BR for the exception (paraphrasing: ‘n…

From the thread is becomes painfully clear how horrible Actalis is set up to act as a CA. Instead it seems they chose to break the BR by default. Almost 5 months to reissue a little over 250k certificates is not what you may expect from a CA that a major browser should trust. The argument that there might be some end-users unable to renew their prescription seems mostly used to gain sympathy. Also this will most prob…

Mozilla recognizes that in some exceptional circumstances, revoking misissued certificates within the prescribed deadline may cause significant harm, such as when the certificate is used in critical infrastructure and cannot be safely replaced prior to the revocation deadline, or when the volume of revocations in a short period of time would result in a large cumulative impact to the web. However, Mozilla does not grant exceptions to the BR revocation requirements. It is our position that your CA is ultimately responsible for deciding if the harm caused by following the requirements of BR section 4.9.1 outweighs the risks that are passed on to individuals who rely on the web PKI by choosing not to meet this requirement.

That statement "may cause significant harm" is what I expect weighed on the CA's mind. When revoking a certificate could kill someone, and there is still a high barrier to exploit (i.e. no "proven method that exposes the Subscriber's Private Key to compromise") it should be up to the CA to clearly explain the situation, and up to Ryan to accept the explanation given. ("It is our position that your CA is ultimately responsible for deciding if the harm [...] outweighs the risks")

Clearly Actalis was not in a position to articulate the harm, which is their fault.

That said, I'm fully aware of the compliance hoops that must be jumped through when providing updates to medical devices. If you have to distribute firmware to medical devices, 4 months can be a remarkably fast turnaround. But in that case, CA-issued certificates are probably inferior to self-signed certificates (on an organisational level) that are not subject to external revocation.

Re: Actalis: Insufficient Serial Number Entropy

#19

Post by makomk » Thu, Aug 01, 2019, 2:30 PM UTC

kevingadd wrote: post #8

Aside from the necessity of enforcing good security policy here, it's brutal to observe the situation Actalis was stuck in based on the thread's ongoing comments. They clearly got themselves into bad/unsustainable deals with big customers where they made promises that couldn't be fulfilled in these circumstances, so their choices were to (likely) lose those customers + harm their customers' users, or to risk getting…

Oh, this is nothing. A while back the browser vendors decided that since underscores weren't technically allowed in subdomain names, every CA who'd issued such certificates needed to revoke them all. It turned out that some of those certificates weren't terribly easy to replace. In particular, a whole bunch were in use by a health insurance enrollment system that was right in the middle of the main enrollment period and because of that could only receive changes that were absolutely essential. So the CA ended up missing the deadline to revoke them by a few months in order to keep this all working. The annointed enforcers of the CA rules were, of course, utterly pissed that their underscore pedanticism wasn't considered important enough to risk people losing access to healthcare for, pointing out that they could certainly deploy a fix if there was some critical security issue so why couldn't they do it for this?

Re: Actalis: Insufficient Serial Number Entropy

#20

Post by FDSGSG » Thu, Aug 01, 2019, 2:41 PM UTC

obituary_latte wrote: post #14

I kind of feel for Actalis. It seems like they were caught between a rock and a hard place seeing as their customers were not/could not respond as quickly as hoped and revoking the certs could negatively impact end-users by preventing them from for example obtaining prescriptions etc. The language is dense for me but it also sounded like there was a reasonable explanation in the BR for the exception (paraphrasing: ‘n…

> it also sounded like there was a reasonable explanation in the BR for the exception

I believe this is due to Actalis misunderstanding the exception. Mozilla provides an exception for exceptional circumstances which Actalis's obviously were not.