11–20 of 34 posts
However, actual information, the zigzag pattern, starts from the bottom-right. For many QR-code versions, the middle part encode _mostly_ ECC blocks, which are by definition redundant.
The fact that a QR-code doesn't decode in the regular scanning apps does not mean you cannot read any information from it.
That's a pretty brutal bit of public shaming. Would it not have been better for the security community at large to instead reach out to Sven and have him address the issue privately?
An example a real life reconstruction of a partially redacted SSH private key : https://blog.cryptohack.org/twitter-secrets
But the situation is potentially still quite bad even if you have less information than that. See Heninger and Shacham (2008):
> In short: don’t ever try and redact real private keys. For documentation purposes, just put “KEY GOES HERE” in the appropriate spot, or something like that. Personally I've always liked redacted keys because it makes it clear to users what they should expect. Does this system want a PEM or a DER or a CER or a CRT or a JKS or a P7B or a P11? Or some vendor-specific format? The public key or the private key? Or both…
> In short: don’t ever try and redact real private keys. For documentation purposes, just put “KEY GOES HERE” in the appropriate spot, or something like that. Personally I've always liked redacted keys because it makes it clear to users what they should expect. Does this system want a PEM or a DER or a CER or a CRT or a JKS or a P7B or a P11? Or some vendor-specific format? The public key or the private key? Or both…
If you insist on doing partial redaction then reasonably simple approach would be to generate two keys and redact non-matching parts. But tbh it still is unnecessary risk
Of course the bit-by-bit assumption makes you reveal much more data than buye-by-byte or base64 characters but the point still stands.
Pet peeve: similar thing goes for QR-code redaction. People nearly always block out the middle part of the QR-code. However, actual information, the zigzag pattern, starts from the bottom-right. For many QR-code versions, the middle part encode _mostly_ ECC blocks, which are by definition redundant. The fact that a QR-code doesn't decode in the regular scanning apps does not mean you cannot read any information from…
If you know (or correctly guess) the exact parameters of the blur, this works far beyond what most people would consider recoverable by looking at it.