A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

Post by tialaramex » Wed, Mar 13, 2019, 10:22 AM UTC

schoen wrote: post #57

SethTro wrote: post #5

Seems like a lot of hand wringing over nothing, security is done with huge factors of safety (moving to 256 bit keys when no one had ever broken a 128 or even 96 bit key). It's hard to imagine that 1,2, or even a quarter of the bits couldn't be zero-ed. > it’s easy to think that a difference of 1 single bit would be largely inconsequential when considering numbers this big. In fact, he said, the difference between 26…

In fact, without a practical attack against SHA256, all of the serial number bits could be zeroed. This is undesirable for other reasons, but the serial number isn't part of the cryptographic security of the certificate except as far as it can be used to prevent the person requesting the certificate from anticipating or controlling what the entire signed data will be.

Post by matmg » Wed, Mar 13, 2019, 10:36 AM UTC

Cthulhu_ wrote: post #107

nneonneo wrote: post #88

Ok, I’m all for strong security and better SSL infrastructure, but the response to this issue was just totally overboard. The issue - one fixed bit in a 64-bit randomized serial field - does not compromise the security of these certs in any meaningful way, especially not before their natural expiry dates anyway. The disruption caused by reissuing everything surely exceeded the disruption of this theoretical issue. I…

It's not about whether it compromised security; it's that they didn't adhere to standards. If you're a certificate authority, you need to conform to standards. If you're not, you SHOULD get evicted as an authority, like DigiNotar [1] was for example. [1] https://en.wikipedia.org/wiki/DigiNotar

Post by shawabawa3 » Wed, Mar 13, 2019, 11:37 AM UTC

repolfx wrote: post #108

bcaa7f3a8bbc wrote: post #89

Earlier quoted context omitted.

Moreover, a Biclique attack against AES exists, by saving some meet-in-the-middle computations, it has already reduced the full 10 rounds, 128-bit AES to "just" 126-bit (25% of 128-bit) of security. Is it a clever attack? Yes. Does it mean the security of AES has been reduced to 25% of the original security level? No. Does it practically matter? No. This is exactly why 128-bit security is seen as a minimum standard i…

Does it mean the security of AES has been reduced to 25% of the original security level? No. I'm curious why that's the case. A plain reading of reducing the security level from 128 to 126 bits would seem to imply the answer is yes?

Post by kgermino » Wed, Mar 13, 2019, 12:34 PM UTC

shawabawa3 wrote: post #115

repolfx wrote: post #108

Earlier quoted context omitted.

Does it mean the security of AES has been reduced to 25% of the original security level? No. I'm curious why that's the case. A plain reading of reducing the security level from 128 to 126 bits would seem to imply the answer is yes?

Because going from "unbreakable in 12 billion years" to "unbreakable in 3 billion years" isn't a practical reduction in security

Post by Xylakant » Wed, Mar 13, 2019, 12:56 PM UTC

air7 wrote: post #114

This article really annoys me. It's "Rage Culture" or maybe just front-page seeking by the author. The problem with that is that it makes people desensitized because if everyone is screaming all the time, one should just shut their ears. We have real issues to discuss and this isn't one of them by a long shot. Reducing the search space from 64bits to 63bits is of no consequence because if an attack on 63bits was feas…