Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

arstechnica.com

Post reply on HN
Print view View original

121–130 of 143 posts

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#121

Post by fixermark »

isostatic wrote: post #120
air7 wrote: post #114

This article really annoys me. It's "Rage Culture" or maybe just front-page seeking by the author. The problem with that is that it makes people desensitized because if everyone is screaming all the time, one should just shut their ears. We have real issues to discuss and this isn't one of them by a long shot. Reducing the search space from 64bits to 63bits is of no consequence because if an attack on 63bits was feas…

It isn't a problem in itself. It doesn't make the certificate any less secure in practice, even if we still used md5 as a hash. The problem however as pointed out down-page [0] [1] > If you can't obey this silly requirement to use extra bits how can we trust you to do all the other things that we need done correctly? Or internally, if you can't make sure you obey this silly rule, how are you making sure you obey thes…

That's a slippery slope argument, and the answer to slippery slope arguments is "We'll address serious issues with appropriate seriousness."

This specific error isn't a serious issue, as indicated by how little impact it's had on real-world security.

It's not favoritism to Apple and Google if they emit certs with 63 bits and get minor criticism and someone else, say, stops using random numbers to seed cert generation and gets raked over the coals. The latter case would require more urgent and serious attention.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#122

Post by fixermark »

Xylakant wrote: post #119
air7 wrote: post #114

This article really annoys me. It's "Rage Culture" or maybe just front-page seeking by the author. The problem with that is that it makes people desensitized because if everyone is screaming all the time, one should just shut their ears. We have real issues to discuss and this isn't one of them by a long shot. Reducing the search space from 64bits to 63bits is of no consequence because if an attack on 63bits was feas…

Reducing the search space from 63bits to 62bits is of no consequence because if an attack on 62bits was feasible, it would mean the same attack would work 50% of the time on 63bit (or take twice as long for 100%). That wouldn't be acceptable at all.

As you know, those 50%s grow quickly. But the relevant question is "How few bits before cracking the cert takes less time than the rate of reissuance?" And the answer is "Fewer than 63."

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#123

Post by shawnz »

air7 wrote: post #114

This article really annoys me. It's "Rage Culture" or maybe just front-page seeking by the author. The problem with that is that it makes people desensitized because if everyone is screaming all the time, one should just shut their ears. We have real issues to discuss and this isn't one of them by a long shot. Reducing the search space from 64bits to 63bits is of no consequence because if an attack on 63bits was feas…

There appears to be some subtext involving a UAE state-backed CA called Dark Matter which is the real reason this is being treated so severely: https://news.ycombinator.com/item?id=19376528

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#124

Post by zeroimpl »

kgermino wrote: post #117
shawabawa3 wrote: post #115

Earlier quoted context omitted.

Because going from "unbreakable in 12 billion years" to "unbreakable in 3 billion years" isn't a practical reduction in security

But that’s still 25% of the original security... I get that it’s meaningless - 4x effectively 0 is still effectively 0 - but denying the math doesn’t really help anything.

The “security” of an algorithm is not defined as the duration of time required by a computer to brute force it. Much more important is how safe it is against other known or anticipated attacks.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#125

Post by geofft »

air7 wrote: post #114

This article really annoys me. It's "Rage Culture" or maybe just front-page seeking by the author. The problem with that is that it makes people desensitized because if everyone is screaming all the time, one should just shut their ears. We have real issues to discuss and this isn't one of them by a long shot. Reducing the search space from 64bits to 63bits is of no consequence because if an attack on 63bits was feas…

The world of hurt is not that the certificates are insecure - the world of hurt is that by the letter of the rules, which people seem intent on sticking to, millions of certs need to be revoked and replaced for (as you point out) no good reason.

And people are sticking to the letter of the rules entirely independent of the article's author. The author is not advocating for anything to be done, just reporting that this process is already in motion.

Of course we have real issues to discuss. But the fact that all these certs are going to get revoked and require replacing is a real issue that impacts people, even if there's no technical reason for it.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#126

Post by Ajedi32 »

air7 wrote: post #114

This article really annoys me. It's "Rage Culture" or maybe just front-page seeking by the author. The problem with that is that it makes people desensitized because if everyone is screaming all the time, one should just shut their ears. We have real issues to discuss and this isn't one of them by a long shot. Reducing the search space from 64bits to 63bits is of no consequence because if an attack on 63bits was feas…

The "world of hurt" comes from the fact that the CAs are revoking every single one of these non-compliant certs, as they're required to by the BRs.

Even though the actual security impact is nil, the current policies in place don't allow any flexibility in how non-compliant certs are treated. Therefore, millions of customers now need to replace their certificates due to a mere technicality.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#127

Post by shawnz »

fixermark wrote: post #122
Xylakant wrote: post #119

Earlier quoted context omitted.

Reducing the search space from 63bits to 62bits is of no consequence because if an attack on 62bits was feasible, it would mean the same attack would work 50% of the time on 63bit (or take twice as long for 100%). That wouldn't be acceptable at all.

As you know, those 50%s grow quickly. But the relevant question is "How few bits before cracking the cert takes less time than the rate of reissuance?" And the answer is "Fewer than 63."

I think you're missing their point. The time it takes to crack a key is given as an average. In reality, half of all 64 bit keys are crackable in the same amount of time or less than what it would take to crack a 63-bit key on average. So if they are saying that it's feasable to crack any 63-bit key in that timeframe, then it must also be true that it's feasable to crack around 50% of 64-bit keys in the same timeframe. Clearly that's still unacceptable.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#128

Post by Ajedi32 »

ehsankia wrote: post #93
profmonocle wrote: post #12

Just to be clear - "mississued" in this case doesn't mean they were issued to someone who doesn't control the domain. The issue is they were issued using a 63-bit serial number instead of the minimum 64 bits. (The software these CAs were all using was generating 64 random bits, but setting the first bit to zero to produce a positive integer.) The reason CAs are required to use 64-bit serial numbers is to make the con…

Is there a reason why certificates are being issued using the bare minimum required number of bits, instead of something higher like 128 or 256? Why even risk being at the very edge?

It seems that a popular open source software that CAs run on (EJBCA) defaulted to 64 bits and few people bothered to change it, since 64-bits was seemingly (but apparently not actually) compliant.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#129

Post by Ajedi32 »

geofft wrote: post #29
mmastrac wrote: post #7

Earlier quoted context omitted.

No idea and completely unsourced, but one of the site comments states this: > 4) This only came up because of DarkMatter, a very shady operator who most people are very happy to have an excuse to screw with technicalities. Edit maybe these are sources? https://bugzilla.mozilla.org/show_bug.cgi?id=1531800 https://groups.google.com/forum/#!msg/mozilla.dev.security.p... Still not getting the whole picture.

The basic story as I understand it is that DarkMatter under contract to the United Arab Emirates wants to become a trusted CA, and they are widely expected to start running a governmental MITM once trusted, but the CA root programs don't have any provision for "You're a bunch of sketchy creeps, we don't trust you." (Oddly enough for a "trusted" root program, there is generally no actual evaluation of trust as convent…

That's a bit misleading I think. There's no evidence whatsoever that DarkMatter plans to abuse their CA to MITM users. DarkMatter has been in possession of a trusted intermediary certificate for years now, so _if_ that was something they wanted to do they could have done it a long time ago.

The reason people are concerned about DarkMatter is that they have (allegedly, they seem to be denying this) previously developed and sold software that can be used to MITM connections (though not by abusing any CA certificates), and that this software has been used for less-than-noble purposes.

So yes "You're a bunch of sketchy creeps, we don't trust you." is an accurate assessment of some people's opinions towards DarkMatter, but "widely expected to start running a governmental MITM once trusted" is inaccurate.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#130

Post by lmm »

repolfx wrote: post #108
bcaa7f3a8bbc wrote: post #89

Earlier quoted context omitted.

Moreover, a Biclique attack against AES exists, by saving some meet-in-the-middle computations, it has already reduced the full 10 rounds, 128-bit AES to "just" 126-bit (25% of 128-bit) of security. Is it a clever attack? Yes. Does it mean the security of AES has been reduced to 25% of the original security level? No. Does it practically matter? No. This is exactly why 128-bit security is seen as a minimum standard i…

Does it mean the security of AES has been reduced to 25% of the original security level? No. I'm curious why that's the case. A plain reading of reducing the security level from 128 to 126 bits would seem to imply the answer is yes?

Brute force attacks are now 4x as effective as they were once thought to be, but they are not the limiting factor for AES' security, even at 126 bits. The most likely way for AES to be broken would be a new algorithmic innovation that worked against any key length, or a new kind of computer, or an implementation flaw, or... , and those things are not 4x as likely than they were.
Post reply on HN