Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

arstechnica.com

Post reply on HN
Print view View original

131–140 of 143 posts

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#131

Post by Ajedi32 »

Golfkid2Gadfly wrote: post #100

What an incredible non-story burying an actual real and terrifying story. The crux of this entire issue is a company known as Dark Matter, which is essentially a UAE state sponsored company, potentially getting a root CA trusted by Mozilla. It's highly suspected that Dark Matter is working on behalf of the UAE to get a root trusted certificate in order to spy on encrypted traffic at their will. Everyone involved in t…

> It's highly suspected that Dark Matter is working on behalf of the UAE to get a root trusted certificate in order to spy on encrypted traffic at their will.

This is false. DarkMatter already operates an intermediate CA, so _if_ this were something they were actually planning to do they wouldn't need a trusted root CA to do it. So far, there's been no evidence presented that DarkMatter has abused their intermediate cert in the past, or that they plan to abuse any root cert they might be granted in the future.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#132

Post by Ajedi32 »

ggm wrote: post #14

CT principles would surely demand they do some public facing declaration? The 'pull the certificates from the browsers' thing demands people from these companies maybe recuse themselves from conversations? (this is public trust process stuff, not technology per se)

I don't understand what you're asking.

Many of the affected CAs have already come out and "confessed" that they've issued non-compliant certs and stated that they're revoking them.

No certificates are being "pulled from browsers" as a result of this incident as far as I know.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#133

Post by Ajedi32 »

j16sdiz wrote: post #67
ikeboy wrote: post #4

Earlier quoted context omitted.

True. 2^63 and 2^64 are effectively the same cost to break. Instead of costing $2X to break, it now costs $X.

This is an anti-collusion measure against birthday attack. The effect is exponential.

2^x is exponential. GP is correct, it's still only one bit, so the cost is halved.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#134

Post by bcaa7f3a8bbc »

kgermino wrote: post #117
shawabawa3 wrote: post #115

Earlier quoted context omitted.

Because going from "unbreakable in 12 billion years" to "unbreakable in 3 billion years" isn't a practical reduction in security

But that’s still 25% of the original security... I get that it’s meaningless - 4x effectively 0 is still effectively 0 - but denying the math doesn’t really help anything.

I agree.

The problem here is my choice of an ambiguous word, "security". Formally speaking, the "security level" or "security claim" of a cipher is defined by the computational complexity (time/memory) of breaking it, often represented as the number of bits. so the Biclique attack indeed reduced the "security" of AES to 25% of its original claim. "Security" in a broader sense can be roughly understood as "how well a system is practically protected, under a specific threat model", in this case, the underlying details, such as this minor reduction to a cipher's security claim hardly matters.

I should have edited my comment to use a better word, but now it already became permanent.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#135

Post by Scarblac »

fixermark wrote: post #121
isostatic wrote: post #120

Earlier quoted context omitted.

It isn't a problem in itself. It doesn't make the certificate any less secure in practice, even if we still used md5 as a hash. The problem however as pointed out down-page [0] [1] > If you can't obey this silly requirement to use extra bits how can we trust you to do all the other things that we need done correctly? Or internally, if you can't make sure you obey this silly rule, how are you making sure you obey thes…

That's a slippery slope argument, and the answer to slippery slope arguments is "We'll address serious issues with appropriate seriousness." This specific error isn't a serious issue, as indicated by how little impact it's had on real-world security. It's not favoritism to Apple and Google if they emit certs with 63 bits and get minor criticism and someone else, say, stops using random numbers to seed cert generation…

It's not a slippery slope argument, it's an applying the rules argument. The rules don't allow for a difference between more and less serious infractions, they just need to be followed to the letter.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#136

Post by mikestew »

Theoretical possibilities and minimal security impacts aside, I'm not seeing comments along the lines of the brown M&M clause [0]. Yeah, brown M&M's weren't going to ruin the day of David Lee Roth, but that wasn't the point: when dealing with heavy and high-amperage equipment of a stage show, what else did you forget or ignore?

64 bits, 63 bits, what's the difference? The difference is that we now have to go through everything you might have forgotten that will make a difference. In other words, we apparently can't trust you to follow instructions, and certificates are all about trust.

[0] https://www.snopes.com/fact-check/brown-out/

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#137

Post by schoen »

tialaramex wrote: post #111
schoen wrote: post #57

Earlier quoted context omitted.

In fact, without a practical attack against SHA256, all of the serial number bits could be zeroed. This is undesirable for other reasons, but the serial number isn't part of the cryptographic security of the certificate except as far as it can be used to prevent the person requesting the certificate from anticipating or controlling what the entire signed data will be.

Well not _all_ the bits. We do want the serial numbers to be non-identical because you need a way to talk about specific certificates for validity checking. Once upon a time bug reports would have focused on certificate serial numbers, these days they're more likely to be crt.sh links but arguably we should discourage that because crt.sh could go away some day.

Yep, that's what I mean by "for other reasons". (Without distinctive serial numbers or crt.sh, we would probably have to attach PEM copies of the certificate in every discussion about it.)

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#138

Post by fixermark »

Scarblac wrote: post #135
fixermark wrote: post #121

Earlier quoted context omitted.

That's a slippery slope argument, and the answer to slippery slope arguments is "We'll address serious issues with appropriate seriousness." This specific error isn't a serious issue, as indicated by how little impact it's had on real-world security. It's not favoritism to Apple and Google if they emit certs with 63 bits and get minor criticism and someone else, say, stops using random numbers to seed cert generation…

It's not a slippery slope argument, it's an applying the rules argument. The rules don't allow for a difference between more and less serious infractions, they just need to be followed to the letter.

"If you can't obey this silly requirement to use extra bits how can we trust you to do all the other things that we need done correctly?" is a slippery slope argument. The response is "We allocate testing resources proportionally to the seriousness of the consequences of failure to adhere to a requirement, as any good engineering project does."

It's probably worth noting that the problem lasted three years and wasn't discovered by an exploit in the wild, but by followup spot-checking of Google certs as a result of spot-checking Dark Matter certs. I don't think seriousness of the issue is in dispute.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#139

Post by okmokmz »

beardbandit wrote: post #25
geofft wrote: post #9

> Adam Caudill, the security researcher who blogged about the mass misissuance last weekend, pointed out that it’s easy to think that a difference of 1 single bit would be largely inconsequential when considering numbers this big. In fact, he said, the difference between 2^63 and 2^64 is more than 9 quintillion. Okay, but, that's because 2^63 itself is more than 9 quintillion. Where the search space was previously 18…

Its 50/50. Either you crack it or you don't.

By that logic lottery tickets would be 50/50 as well; either you win or you don't. That's not how it works

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#140

Post by ClassyJacket »

Cthulhu_ wrote: post #106
ClassyJacket wrote: post #55

Earlier quoted context omitted.

Nope, the chance of success for each attempt went from 1 in 18,000,000,000,000,000,000 to 2 in 18,000,000,000,000,000,000.

Not 1 in 18 quintillion to 1 in 9 quintillion? I think you've got your binary math wrong.

2/18 and 1/9 are equal.
Post reply on HN