Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

arstechnica.com

Post reply on HN
Print view View original

21–30 of 143 posts

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#21

Post by _wmd »

profmonocle wrote: post #12

Just to be clear - "mississued" in this case doesn't mean they were issued to someone who doesn't control the domain. The issue is they were issued using a 63-bit serial number instead of the minimum 64 bits. (The software these CAs were all using was generating 64 random bits, but setting the first bit to zero to produce a positive integer.) The reason CAs are required to use 64-bit serial numbers is to make the con…

This seems highly unlikely to be authoritative -- AIUI serial number unpredictability is critical to SSL certificate security, as without it, it becomes possible to induce a CA into producing a signature that matches a certificate for another domain. Unless something else changed about the format when the hash algorithm was changed, AFAIK this property is independent to the hash algorithm in use

If memory serves it isn't a theoretical attack either, I read about it used against (Startcom maybe?) not so many years ago

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#22

Post by paulddraper »

wahern wrote: post #20

Presumably 64 bits were originally chosen because it still permitted simple or naive ASN.1 decoders to return the parsed value as a native 64-bit type. But ASN.1 INTEGERs are always signed, so theses serials would now have to be 65 bits. But any ASN.1 decoder interface that permitted directly storing a 65-bit value into a 64-bit type--even an unsigned type--is dangerous if not broken. I'm guessing that most X.509 man…

Yes, now certificates are about half as hard to hack as they were supposed to be.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#23

Post by talaketu »

geofft wrote: post #9

> Adam Caudill, the security researcher who blogged about the mass misissuance last weekend, pointed out that it’s easy to think that a difference of 1 single bit would be largely inconsequential when considering numbers this big. In fact, he said, the difference between 2^63 and 2^64 is more than 9 quintillion. Okay, but, that's because 2^63 itself is more than 9 quintillion. Where the search space was previously 18…

"50% easier than theoretically impossible" means it's now 50% possible, doesn't it?

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#24

Post by Dylan16807 »

talaketu wrote: post #23
geofft wrote: post #9

> Adam Caudill, the security researcher who blogged about the mass misissuance last weekend, pointed out that it’s easy to think that a difference of 1 single bit would be largely inconsequential when considering numbers this big. In fact, he said, the difference between 2^63 and 2^64 is more than 9 quintillion. Okay, but, that's because 2^63 itself is more than 9 quintillion. Where the search space was previously 18…

"50% easier than theoretically impossible" means it's now 50% possible, doesn't it?

No more than "half of infinity" is half finite.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#25

Post by beardbandit »

geofft wrote: post #9

> Adam Caudill, the security researcher who blogged about the mass misissuance last weekend, pointed out that it’s easy to think that a difference of 1 single bit would be largely inconsequential when considering numbers this big. In fact, he said, the difference between 2^63 and 2^64 is more than 9 quintillion. Okay, but, that's because 2^63 itself is more than 9 quintillion. Where the search space was previously 18…

Its 50/50.

Either you crack it or you don't.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#26

Post by omeid2 »

spydum wrote: post #17
danite wrote: post #15

Earlier quoted context omitted.

Typically with crypto you want to stick with one major industry standard implementation that is strenuously verified. It's probably more concerning if everyone's using their own.

Suppose so but doesn’t it become one well to poison? It just surprises me a bit (mainly because I was NOT familiar with EJBCA and have moderate awareness of PKI)

I suspect a lot of people expect OpenSSL or LibreSSL to be used in this kind of setups.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#27

Post by [deleted] »

geofft wrote: post #8
bitxbitxbitcoin wrote: post #2

“Almost no chance of exploitation.” How true is this?

High-entropy certificate serial numbers are a defense against hash collision attacks. The margin of security is reduced to the point that a brute force attack is twice as easy. If it was going to take you 10,000 years to brute-force it, now it takes you 5,000, both of which round to "impossible." If it was going to take you four weeks on EC2, now it takes two weeks, both of which round to "entirely too easy."

[deleted]

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#29

Post by geofft »

mmastrac wrote: post #7
xyzzy123 wrote: post #3

Given that there seems to be no security impact (and none expected in the next year or two)... Curious why everyone doesn’t agree to use 64 bits in future and just let the mis-issued certs live out their natural life? Seems to create a lot of busywork for lots of people for no discernible benefit?

No idea and completely unsourced, but one of the site comments states this: > 4) This only came up because of DarkMatter, a very shady operator who most people are very happy to have an excuse to screw with technicalities. Edit maybe these are sources? https://bugzilla.mozilla.org/show_bug.cgi?id=1531800 https://groups.google.com/forum/#!msg/mozilla.dev.security.p... Still not getting the whole picture.

The basic story as I understand it is that DarkMatter under contract to the United Arab Emirates wants to become a trusted CA, and they are widely expected to start running a governmental MITM once trusted, but the CA root programs don't have any provision for "You're a bunch of sketchy creeps, we don't trust you." (Oddly enough for a "trusted" root program, there is generally no actual evaluation of trust as conventionally defined. The "trust" part is "can you pass audits and generally be technically and organizationally competent to not let your private key be stolen / your infrastructure be abused by an attacker." Individual employees are part of the threat model, so there's usually a two-person rule for access to the private key; entire malicious organizations willing to lie in public and cover their tracks are not envisioned by the model.) So people are trying to block their application by nitpicking technical mistakes that, by the letter of the Baseline Requirements, disqualify you from being a CA.

https://www.eff.org/deeplinks/2019/02/cyber-mercenary-groups... covers some background on DarkMatter.

One of the Baseline Requirements is you may not issue certs with fewer than 64 bits of entropy. Turns out DarkMatter was doing that, by issuing certs with 63 bits of entropy. Also turns out this was a thing lots of CAs did. Now that it's been pointed out publicly....

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#30

Post by omeid2 »

The interesting aspect that a lot of people are overlooking is that, for a theoretical attack within certain timeframes, this difference can be make-it or break it!

Imagine a collision attack that takes about a 1 year with 64bit serial numbers, so with 63bit serial number it should take about half, at 6 months.

The average certificate is issued for about 1 year, so being able to mount a collision attack that took 1 year in 6 months can make the difference from generally-not-useful to very practical and dangerous.

Post reply on HN