A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates • Hacker News Board

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#31

Post by heinrich5991 » Wed, Mar 13, 2019, 2:11 AM UTC

_wmd wrote: post #21

profmonocle wrote: post #12

Just to be clear - "mississued" in this case doesn't mean they were issued to someone who doesn't control the domain. The issue is they were issued using a 63-bit serial number instead of the minimum 64 bits. (The software these CAs were all using was generating 64 random bits, but setting the first bit to zero to produce a positive integer.) The reason CAs are required to use 64-bit serial numbers is to make the con…

This seems highly unlikely to be authoritative -- AIUI serial number unpredictability is critical to SSL certificate security, as without it, it becomes possible to induce a CA into producing a signature that matches a certificate for another domain. Unless something else changed about the format when the hash algorithm was changed, AFAIK this property is independent to the hash algorithm in use If memory serves it i…

I believe this is only an issue if you can produce collisions for the underlying hash function. SHA256 is still considered safe against that.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#32

Post by a-wu » Wed, Mar 13, 2019, 2:12 AM UTC

For background, earlier this month, DarkMatter applied for Mozilla root CA inclusion. There was an email thread [1], with concerns about DarkMatter, and one of the emails[2] was concerned that DarkMatter was generating serial numbers in this exact same fashion using EJBCA. There was a pretty long-winded discussion in the thread about whether flipping the MSB constituted a loss of 1-bit of entropy and an EJBCA dev chimed in[3] saying basically that they are pushing a fix to solve this. This seems to have kicked off this issue. (there's a lot more to it, with DarkMatter's CTO saying that the method did not constitute a loss of a bit, etc, but this thread seems to be where the issue was discovered at least.)

[1] https://groups.google.com/forum/#!topic/mozilla.dev.security...

[2] https://groups.google.com/d/msg/mozilla.dev.security.policy/...

[3] https://groups.google.com/d/msg/mozilla.dev.security.policy/...

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#33

Post by TylerE » Wed, Mar 13, 2019, 2:21 AM UTC

Dylan16807 wrote: post #24

talaketu wrote: post #23

Earlier quoted context omitted.

"50% easier than theoretically impossible" means it's now 50% possible, doesn't it?

No more than "half of infinity" is half finite.

Infinity and "practically infinity" aren't the same thing though. Half of "practically infinity" may end up being practical.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#34

Post by jrochkind1 » Wed, Mar 13, 2019, 2:21 AM UTC

from that write-up, I'd call that a bug in EJBCA more than a "misconfiguration". If it was working as designed, then it's design was buggy. :)

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#35

Post by im3w1l » Wed, Mar 13, 2019, 2:22 AM UTC

geofft wrote: post #29

mmastrac wrote: post #7

Earlier quoted context omitted.

No idea and completely unsourced, but one of the site comments states this: > 4) This only came up because of DarkMatter, a very shady operator who most people are very happy to have an excuse to screw with technicalities. Edit maybe these are sources? https://bugzilla.mozilla.org/show_bug.cgi?id=1531800 https://groups.google.com/forum/#!msg/mozilla.dev.security.p... Still not getting the whole picture.

The basic story as I understand it is that DarkMatter under contract to the United Arab Emirates wants to become a trusted CA, and they are widely expected to start running a governmental MITM once trusted, but the CA root programs don't have any provision for "You're a bunch of sketchy creeps, we don't trust you." (Oddly enough for a "trusted" root program, there is generally no actual evaluation of trust as convent…

I know nothing about DarkMatter so this may nor may not be justified but I just want to make the point that they could be kicked out if they actually did make MITM certs. There are certificate comparison programs that try to spot them.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#36

Post by p1mrx » Wed, Mar 13, 2019, 2:27 AM UTC

omeid2 wrote: post #30

The interesting aspect that a lot of people are overlooking is that, for a theoretical attack within certain timeframes, this difference can be make-it or break it! Imagine a collision attack that takes about a 1 year with 64bit serial numbers, so with 63bit serial number it should take about half, at 6 months. The average certificate is issued for about 1 year, so being able to mount a collision attack that took 1 y…

Why do you assume that an attack would take 1 year, and not (e.g.) a billion years? A factor of two is only interesting if the number you're dividing was interesting in the first place.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#37

Post by omeid2 » Wed, Mar 13, 2019, 2:27 AM UTC

geofft wrote: post #11

SethTro wrote: post #6

Earlier quoted context omitted.

when X > $1M (maybe even large) it really doesn't

They're "the same cost" because anyone with account to $1M or $1B to break a cert generally also has access to $2M or $2B. No reasonable threat model includes defending against attackers that have 50% of the necessary capital to conduct an attack but not more.

I think this is a general fallacy held by a lot people.

The notion that someone who has access to X amount of funds for a given task automatically has 2X and can also afford to spend 2X on the given task is not necessarily true, so such claims are generally baseless.

What is most interesting is that these claims are generally about non-exact amounts, so the logic should follow that if you can afford X, then you can afford 2X, also means that you can afford 4X, and 8X, ad infinitum.

In practice, a 2X difference in majority of real life cases concerning substantial amount of resources is by definition substantial and far from a trivial.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#38

Post by [deleted] » Wed, Mar 13, 2019, 2:30 AM UTC

p1mrx wrote: post #36

omeid2 wrote: post #30

The interesting aspect that a lot of people are overlooking is that, for a theoretical attack within certain timeframes, this difference can be make-it or break it! Imagine a collision attack that takes about a 1 year with 64bit serial numbers, so with 63bit serial number it should take about half, at 6 months. The average certificate is issued for about 1 year, so being able to mount a collision attack that took 1 y…

Why do you assume that an attack would take 1 year, and not (e.g.) a billion years? A factor of two is only interesting if the number you're dividing was interesting in the first place.

[deleted]

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#39

Post by pryce » Wed, Mar 13, 2019, 2:31 AM UTC

geofft wrote: post #29

mmastrac wrote: post #7

Earlier quoted context omitted.

No idea and completely unsourced, but one of the site comments states this: > 4) This only came up because of DarkMatter, a very shady operator who most people are very happy to have an excuse to screw with technicalities. Edit maybe these are sources? https://bugzilla.mozilla.org/show_bug.cgi?id=1531800 https://groups.google.com/forum/#!msg/mozilla.dev.security.p... Still not getting the whole picture.

The basic story as I understand it is that DarkMatter under contract to the United Arab Emirates wants to become a trusted CA, and they are widely expected to start running a governmental MITM once trusted, but the CA root programs don't have any provision for "You're a bunch of sketchy creeps, we don't trust you." (Oddly enough for a "trusted" root program, there is generally no actual evaluation of trust as convent…

It's amazing that we anticipate having to revoke malicious CAs as a crucial part of a security model, yet we have basically no plan to ensure that we don't accept a competent-but-malicious CA into the fold in the first place.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#40

Post by gpm » Wed, Mar 13, 2019, 2:32 AM UTC

spydum wrote: post #10

Sooooo all the big players depend on one CA PKI package: EJBCA - is that not a major concern ?

That seems like the correct state of things. More packages means more possibility of bugs. We want to trust as little code as possible.

Now if only the same policy would be applied to CAs (possibly a few to mitigate abuse of power concerns, but far less than are in my trust store today).