Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

arstechnica.com

Post reply on HN
Print view View original

61–70 of 143 posts

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#61

Post by geofft »

_wmd wrote: post #21
profmonocle wrote: post #12

Just to be clear - "mississued" in this case doesn't mean they were issued to someone who doesn't control the domain. The issue is they were issued using a 63-bit serial number instead of the minimum 64 bits. (The software these CAs were all using was generating 64 random bits, but setting the first bit to zero to produce a positive integer.) The reason CAs are required to use 64-bit serial numbers is to make the con…

This seems highly unlikely to be authoritative -- AIUI serial number unpredictability is critical to SSL certificate security, as without it, it becomes possible to induce a CA into producing a signature that matches a certificate for another domain. Unless something else changed about the format when the hash algorithm was changed, AFAIK this property is independent to the hash algorithm in use If memory serves it i…

The signature is over all the data in the certificate. So a hash collision in the signature algorithm makes this attack possible. (And if you can predict/control serial numbers, it makes the attack much easier because then you can generate a colliding pair of one valid cert and one invalid one and get the first one signed, instead of having to find a preimage of a valid certificate.) But without a hash collision, it should be theoretically safe to have no entropy at all. Most commonly-digitally-signed objects (Git commits, software packages, etc.) have no added entropy in the object itself / the input to the hash function.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#62

Post by saagarjha »

beardbandit wrote: post #25
geofft wrote: post #9

> Adam Caudill, the security researcher who blogged about the mass misissuance last weekend, pointed out that it’s easy to think that a difference of 1 single bit would be largely inconsequential when considering numbers this big. In fact, he said, the difference between 2^63 and 2^64 is more than 9 quintillion. Okay, but, that's because 2^63 itself is more than 9 quintillion. Where the search space was previously 18…

Its 50/50. Either you crack it or you don't.

Except that's not how probability works.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#63

Post by geofft »

krferriter wrote: post #59
TylerE wrote: post #33

Earlier quoted context omitted.

Infinity and "practically infinity" aren't the same thing though. Half of "practically infinity" may end up being practical.

Yes the previous value was not infinity. It was impractical to solve in a human lifetime, but if they keep trimming off a few bits it very quickly becomes practical. If actually "infinity" then dividing it by any finite number would still result in infinity, which is not the case here.

Right, which is why the specific claim here is that 63 is not a problem, not that smaller numbers in general are not a problem.

A better way to put this: instead of saying "it reduces the search space by 9 quintillion," say "it reduces 50% of the search space." Sure, that's a lot, but not nearly as much as trimming 8 bits and saying "it reduces 99.6% of the search space."

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#64

Post by tptacek »

geofft wrote: post #11
SethTro wrote: post #6

Earlier quoted context omitted.

when X > $1M (maybe even large) it really doesn't

They're "the same cost" because anyone with account to $1M or $1B to break a cert generally also has access to $2M or $2B. No reasonable threat model includes defending against attackers that have 50% of the necessary capital to conduct an attack but not more.

Objection! There is one such threat model: content protection schemes (like BD+) are that finely-calibrated. The goal is to be secure enough for the new release window, but to accept failure after that point.

You're totally right here, I'm just nerding out on threat models and security economics.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#65

Post by saagarjha »

krferriter wrote: post #59
TylerE wrote: post #33

Earlier quoted context omitted.

Infinity and "practically infinity" aren't the same thing though. Half of "practically infinity" may end up being practical.

Yes the previous value was not infinity. It was impractical to solve in a human lifetime, but if they keep trimming off a few bits it very quickly becomes practical. If actually "infinity" then dividing it by any finite number would still result in infinity, which is not the case here.

> trimming off a few bits

i.e., reduce it by close to practically infinity?

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#66

Post by geofft »

omeid2 wrote: post #56
geofft wrote: post #51

Earlier quoted context omitted.

I'm not sure but I think you're trying to say I'm wrong. In the general case it's wrong, of course, to say that being able to afford X implies being able to afford 2X: few people could afford 2x their rent or a house 2x the price of theirs, etc. Few people would fail to be meaningfully affected by getting 2x (or 1/2x) their salary. But I'm talking specifically about cryptographic threat models. No reasonable threat m…

> No reasonable threat model says, conducting this attack takes $100,000, and since most people don't have $100,000 in savings it's safe Sure, that is never the claim. > And in particular the claims here are in fact about exact amounts: a factor of two Sure, but that is still a factor of X, an unknown amount. The bottom line is that for many actors, even nation state, the cost difference of 20M and 40M might mean tha…

And my claim is that if your threat model depends on an attacker who can afford $20M being unable to afford $40M, your threat model is flawed and you've already lost. They might have to seek alternative options. They might not. They might just be able to issue $20M of bonds, who knows. They might have a strong economy next year and the attackerbucks-to-USD exchange rate might double. If you need to defend against an attacker with $30M in the bank, make the attack cost $30B or $30T.

And the neat thing about crypto is that's easy to do: just increase the amount of entropy involved. A mere ten more bits make a brute-force attack cost 1000x as much. If we're genuinely worried that 63 bits is too small, ditch the 64-bit requirement and make it 128-bit. (Probably phrase it as 120-bit, so people can use UUIDs and whatnot - the point is still that 120 is still clearly more than enough, not near the borderline.)

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#67

Post by j16sdiz »

ikeboy wrote: post #4
bitxbitxbitcoin wrote: post #2

“Almost no chance of exploitation.” How true is this?

True. 2^63 and 2^64 are effectively the same cost to break. Instead of costing $2X to break, it now costs $X.

This is an anti-collusion measure against birthday attack. The effect is exponential.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#68

Post by fwip »

omeid2 wrote: post #60
fwip wrote: post #52

Earlier quoted context omitted.

Such an attack doesn't exist. Any such attack would also become feasible with twice the budget.

> Such an attack doesn't exist. As far as we know. > Any such attack would also become feasible with twice the budget. Assuming that the attack yields to parallel computing and scales linearly with more cpu/cores, because linear programming is bound to current compute capabilities and then theoretical limits like Bremermann's limit and Margolus–Levitin theorem.

Yeah, assuming these true things.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#69

Post by omeid2 »

geofft wrote: post #66
omeid2 wrote: post #56

Earlier quoted context omitted.

> No reasonable threat model says, conducting this attack takes $100,000, and since most people don't have $100,000 in savings it's safe Sure, that is never the claim. > And in particular the claims here are in fact about exact amounts: a factor of two Sure, but that is still a factor of X, an unknown amount. The bottom line is that for many actors, even nation state, the cost difference of 20M and 40M might mean tha…

And my claim is that if your threat model depends on an attacker who can afford $20M being unable to afford $40M, your threat model is flawed and you've already lost. They might have to seek alternative options. They might not. They might just be able to issue $20M of bonds, who knows. They might have a strong economy next year and the attackerbucks-to-USD exchange rate might double. If you need to defend against an…

> And my claim is that if your threat model depends on an attacker who can afford $20M being unable to afford $40M

But is it? I think the underlying claim is that 2X difference doesn't matter, which is patently false.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#70

Post by Dylan16807 »

TylerE wrote: post #33
Dylan16807 wrote: post #24

Earlier quoted context omitted.

No more than "half of infinity" is half finite.

Infinity and "practically infinity" aren't the same thing though. Half of "practically infinity" may end up being practical.

There should be a very large gap between "theoretically impossible" and "practical". If cutting the search space in half gets you from one to the other, there's probably been an error in definition.
Post reply on HN