Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

arstechnica.com

Post reply on HN
Print view View original

81–90 of 143 posts

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#81

Post by TylerE »

Dylan16807 wrote: post #70
TylerE wrote: post #33

Earlier quoted context omitted.

Infinity and "practically infinity" aren't the same thing though. Half of "practically infinity" may end up being practical.

There should be a very large gap between "theoretically impossible" and "practical". If cutting the search space in half gets you from one to the other, there's probably been an error in definition.

Who knows what the future would bring?

A $32 million (1985 dollars) Cray 2 super computer could do 1.9GFlops.

You can now get over 50x that performance for less than a grand in a device that fits in your pocket. I bet those engineers didn't expect that in half a lifetime.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#83

Post by lixtra »

geofft wrote: post #29
mmastrac wrote: post #7

Earlier quoted context omitted.

No idea and completely unsourced, but one of the site comments states this: > 4) This only came up because of DarkMatter, a very shady operator who most people are very happy to have an excuse to screw with technicalities. Edit maybe these are sources? https://bugzilla.mozilla.org/show_bug.cgi?id=1531800 https://groups.google.com/forum/#!msg/mozilla.dev.security.p... Still not getting the whole picture.

The basic story as I understand it is that DarkMatter under contract to the United Arab Emirates wants to become a trusted CA, and they are widely expected to start running a governmental MITM once trusted, but the CA root programs don't have any provision for "You're a bunch of sketchy creeps, we don't trust you." (Oddly enough for a "trusted" root program, there is generally no actual evaluation of trust as convent…

The whole CA system is fundamentally broken.

When you point a virgin browser to a new ssl endpoint the user should be presented with the certificate and a list of certificate chains that imply trust in the certificate. At that point you should decide which certificate to trust or not. This can be

- only the end certificate (because you verified the hash),

- some intermediate certificate or

- some/all root certificates (that come with the browser).

Obviously the last option is stating “I’m incompetent and/or blindly trust the browser”. Unfortunately it is the default and the software doesn’t help you to manage certificates you trust in a reasonable way.

For me it would be okay to turn of dumb mode during installation. As a start, the green address bar could be used for these user trusted certificates (instead of for EV).

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#84

Post by jaas »

spydum wrote: post #10

Sooooo all the big players depend on one CA PKI package: EJBCA - is that not a major concern ?

EJBCA is popular but it's hardly a monoculture, especially among the larger CAs that can afford to do their own thing. Let's Encrypt doesn't use it, and I'm pretty sure a significant number of the other bigger CAs don't.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#85

Post by geofft »

TylerE wrote: post #81
Dylan16807 wrote: post #70

Earlier quoted context omitted.

There should be a very large gap between "theoretically impossible" and "practical". If cutting the search space in half gets you from one to the other, there's probably been an error in definition.

Who knows what the future would bring? A $32 million (1985 dollars) Cray 2 super computer could do 1.9GFlops. You can now get over 50x that performance for less than a grand in a device that fits in your pocket. I bet those engineers didn't expect that in half a lifetime.

Moore's law was described in 1965 and the experimental evidence lined up for well past the next two decades. If you handwave exactly what it means to "everything is 2x better every 1.5 years," we'd expect a factor of 2^(30 / 1.5) = 1 million by 2015, so having a factor of 100,000x in cost and having it fit in your pocket wasn't actually unexpected.

Certainly any cryptosystems designed in 1985 that wanted to encrypt data until today should have taken the most aggressive form of Moore's Law into account.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#86

Post by kardos »

geofft wrote: post #78
gpm wrote: post #40

Earlier quoted context omitted.

That seems like the correct state of things. More packages means more possibility of bugs. We want to trust as little code as possible. Now if only the same policy would be applied to CAs (possibly a few to mitigate abuse of power concerns, but far less than are in my trust store today).

Counterpoint (which I'm not fully convinced of myself, to be fair): CAs are supposed to be interchangeable and easy to revoke. While the CA ecosystem as a whole must be robust, no individual CA can be too big to fail. If a serious bug is found in software used by one or a few CAs (imagine something like the Debian OpenSSL bug from 11 years ago), revoking them and requiring customers to move to other CAs is feasible.…

Would two signatures on the same cert fit the bill?

Two complete certs is twice as much data to transmit, making the TLS setup a bit heavier.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#87

Post by geofft »

lixtra wrote: post #83
geofft wrote: post #29

Earlier quoted context omitted.

The basic story as I understand it is that DarkMatter under contract to the United Arab Emirates wants to become a trusted CA, and they are widely expected to start running a governmental MITM once trusted, but the CA root programs don't have any provision for "You're a bunch of sketchy creeps, we don't trust you." (Oddly enough for a "trusted" root program, there is generally no actual evaluation of trust as convent…

The whole CA system is fundamentally broken. When you point a virgin browser to a new ssl endpoint the user should be presented with the certificate and a list of certificate chains that imply trust in the certificate. At that point you should decide which certificate to trust or not. This can be - only the end certificate (because you verified the hash), - some intermediate certificate or - some/all root certificate…

Not obvious to me at all. I would say that believing you can manually verify hashes in a trustworthy way is incompetent. Where do you get the hashes to compare against from?

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#88

Post by nneonneo »

Ok, I’m all for strong security and better SSL infrastructure, but the response to this issue was just totally overboard. The issue - one fixed bit in a 64-bit randomized serial field - does not compromise the security of these certs in any meaningful way, especially not before their natural expiry dates anyway.

The disruption caused by reissuing everything surely exceeded the disruption of this theoretical issue. I guess, on the plus side, we get to find out whether the PKI infrastructure is ready for a mass revocation/replacement event...

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#89

Post by bcaa7f3a8bbc »

tedunangst wrote: post #72
geofft wrote: post #9

> Adam Caudill, the security researcher who blogged about the mass misissuance last weekend, pointed out that it’s easy to think that a difference of 1 single bit would be largely inconsequential when considering numbers this big. In fact, he said, the difference between 2^63 and 2^64 is more than 9 quintillion. Okay, but, that's because 2^63 itself is more than 9 quintillion. Where the search space was previously 18…

Or, if the safety margin here is really only one bit, we should probably increase the minimum. If 63 is unsafe today, 64 will be unsafe tomorrow. If you discovered your AES key generator only created 127 bit keys, would you correct the mistake moving forward? Or go back and immediately burn everything with the old key? The difference between 2^127 and 2^128 is much, much more than 9 quintillion.

Moreover, a Biclique attack against AES exists, by saving some meet-in-the-middle computations, it has already reduced the full 10 rounds, 128-bit AES to "just" 126-bit (25% of 128-bit) of security. Is it a clever attack? Yes. Does it mean the security of AES has been reduced to 25% of the original security level? No. Does it practically matter? No. This is exactly why 128-bit security is seen as a minimum standard in cryptography - it can provide a more-than-adequate security margin which renders all minor speedups in cryptanalysis irrelevant.

If the 64-bit random serial number has already provided an adequate security margin, it should be that no action needed for all existing 63-bit certificates. But it seems the choice of 64-bit here is arbitrary without good justification...

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#90

Post by talaketu »

ClassyJacket wrote: post #55
talaketu wrote: post #23

Earlier quoted context omitted.

"50% easier than theoretically impossible" means it's now 50% possible, doesn't it?

Nope, the chance of success for each attempt went from 1 in 18,000,000,000,000,000,000 to 2 in 18,000,000,000,000,000,000.

that's from theoretically possible to theoretically possible.
Post reply on HN