Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

arstechnica.com

Post reply on HN
Print view View original

91–100 of 143 posts

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#91

Post by cheeze »

paulddraper wrote: post #22
wahern wrote: post #20

Presumably 64 bits were originally chosen because it still permitted simple or naive ASN.1 decoders to return the parsed value as a native 64-bit type. But ASN.1 INTEGERs are always signed, so theses serials would now have to be 65 bits. But any ASN.1 decoder interface that permitted directly storing a 65-bit value into a 64-bit type--even an unsigned type--is dangerous if not broken. I'm guessing that most X.509 man…

Yes, now certificates are about half as hard to hack as they were supposed to be.

Well, it depends on what you mean by "hack."

The attack that we're talking about here isn't breaking a signature, but relies instead on being able to manipulate certificate data to generate a certificate with a known hash. That hash must collide with another certificate hash, which would then let you generate a rogue certificate.

A team demonstrated that this attack was possible by being able to issue a rogue cert by being able to predict the not_before and not_after on the certificate that would be issued, predicting the serial of the issued cert, and finding an input for the rest of the cert fields which caused a collision.

https://www.win.tue.nl/hashclash/rogue-ca/

So, yes 128 bit serials would be better, but we should be safe even at 63 bits of entropy.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#92

Post by cheeze »

jaas wrote: post #84
spydum wrote: post #10

Sooooo all the big players depend on one CA PKI package: EJBCA - is that not a major concern ?

EJBCA is popular but it's hardly a monoculture, especially among the larger CAs that can afford to do their own thing. Let's Encrypt doesn't use it, and I'm pretty sure a significant number of the other bigger CAs don't.

Well, it will come out who was using it since they will have to disclose this.

I don't think Digicert/Symantec are using it

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#93

Post by ehsankia »

profmonocle wrote: post #12

Just to be clear - "mississued" in this case doesn't mean they were issued to someone who doesn't control the domain. The issue is they were issued using a 63-bit serial number instead of the minimum 64 bits. (The software these CAs were all using was generating 64 random bits, but setting the first bit to zero to produce a positive integer.) The reason CAs are required to use 64-bit serial numbers is to make the con…

Is there a reason why certificates are being issued using the bare minimum required number of bits, instead of something higher like 128 or 256? Why even risk being at the very edge?

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#94

Post by Dylan16807 »

omeid2 wrote: post #75
Dylan16807 wrote: post #73

Earlier quoted context omitted.

A 2X difference from baseline does not make a meaningful difference in who can attack you.

It could make the difference of mounting a hash collision before a certificate expires or after (2X time), if the attack doesn't yield to parallelism and time becomes a limiting factor.

The claim was about a 1 bit reduction in entropy. A scenario like that definitely acts differently, but it's not searching a space either; reducing a guaranteed calculation time by 2x is not really comparable to a loss of 1 entropy bit.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#95

Post by IloveHN84 »

Personally I hate EJBCA.

Recently they stopped releasing new updates for the community edition (blocker at 6.10, while the 7.0.1 is out) because they are a really greedy company.

Building by yourself is half a nightmare and the installation process as well, relying on ant tasks for it and that fail 5 out of 10 times.

Considering the UI, most of the settings can be really misused and even their evangelist can get fooled by it (especially with their Enterprise Hardware Instance, whose synchronization across the nodes is also faulty)

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#96

Post by dodobirdlord »

TylerE wrote: post #81
Dylan16807 wrote: post #70

Earlier quoted context omitted.

There should be a very large gap between "theoretically impossible" and "practical". If cutting the search space in half gets you from one to the other, there's probably been an error in definition.

Who knows what the future would bring? A $32 million (1985 dollars) Cray 2 super computer could do 1.9GFlops. You can now get over 50x that performance for less than a grand in a device that fits in your pocket. I bet those engineers didn't expect that in half a lifetime.

That's rather beside the point. If 63 bits is insecure, then 64 bits is also insecure. If I can brute force 63 bits in a week, I can brute force 64 bits in 2 weeks. If we are worried that 63 bits is a security issue, then the solution isn't increasing to 64 bits, it's increasing to 96 bits, or 128 bits.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#97

Post by [deleted] »

ehsankia wrote: post #93
profmonocle wrote: post #12

Just to be clear - "mississued" in this case doesn't mean they were issued to someone who doesn't control the domain. The issue is they were issued using a 63-bit serial number instead of the minimum 64 bits. (The software these CAs were all using was generating 64 random bits, but setting the first bit to zero to produce a positive integer.) The reason CAs are required to use 64-bit serial numbers is to make the con…

Is there a reason why certificates are being issued using the bare minimum required number of bits, instead of something higher like 128 or 256? Why even risk being at the very edge?

[deleted]

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#98

Post by lixtra »

geofft wrote: post #87
lixtra wrote: post #83

Earlier quoted context omitted.

The whole CA system is fundamentally broken. When you point a virgin browser to a new ssl endpoint the user should be presented with the certificate and a list of certificate chains that imply trust in the certificate. At that point you should decide which certificate to trust or not. This can be - only the end certificate (because you verified the hash), - some intermediate certificate or - some/all root certificate…

Not obvious to me at all. I would say that believing you can manually verify hashes in a trustworthy way is incompetent. Where do you get the hashes to compare against from?

You get the hashes you trust from the counterparty that you trust. I.e. your bank could print it everywhere.

It’s not less obvious than just trusting your browser vendor.

EDIT: Also note that in the presented approach you can still trust some root CAs. It’s just that the user has to do it explicitly.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#99

Post by Spare_account »

talaketu wrote: post #90
ClassyJacket wrote: post #55

Earlier quoted context omitted.

Nope, the chance of success for each attempt went from 1 in 18,000,000,000,000,000,000 to 2 in 18,000,000,000,000,000,000.

that's from theoretically possible to theoretically possible.

Which is grammatically consistent with the assertion that fundamentally nothing has changed: certificates with a 63-bit serial number are unlikely to be compromised and certificates with a valid 64-bit serial number are also unlikely to be compromised.

Re: A world of hurt after GoDaddy, Apple, and Google misissue 1M certificates

#100

Post by Golfkid2Gadfly »

What an incredible non-story burying an actual real and terrifying story.

The crux of this entire issue is a company known as Dark Matter, which is essentially a UAE state sponsored company, potentially getting a root CA trusted by Mozilla.

It's highly suspected that Dark Matter is working on behalf of the UAE to get a root trusted certificate in order to spy on encrypted traffic at their will. Everyone involved in this decision is at least suspect of this if not actively seeking a way to thwart Dark Matter.

Mozilla threw the book at them by giving them this technical hurdle about their 63-bit generated serial numbers - which turned out to be something that a lot of other (far more reputable) vendors also happened to have this issue.

Should it get fixed? Ya, absolutely.

Is it nearly as big of a deal as giving a company like Dark Matter, who works on behalf of the UAE, the ability to decrypt HTTPS communication? Not even close - this is far more scarier, and much more of a security threat to you and me. It's pretty disappointing that this is the story that arstechnica runs with instead of the far more critical one.

The measure of what makes a trustworthy CA are things like organizational competency and technical procedures. These are things that state level actors easily succeed in. There is no real measure in place for motives and morals for state level actors. That should be the terrifying part of this story - anyone arguing about the entropy of 63 or 64 bit is simply missing the forest for the trees in this argument.

Post reply on HN