Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

lkml.org

Post reply on HN
Print view View original

1–10 of 131 posts

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#2

Post by ckastner »

This has also been discovered with the Debian project, as I submitted a while ago [1].

The really scary part is the follow-up [2]:

  > € gpg --search-key samuel.thibault@gnu.org
  > ...
  > (1) Samuel Thibault 
  > 4096 bit RSA key 7D069EE6, created: 2014-06-16

  And it has 55 signatures from 55 colliding keys...
Edit: even the 64-bit fingerprint is probably insufficient, see [3].

[1] https://lists.debian.org/debian-devel/2016/08/msg00143.html

[2] https://lists.debian.org/debian-devel/2016/08/msg00144.html

[3] https://lists.debian.org/debian-devel/2016/08/msg00215.html

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#3

Post by CiPHPerCoder »

I've attended security conferences in the past two years wherein representatives of companies that claim to see 80+ percent of all Internet traffic in their threat intel offerings who were presenting about Android malware reverse engineering used short IDs in their slide deck and business cards.

When I mentioned Evil32 to them, they looked at a loss.

https://evil32.com

If this is news to you, don't feel bad. Many infosec conference speakers don't do this right either, and those are the sorts of people you'd expect to get this right.

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#5

Post by ajdlinux »

All the fake keys that I've seen mentioned are from the data set at https://evil32.com.

It appears a couple of researchers decided, back in 2014, to demonstrate this issue by cloning the entire strong set of the PGP web of trust (not just Linus' key, but basically everyone who uses PGP/GPG for Free Software development - myself included).

It would appear that sometime quite recently, someone decided it would be fun to upload all of those keys (there's ~24,000 in their tarball) to the keyservers...

One would hope that the researchers behind evil32.com are ethical enough and sensible enough to have permanently destroyed the secret keys - but obviously, anyone could mount this attack quite trivially with modern hardware.

So, check your fingerprints!

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#6

Post by wtbob »

I don't know why more folks don't display keys and fingerprints as Base64; it seems to me that "q68RxlopcLEwq+PEeb4+QwBBGIY=" (Linus's real key) and "D2oUZTLYaa7kOPdLYhGqOwBBGIY=" (Linus's fake key) are pretty easilt-distinguishable, and not terribly verbose.

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#8

Post by eli »

wtbob wrote: post #6

I don't know why more folks don't display keys and fingerprints as Base64; it seems to me that "q68RxlopcLEwq+PEeb4+QwBBGIY=" (Linus's real key) and "D2oUZTLYaa7kOPdLYhGqOwBBGIY=" (Linus's fake key) are pretty easilt-distinguishable, and not terribly verbose.

If everyone did that, couldn't attackers just target collisions that "look like" the target key in Base64? i.e. the same first 5 or 6 chars and the punctuation in the right places.

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#9

Post by YPCrumble »

wtbob wrote: post #6

I don't know why more folks don't display keys and fingerprints as Base64; it seems to me that "q68RxlopcLEwq+PEeb4+QwBBGIY=" (Linus's real key) and "D2oUZTLYaa7kOPdLYhGqOwBBGIY=" (Linus's fake key) are pretty easilt-distinguishable, and not terribly verbose.

Is there a reason a hacker couldn't just create a key like "q68RxlopoLEwq+PEeb4+QwBBGIY=" to create a similar problem?

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#10

Post by _wmd »

wtbob wrote: post #6

I don't know why more folks don't display keys and fingerprints as Base64; it seems to me that "q68RxlopcLEwq+PEeb4+QwBBGIY=" (Linus's real key) and "D2oUZTLYaa7kOPdLYhGqOwBBGIY=" (Linus's fake key) are pretty easilt-distinguishable, and not terribly verbose.

You can do what PGPfone did and encode the fingerprint as a series of dictionary words:

Real gregkh: 647F28654894E3BD457199BE38DBBDC8 = style tactful newcomers file gallows adored insist flags athletics

Fake gregkh: 497C48CE16B926E93F49630127365DEA = jukebox governor fashionable mahogany prepares gobble surprised martha apostles

There's even an Internet standard for this: http://tools.ietf.org/html/rfc1751 , although its dictionary isn't very large or interesting. Here's another implementation intended for BitTorrent magnet hashes: http://pythonsweetness.tumblr.com/post/56715292510/cheatcode...

SSH keygen has a mode where the digest is printed as ASCII art, I imagine by using the key as input into something like a fractal function. I can't find the option for it, but I'm sure you've seen it on the console at some point

Post reply on HN