alt Hacker NewsI wouldn't be surprised if we learn in the near future, that this was deliberate.
Replies
hannob • today at 10:49 AM
Makes no sense.
If it was deliberate, one would use keys that only the person abusing it has. Not keys everyone can guess if they get a hint.
➕ show 1 reply
skywhopper • today at 10:38 AM
Sounds more like extremely sloppy procedures. Which depressingly I doubt are unusual among CAs.
➕ show 1 reply
betterunix2 • today at 2:40 PM
I would be shocked if this was anything other than a bug. A CA already has the power to issue MITM certificates, so what reason would a CA have to deliberately generate bad keys?
In all likelihood it is code that reads 1 byte from /dev/random, or reads 32 bytes but writes it into a 1 byte array, or something to that effect.
I'm not so sure. If you wanted to be deliberate, you'd choose a plausible value that you could control.
No one is going to suspect `98761316832165974216498789746` is anything other than random. But `000000000000000123` looks suspicious.