logoalt Hacker News

nunez • yesterday at 3:28 PM • 5 replies • view on HN

That's INSANE

Like, that had to be malicious right? ssh-keygen won't generate a key like this, and neither will openssl or whatever Microsoft is doing behind their CA server.


Replies

persedes • yesterday at 3:46 PM

It's 0x0000000000000000000....4, but no, just good ol' human failure (and a bunch of extra f-ups along the way)

xienze • yesterday at 5:29 PM

The other keys were 56, 66, 115, 155, 156, 230, 237. I honestly think whoever did this thought the "384" in 384-bit meant they had to choose numbers between 0-384.

➕ show 1 reply
jms703 • yesterday at 3:35 PM

You should read the report from mozilla.

➕ show 1 reply
alienbaby • yesterday at 4:53 PM

Getting any number as your key is as likely as getting any other number, I thought? 4 is as likely as 64257383994662784857722891857 etc ..?

➕ show 3 replies
alias_neo • yesterday at 3:54 PM

Maybe it was just a mistake and they intended to generate a `--bitsize 4` thinking it was in kilobyte units.

shrug

I think they're just absolutely inept and should never be trusted with anything security related as an organisation if this is a mistake they could make.