They used the "correct" key for signing the CRLs (which of course was then an invalid signature):

> The CRL's were signed with the original private keys (which were supposed to be the correct keys with appropriate entropy) but given that this resulted in incorrect signatures, they were resigned with flawed keys.

And THAT is where I'm drawing the line between "honest mistake" and "gross negligence". For that to not raise giant red flags is an unacceptable failure in process and work culture.

▲

user43928 17 hours ago | parent | next [-]

I've seen speculation that there was a language barrier, given that this is an Indian company.

The theory was that someone misinterpreted 384-bit keys to mean the key must be a number between 1-384.

I think that's entirely made up, but it wouldn't be completely implausible to have happened while someone tried to troubleshoot why the first attempt failed.

	▲	eqvinox 12 hours ago \| parent \| next [-]
		> I've seen speculation that there was a language barrier, given that this is an Indian company. The discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 really doesn't sound like that, but who knows what's getting lost in the "fog of war" we're currently getting on this all.
	▲	trollbridge 11 hours ago \| parent \| prev [-]
		I mean, what we call "Arabic numerals" actually originated in India. Indians, generally speaking, can comprehend numbers. A language barrier is not an acceptable excuse, especially in a country where the primary language of technology firms is English.

▲

baobabKoodaa a day ago | parent | prev [-]

Unreal. Absolutely unreal.