new | show | ask | jobs Github

yoavm 8 hours ago

Why would it be?

▲

sscaryterry 8 hours ago | parent [-]

Do I honestly need to enumerate what you can do if you have the keys for a CA?

▲

swiftcoder 8 hours ago | parent [-]

Yeah, but if you are the one issuing the CA's private key, you already, by definition, have the keys to that CA. You don't need to make stupid keys in that scenario

▲

sscaryterry 8 hours ago | parent [-]

In case it wasn't obvious. The NSA and many other organisation would find this extremely useful.

▲

yoavm 7 hours ago | parent [-]

But it doesn't make sense. Sure they'd find it extremely useful to have the key, but it doesn't need to be a weak key for it to be useful. If anything, it makes it less useful to them.

If I'm going to ask you or force you to share your password with me, there's no reason I'd ask you to set the password to 4. We might as well agree that the password would be D#!(s9fj0jalk!4af095SF42 , and it's much more likely our collaboration will continue working for years.

"Never attribute to malice that which is adequately explained by stupidity"

▲

skinfaxi 6 hours ago | parent [-]

A weak key means use is unattributable.

	▲	NetMageSCW 3 hours ago \| parent [-]
		A secret strong key is also unattributable.