Remix.run Logo
Remix clone Hacker News
new | show | ask | jobsGithub
▲ luispa 6 hours ago

-----BEGIN RSA PRIVATE KEY----- 4 -----END RSA PRIVATE KEY-----

▲breakwaterlabs 5 hours ago | parent | next [-]

EC, not RSA. RSA would *never* allow something like that.

It would need to be a 3, 5, or 7, since a prime is required.

▲nneonneo 4 hours ago | parent [-]

“d=4” is a perfectly legal RSA private key. The corresponding public key would probably have a weird e (not 65537, the usual choice), but would otherwise be legal, and could have an arbitrarily large modulus n (thus appearing “secure”).

Note that p,q (the primes you’re thinking of) are not actually required for decryption. They enable you to calculate d, the decryption exponent, and also enable decryption-time optimizations (exponentiation with d_p and d_q followed by CRT recombination), but that’s optional. In fact, p,q can be computed from n, e and d.

▲mplewis 2 hours ago | parent [-]

congratulations, you've performed an autopsy on a joke

▲qubex 2 hours ago | parent [-]

To be fair, it was one hell of a corpse.

▲devmor an hour ago | parent [-]

To be four, you could open it to the world.

▲nayuki 5 hours ago | parent | prev | next [-]

You can't do that because an RSA private key contains two numbers - the modulus and the exponent. Even better, an RSA private key usually has the modulus stored as its two factors rather than their product.

Also note that using small numbers like 65537 for RSA public exponents is common practice.

▲nunez 5 hours ago | parent | prev | next [-]

That's INSANE

Like, that had to be malicious right? ssh-keygen won't generate a key like this, and neither will openssl or whatever Microsoft is doing behind their CA server.

▲xienze 3 hours ago | parent | next [-]

The other keys were 56, 66, 115, 155, 156, 230, 237. I honestly think whoever did this thought the "384" in 384-bit meant they had to choose numbers between 0-384.

▲jefftk 2 hours ago | parent [-]

There's only a ~1 in 17 chance that they'd all be below 256 if 384 was the limit. My money is on accidentally generating a 1-byte random number.

▲persedes 5 hours ago | parent | prev | next [-]

It's 0x0000000000000000000....4, but no, just good ol' human failure (and a bunch of extra f-ups along the way)

▲jms703 5 hours ago | parent | prev | next [-]

You should read the report from mozilla.

▲collinrapp 4 hours ago | parent [-]

I assume you’re referring to [1]? If so, I just did after seeing your comment. I couldn’t help but chuckle at the demonstration of how easy it would be for someone to obtain the private keys themselves using an LLM, even though it’s easy to crack without one….

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

▲alienbaby 4 hours ago | parent | prev | next [-]

Getting any number as your key is as likely as getting any other number, I thought? 4 is as likely as 64257383994662784857722891857 etc ..?

▲PeeMcGee 2 hours ago | parent | next [-]

Using RSA as an example, the prime factors are supposed to have the same bit length (plus or minus 1 for carryover) for a similar reason. If the smaller factor has 1 fewer bit than the larger factor, it will be discovered twice as quickly by brute force, and 4x faster if it has 2 fewer bits, 8x faster if it has 3 fewer bits, etc. You could technically create a 4096 bit RSA key where one of the factors is 3 and the other is some other giant prime, but it would be immediately discovered by a naive brute force attack. The algorithm itself isn't concerned with the bit-length difference and operates on the inputs opaquely. The key generator is responsible for selecting prime factors that cannot be easily derived from the algorithm's output.

▲OkayPhysicist 2 hours ago | parent | prev | next [-]

Sure, but the probability of getting "4" as opposed to some number that might as as well be equivalent to latter as far as a causal reader is concerned is insanely small.

▲karagenit 3 hours ago | parent | prev [-]

Yeah, except in total there were eight different weak keys, all less than 256. The odds of randomly generating those keys (all so small) is so astronomically low that we know for sure their keygen process was messed up.

▲alias_neo 5 hours ago | parent | prev [-]

Maybe it was just a mistake and they intended to generate a `--bitsize 4` thinking it was in kilobyte units.

shrug

I think they're just absolutely inept and should never be trusted with anything security related as an organisation if this is a mistake they could make.

▲throw0101c 3 hours ago | parent | prev | next [-]

> -----BEGIN RSA PRIVATE KEY----- 4 -----END RSA PRIVATE KEY-----

The "4" would be valid in hex, decimal, and even octal.

▲kccqzy 5 hours ago | parent | prev | next [-]

-----BEGIN PRIVATE KEY----- MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAShZANiAAQTglHNUqyS mMHIqtl3Mh3rl+cJvQtMoKylXcitUdz8nRWJoVl+OlEg4e/WMcY+GDXKyuKYaaYu FjHoooGBq1ZhbcRdkYq8CfOrDmPPeSqk3O1zh743u6VpVJ8cArJw7Wc= -----END PRIVATE KEY-----

The key needs to mention which curve it is using.

▲hatthew an hour ago | parent | prev | next [-]

technical accuracy aside, this made me giggle like a madman

▲jen20 6 hours ago | parent | prev | next [-]

BEGIN EC PRIVATE KEY, surely?

▲forlorn 5 hours ago | parent | prev | next [-]

We don't know what passwords other CAs have.

▲bigfishrunning an hour ago | parent [-]

Not yet we don't

▲ 5 hours ago | parent | prev | next [-]
[deleted]
▲kibwen 3 hours ago | parent | prev | next [-]

Annoyed that you've posted this, now I need to go increment all the private keys on my servers. >:(

▲bigfishrunning an hour ago | parent [-]

5 has two ones in it!

▲ 6 hours ago | parent | prev | next [-]
[deleted]
▲zoobab 6 hours ago | parent | prev [-]

[flagged]

▲sspiff 6 hours ago | parent | next [-]

No need to resort to racism. Stupidity is present in all nations.

▲knottn 6 hours ago | parent [-]

India is a place not a race though. They have an entire caste system built around that fact.

▲triceratops 6 hours ago | parent | next [-]

Today "racism" is used as a synonym for "bigotry". Would you agree it was bigotry? Or do you only have a problem with people using words wrong, and not bigotry itself?

▲alt227 6 hours ago | parent [-]

Whynot use the correct word for it, which is prejudice? Racism is prejudice against a race. You can be prejudiced to any group of people, doesnt mean that you are biggoted.

▲triceratops 6 hours ago | parent [-]

> Whynot use the correct word for it, which is prejudice?

Again you seem more concerned with grammar than, y'know, condemning racism, prejudice, or bigotry. They're all equally bad and closely related concepts. "A rose by another name" and so on.

Your own comment has 3 typos and several grammatical errors ("prejudiced to" is wrong, for example). Irony.

Finally, modern usages of "racism" encapsulate all of these meanings. Languages change over time.

> You can be prejudiced to any group of people, doesnt mean that you are biggoted

Yes, that's literally what it means.

▲dugidugout 5 hours ago | parent | next [-]

They are not being pedantic here, they are establishing a meaningful difference in words to help distinguish a shared phenomena. I think the original comment was unnecessary and certainly bigoted, but I would need more to say racism. The "grammar" guy clarified twice the semantic difference they personally observed (note they did not labor on syntax like you wish to suggest).

All that said, I make this comment as I believe the other commenter's worry is on display im this comment here...

> Again you seem more concerned with grammar than, y'know, condemning racism, prejudice, or bigotry. They're all equally bad and closely related concepts

These are _not_ all equally bad. Prejudice is foundational to understanding, there is no escape from this. In this understanding, we should treat particular postures of prejudice more serious than collapsing any "bad prejudice" under the same label.

▲triceratops 5 hours ago | parent [-]

> I think the original comment was unnecessary and certainly bigoted, but I would need more to say racism

Do you think racism is worse than bigotry? Why? I understand that the first word has a more emotional charge in our times. But as far as "bad things to do" go they're equal in gravity. Racism is just a subset of bigotry.

> These are _not_ all equally bad

Why not?

> Prejudice is foundational to understanding

That's one definition of the word - "judging without knowing the facts".

But there's another definition - "an irrational hostile attitude, fear, or hatred towards a particular group, race, or religion" - which was the one we are operating with in this thread.

https://en.wiktionary.org/wiki/prejudice#English

▲dugidugout 2 hours ago | parent [-]

[dead]

▲ 3 hours ago | parent | prev | next [-]
[deleted]
▲49369201837 5 hours ago | parent | prev [-]

[flagged]

▲zoobab 6 hours ago | parent | prev | next [-]

You have little and big endians:

https://en.wikipedia.org/wiki/Endianness

I had a bunch of openwrt routers based on the ADM5120 SoC, some of them were of different endianness, totally wth:

https://linux-mips.org/wiki/Adm5120

▲sspiff 5 hours ago | parent | prev [-]

My mistake. English is not my first language. In my native language, the word racism is used for discrimination or prejudice against anything foreign (nation, race, language, ...).

But either way, I find the reduction of the argument to the semantics of the word racism to be deflection. Wouldn't you agree the original comment was made in poor taste? Why did it need to include a reference to Indian and imply that all things Indian made are cheap or low quality?

We applied this kind of mindset to the Japanese in the 60s and 70s, and look where that got us. I witness it happening again in the 00s and 10s applied to Korean electronics (LG and Samsung mostly) while we were content with minor improvements over the status quo and innovating far too slowly.

Yes, this incident has an almost farcical amount of stupid attached to it, but the fact that it happened to an Indian company is in my eyes only coincidental. There are plenty of Silicon Valley startups and tech companies that are equally cavalier about aspects of security and apply the mentality of "we'll fix it in post" to anything but shipping features.

▲freetonik 5 hours ago | parent | next [-]

>In my native language, the word racism is used for discrimination or prejudice against anything foreign (nation, race, language, ...).

Curious which language is that, and if "racism" is an accurate translation to English. What you describe sounds more like xenophobia.

▲sspiff 5 hours ago | parent [-]

Dutch. The word is "racisme", and the entry for it in our dictionary[0] states:

> Racism is a form of discrimination in which a person is judged on the basis of his or her ethnic origin, skin color, nationality or religion. It is a form of prejudice and inequality that prevents people from gaining equal opportunities.

While I'm happy to admit that perhaps my use of the word in English is incorrect and its meaning there is more narrow, in Dutch it covers nationality or religion as well. Islamophobia is considered racist ("racistisch") in Dutch, for example.

[0]: https://www.nationaalwoordenboek.nl/woord/racisme.html

▲zoobab 5 hours ago | parent | prev [-]

"There are plenty of Silicon Valley startups and tech companies that are equally cavalier about aspects of security and apply the mentality of "we'll fix it in post" to anything but shipping features."

Most companies handle security very badly.

▲ 6 hours ago | parent | prev | next [-]
[deleted]
▲gagan2020 5 hours ago | parent | prev [-]

I am against eMudhra to the core and their stupidity (or playing the dangerous game of compromising the security) but this is pure racism.

▲wannabe44 4 hours ago | parent [-]

IME the number of manual processes which are bug-prone and faulty in Indian teams is higher than normal, and so is the reluctance to any form of automated testing, and general unawareness about any security or licensing concerns.

▲gagan2020 27 minutes ago | parent [-]

This is also racists. How many Indian engineers are there vs rest of the world? What kind of work is getting outsourced?

Let's take your words only.

Manual processes which are bug-prone and faulty are getting outsourced. They handle it with their best knowledge. Some processes/data knowledge is never transferred and some are kept hidden and assumed from outsourced teams but they have different culture and exposure so their understanding of things might be different. Its expectation mismatch not team issues.

American software giants are run by Indians only. So, if they are bug-prone & faulty then how could they reach there. It just that when person study with you or live with you then they have same set of culture & exposure like you have. So, they can manage things effectively.