News for hackers. Stuff that matters.

A comment on TIL that You can spot base64 encoded JSON, certificates, and private keys. Parent comment

Re:TIL that You can spot base64 encoded JSON, certificates, ... by Muromec on Tuesday August 05, 2025 @04:00PM (#44803477)
MII is not RSA, it's an opening header of asn1 structure encoded to DER -- 30 82 0x which is basically "{" when which can be pretty much anything from x509 certificate to private keys fro ECDSA.

Actual RSA oid is somewhere in the middle.

[ Parent | on HN ]
Re:TIL that You can spot base64 encoded JSON, certificates, ... by mmastrac on Tuesday August 05, 2025 @04:14PM (#44803667)
True, but for the most part, RSA keys are the only keys that anyone encounters that start with long SEQUENCEs requiring two-byte lengths.

`eY` could be any JSON, but it's most likely going to be a JWT.

Neither is a perfect signal, but contextually is more likely correct than not.

[ Parent | on HN ]
Re:TIL that You can spot base64 encoded JSON, certificates, ... by Muromec on Tuesday August 05, 2025 @04:22PM (#44803749)
That depends on the kind of abyss you are staring into. Mine had plenty of non-RSA keys, certificates (which are of course two-byte length all the time) and CMS containers.
[ Parent | on HN ]