News for hackers. Stuff that matters.
Re:eMudhra to Exit Global SSL/TLS Certificate Business by alienbaby on Thursday October 22, 2026 @12:53PM (#50197967)
Getting any number as your key is as likely as getting any other number, I thought? 4 is as likely as 64257383994662784857722891857 etc ..?
Re:eMudhra to Exit Global SSL/TLS Certificate Business by PeeMcGee on Thursday October 22, 2026 @02:03PM (#50198944)
Using RSA as an example, the prime factors are supposed to have the same bit length (plus or minus 1 for carryover) for a similar reason. If the smaller factor has 1 fewer bit than the larger factor, it will be discovered twice as quickly by brute force, and 4x faster if it has 2 fewer bits, 8x faster if it has 3 fewer bits, etc. You could technically create a 4096 bit RSA key where one of the factors is 3 and the other is some other giant prime, but it would be immediately discovered by a naive brute force attack. The algorithm itself isn't concerned with the bit-length difference and operates on the inputs opaquely. The key generator is responsible for selecting prime factors that cannot be easily derived from the algorithm's output.
Re:eMudhra to Exit Global SSL/TLS Certificate Business by OkayPhysicist on Thursday October 22, 2026 @02:24PM (#50199180)
Sure, but the probability of getting "4" as opposed to some number that might as as well be equivalent to latter as far as a causal reader is concerned is insanely small.
Re:eMudhra to Exit Global SSL/TLS Certificate Business by nunez on Friday October 23, 2026 @06:50PM (#50216464)
and it's more surprising that the program that was used to generate the key isn't like "uhhh no"
Re:eMudhra to Exit Global SSL/TLS Certificate Business by karagenit on Thursday October 22, 2026 @01:45PM (#50198699)
Yeah, except in total there were eight different weak keys, all less than 256. The odds of randomly generating those keys (all so small) is so astronomically low that we know for sure their keygen process was messed up.