GgoogleJP first seen 18 h ago, last 17 h ago, peak #1

Compromised certificate authority private keys cracked with single byte

Original: 証明書 脆弱性

Security outlet GIGAZINE reports that all eight certificate authorities compromised in the eMudhra breach had private keys so weak they could be recovered from as little as a single byte — one key was just the number 4. These keys chained back to a root certificate trusted by the root programs of Mozilla, Microsoft, Apple and Chrome, and by many downstream trust stores, raising concerns about the integrity of the web's certificate trust system.

Why now: A security breach showing trivially weak private keys trusted by major browser root programs has alarmed the security community.

eMudhraMozillaMicrosoftAppleGoogle Chrome

Open on google →

Evidence

• eMudhraで侵害された8つの認証局すべての秘密鍵はなんとたった「1バイト」で秘密鍵の1つは「4」、Mozilla・Microsoft・Apple・Chromeのルートプログラムや多くの下流トラストストアによって信頼されているルート証明書に連鎖 · GIGAZINE

API: https://socialmediatrends-api.osmike.com/v1/trends/3178288