Intermediate certs allow anyone to mint web credentials for any Internet server.

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

  • LordCrom@lemmy.worldEnglish
    2·
    3 小时前

    Remember kiddies, if you don’t have an update, you can always manually remove the certs from your local trust store.

    I imagine old java keystores or legacy browsers that have self co tai end keystores would be targets for manual fixes.

  • cron@feddit.orgOPEnglish
    8·
    12 小时前

    Anybody else just got troubles with this? At work, we’re just finding out if the certs were trusted and where exactly.

    • fibojoly@sh.itjust.worksEnglish
      13·
      11 小时前

      My colleague was laughing his head off all morning. Never a good sign when we start laughing a lot, in our office :,D

  • jaybone@lemmy.zipEnglish
    61·
    11 小时前

    As noted, most browsers have already blocked the intermediate certificates

    Doesn’t this require a browser update? Or they already check these certs with some external service which now knows to reject these certs?

    Edit: from this link https://ifin.network/t/emudhra-intermediate-certificates-compromised/909

    Chrome and Firefox browsers now have updated trust stores that revoke these CAs

    Are those trust stores automatically updated? Or does this actually require downloading a browser update? Like a new (minor) version of the software distribution?