Post

Givin this a little bump. I haven't heard anyone mention how long the CA went with a passphrase of '4' before it was discovered / cracked. Quis custodiet ipsos custodes? If nobody is probing as a public service, that is even worse IMO.

Alex Wykoff@distributed.camp

A good question to ask is how long did they get away with it?

0 reposts0 likes

I don’t understand the math involved, but it does seem like it would be non-trivial to figure it out? Can you put in one giant number and get out another giant number and the fact that the second is convertible from the first is not readily apparent as far as I understand things.

There are many things in both Infosec and the real world that would fail if probed. My point is just that the same principle the encryption depends upon (inability to drive the key from the output) is the one that makes it not blindingly obvious when your keys are dangerously insecure.

I think this is legitimately a case of “no one put in place a process to check that the brain surgeon isn’t eating crayons” because why would you need to?