Post

Givin this a little bump. I haven't heard anyone mention how long the CA went with a passphrase of '4' before it was discovered / cracked. Quis custodiet ipsos custodes? If nobody is probing as a public service, that is even worse IMO.

Alex Wykoff@distributed.camp

A good question to ask is how long did they get away with it?

EricLaw 🎻

@ericlawrence.com

I don’t understand the math involved, but it does seem like it would be non-trivial to figure it out? Can you put in one giant number and get out another giant number and the fact that the second is convertible from the first is not readily apparent as far as I understand things.

Alex Wykoff

@distributed.camp

Are we being fatuous about factoring and brute force (or in this case a light tap)?

EricLaw 🎻

@ericlawrence.com

There are many things in both Infosec and the real world that would fail if probed. My point is just that the same principle the encryption depends upon (inability to drive the key from the output) is the one that makes it not blindingly obvious when your keys are dangerously insecure.

21/10/26, 4:58 pm0 reposts1 like

EricLaw 🎻

@ericlawrence.com

16151413121110090807060504030201 isn't a secure key either, but good luck brute forcing to it.