5 ms·
Quite expected, as root certs are not generated by a smartcard chip. The paper itself says not much of typical browser TLS is affected.
by dullgiulio 9y ago
Quite expected, as root certs are not generated by a smartcard chip. The paper itself says not much of typical browser TLS is affected.
- jlgaddis 9y agoOops, I meant to post the results of running the tool across the US DoD's Root CA certificates (same result, FWIW) -- I have NFI how they are generated -- but thanks for the response. I would hope that most root CA certificates are generated by and stored in HSMs but I really wouldn't be surprised to find that some little-known root CA went the cheap/easy route.
- lvh 9y agoThe requirements for being a public CA are self-regulated by the industry (via a consortium called CABforum including CAs and browser vendors). The requirements are far more stringent than that, but yes, you need an appropriate HSM. There are some biases that are far more likely in some root CAs because they’re unusually long-lived. For example, I would expect Blum primes to be more prevalent among CAs than a randomly selected leaf certificate. This is because of pre-NFS/QFS folklore that they’re safer. While this is a detectable pattern, it’s not known to produce weaker keys, though it does effectively halve your set of primes.
- jlgaddis 9y ago> The requirements for being a public CA are self-regulated by the industry (via a consortium called CABforum including CAs and browser vendors). The requirements are far more stringent than that, but yes, you need an appropriate HSM. Yeah, and no root CA would ever do anything to violate the BRs, right? /s
- lvh 9y agoIt’s true that BRs exist for a reason (and CAs occasionally fail to follow them), but roots not being on an appropriate HSM would be an extraordinary claim. The failures we’ve seen are not in the same ballpark.
- ph4r05 9y agoWe also checked all intermediate CA certs - all are ok. (sources: Certificate Transparency, Censys)