4 ms·
Not true. IIRC, the way the Debian bug was found was by some parties noticing a bunch of collisions of SSH public keys. (For example, Github lets you push/pull
by jey 13y ago
Not true. IIRC, the way the Debian bug was found was by some parties noticing a bunch of collisions of SSH public keys.
(For example, Github lets you push/pull via SSH as git@github.com, and they determine your identity by the SSH key used.)
- hueving 13y agoHow is what I said not true? If the same thing as the Deb prng bug happened in a closed source system, it could sit for a couple of years exposing thousands/millions of systems and then be patched quietly to avoid embarrassment, leaving everyone vulnerable.
- lstamour 13y agoFYI -- the source code here is public. Didn't help :D
- sneak 13y agoIt helped us realize how easy it would be to test for this, and that Apple isn't.
- lawnchair_larry 13y agoI question your code comprehension. This is not easy to test for at all, and Chrome doesn't do it either. Do you understand how to exploit this issue?
- hueving 13y agoStatic analysis would have caught this immediately. It caused unreachable code that the compiler even recognized and optimized away. You're saying Google Chrome doesn't test that an ephemeral key is actually signed by the cert's private key? If that's the case, that's completely unacceptable because it's the whole point of the protocol.