8 ms·
Yup, this is what I will be trying next.
by benjojo12 11y ago
Yup, this is what I will be trying next.
- baby 11y agoOh and check for low private keys as well, I did that before here's the code: http://cryptologie.net/article/265/small-rsa-private-key-problem/ http://cryptologie.net/article/265/small-rsa-private-key-pro...
- LunaSea 11y agoIt could be interesting to try to match those keys to the ones generated by Debian during the OpenSSH vulnerability [1] period. [1] http://jblevins.org/log/ssh-vulnkey http://jblevins.org/log/ssh-vulnkey
- ryan-c 11y agoI'd also suggest looking at the rsa public exponents. PuTTY and OpenSSH (at least used to) use their own values when generating keys, so you can somewhat reliably identify which keys were generated by these tools
- martincmartin 11y agoIt would be interesting to see, what's the public key that's used by the largest number of accounts? I wonder if some people, instead of generating their own, use a public/private pair they downloaded from the internet somewhere, not realizing the vulnerability.
- baby 11y agoI don't think that would happen since you would not find such a result googling for "how to get a pgp key". Makes me want to do a parody webpage explaining how to setup PGP by just copy/pasting one
- martincmartin 11y agoIt's quite possible it doesn't happen, but it's also a trivial SQL command to find out..
- leni536 11y agoMaybe it doesn't happen directly but through downloading some preconfigured Linux VM with the private/public key already set up.
- dale-cooper 11y agoI don't think github allows you to use the same key for different accounts. Maybe it's the way they identify the user who is pushing over ssh?
- djcapelis 11y agoCorrect!
- facetube 11y agoDo you have any (anonymized) stats for the largest key sizes you encountered? I ask as the owner of a comically-large key.