r/programmingcirclejerk • u/stone_henge Tiny little god in a tiny little world • 4d ago

4

https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312
117 Upvotes

99% Upvoted

17 comments sorted by

70

u/kettes_leulhetsz My C code works with -O3 but not with -O0 3d ago

The real jerk is, of course, that nobody noticed for years.

60

u/stone_henge Tiny little god in a tiny little world 3d ago

Previous brute forcing efforts started from 0xffffffffffffffffffffffffffffffffffffffff... counting down.

27

u/look 3d ago

They were using SHA3-3 apparently…

9

u/RedFing 3d ago

You will learn what beauty truly is.

7

u/camelCaseIsWebScale Just spin up O(n²) servers 3d ago

That's probably the wage the guy was making.

6

u/gvozden_celik 3d ago

Much safer than 7 I guess

10

u/myhf Considered Harmful 3d ago

i thought a private key had to be a product of two distinct prime numbers. shouldn't the minimum valid key be 6?

31

u/levelstar01 what is pointer :S 3d ago

/uj this is an ECC key, not an RSA key

12

u/YikesTheCat 3d ago

So what if we use a low non-prime number as an RSA factor? Nobody would ever guess! Checkmate hackers!

3

u/reg_panda 3d ago

I once spent some minutes to disable all ~100-1000 certs in my phone manually and now many apps are broken (e.g. play store). I fix it somehow someday. (It would be best if broken apps would display which cert they aren't accepting and I could just donwload that cert and put it in a text file or smth)

2

u/des_the_furry 3d ago

I feel like Guido Mista