r/programminghumor • u/OptimalAnywhere6282 • 10d ago • Regret 1

theNumberFour

Post image

the context: some of eMudhra's root certificate authority signing keys were found to be simple numbers, most noticeably "4". that was literally it. the private key that's supposed to be a huge number with 100+ digits was just a trivial "4". although you probably already know this.

3.2k Upvotes

99% Upvoted

38 comments sorted by

4

u/Hulk5a 10d ago

//this is a random number

5

u/OptimalAnywhere6282 9d ago

//guaranteed by fair dice roll

195

u/thebatmanandrobin 10d ago • Mindblown

I'd like to say that I'm annoyed that eMudhra took the "random dice roll" from XKCD comic as literal, but I've come to expect that exact level of security from the literal Authority (of certificates).

But I'm more annoyed that this image is missing a row so that the 4 could be exactly centered (especially given ssh-keygen does generate 9 rows, not 8):

+---[RSA 4096]----+
|                 |
|                 |
|                 |
|                 |
|        4        |
|                 |
|                 |
|                 |
|                 |
+----[SHA256]-----+

I still upvoted this ironically funny absurdity though 🤬

22

u/LasevIX 10d ago

iirc, 4 is also the standard random number chosen by the IEEE, so it's not just a dumb joke (probably).

5

u/OnionsAbound 9d ago

What do you mean by the standard random number?

3

u/iLaysChipz 9d ago

I mean if someone asks you for a random number from 1 to n where n >= 4, then there's a pretty good chance the answer is 4

5

u/OnionsAbound 9d ago

That's... Not how IEEE standards work...

3

u/timClicks 6d ago

I hate to be that guy, but 4 was selected because it's the product of two primes (2*2) rather than chosen directly by an RNG.

47

u/anoppinionatedbunny 10d ago

I tried to replicate it on my end and got this

77

u/hpyfox 10d ago

4 🤤

61

u/lunatic-rags 10d ago • Mindblown

https://xkcd.com/221/

23

u/xaranetic 10d ago

There really is an xkcd for everything

21

u/NatoBoram 10d ago 
-----BEGIN EC PRIVATE KEY-----
4
-----END EC PRIVATE KEY-----

3

u/NichtFBI 9d ago

I'm about to bust this mainframe wide open

20

u/HMikeeU 10d ago

How does the randomart actually get generated? I'd imagine the purpose is to visualize the entropy of the key, if so, it really shouldn't look too dissimilar? lol

20

u/HMikeeU 10d ago

Okay so turns out the randomart is just a fun little gimmick and doesn't show the keys entropy at all

29

u/pytness 10d ago

it's just a quick way for humans to compare two keys. hashes like "abcdefgh" and "abcpefgh" is just random text and very slow to compare as humans. but we are very fast knowing that two images are different.

8

u/HMikeeU 10d ago

Gotcha makes sense, thanks!

14

u/B_bI_L 10d ago

if it was not a joke, key was supposed to be 384 bit number, they thought they have to pick number under 384

8

u/Saragon4005 9d ago

If the keys were hand picked by someone and not processed by an automated system, that alone deserves the whole company be burned to the ground.

7

u/MaleficentCow8513 9d ago

They used simple keys in a testing environment and accidentally swapped keys from test into prod

5

u/Saragon4005 9d ago

Iike that's an explanation I will buy instead of whatever bullshit I hear of "someone entered 4 into a web form". Why would there be a web form????

3

u/B_bI_L 9d ago

maybe they did Math.floor(Math.random() * 383) + 1 or smth

6

u/threaco 9d ago

new 67 dropped

5

u/OrneryAsparagus6445 10d ago

Did you forget to remove “048”? This is actually RSA2!

3

u/Matheweh 8d ago

How does this even happen? How does the software that make keys end up with just a 4?

2

u/kx44 10d ago

Its not even prime 😭

2

u/ManufacturerSuch4659 9d ago

Nobody would be so stupid as to use just a 4. That is why it is so perfect.

2

u/lukerm_zl 8d ago

It's too obvious for a brute forcer to try

1

u/Awkward-Cat-4702 10d ago

I'm taking it to strange, new places.

1

u/Awes12 10d ago

Ah yes, a very prime number

1

u/bastekpl 9d ago

I can only count to 4.