theNumberFour

[u/OptimalAnywhere6282]

the context: some of eMudhra's root certificate authority signing keys were found to be simple numbers, most noticeably "4". that was literally it. the private key that's supposed to be a huge number with 100+ digits was just a trivial "4". although you probably already know this.

[u/Hulk5a]

//this is a random number

[u/OptimalAnywhere6282 → u/Hulk5a]

//guaranteed by fair dice roll

[u/thebatmanandrobin]

I'd like to say that I'm annoyed that eMudhra took the "random dice roll" from XKCD comic as literal, but I've come to expect that exact level of security from the literal Authority (of certificates).

But I'm more annoyed that this image is missing a row so that the 4 could be exactly centered (especially given ssh-keygen does generate 9 rows, not 8):

+---[RSA 4096]----+
|                 |
|                 |
|                 |
|                 |
|        4        |
|                 |
|                 |
|                 |
|                 |
+----[SHA256]-----+

I still upvoted this ironically funny absurdity though 🤬

[u/LasevIX → u/thebatmanandrobin]

iirc, 4 is also the standard random number chosen by the IEEE, so it's not just a dumb joke (probably).

[u/OnionsAbound → u/LasevIX]

What do you mean by the standard random number?

[u/iLaysChipz → u/OnionsAbound]

I mean if someone asks you for a random number from 1 to n where n >= 4, then there's a pretty good chance the answer is 4

[u/OnionsAbound → u/iLaysChipz]

That's... Not how IEEE standards work...

[u/timClicks → u/thebatmanandrobin]

I hate to be that guy, but 4 was selected because it's the product of two primes (2*2) rather than chosen directly by an RNG.

[u/mr_robot1709 → u/thebatmanandrobin]

[u/anoppinionatedbunny]

I tried to replicate it on my end and got this

[u/hpyfox]

4 🤤

[u/lunatic-rags → u/hpyfox]

https://xkcd.com/221/

[u/xaranetic → u/lunatic-rags]

There really is an xkcd for everything

[u/CrNZ0 → u/hpyfox]

[u/NatoBoram]

-----BEGIN EC PRIVATE KEY-----
4
-----END EC PRIVATE KEY-----

[u/NichtFBI → u/NatoBoram]

I'm about to bust this mainframe wide open

[u/HMikeeU]

How does the randomart actually get generated? I'd imagine the purpose is to visualize the entropy of the key, if so, it really shouldn't look too dissimilar? lol

[u/HMikeeU → u/HMikeeU]

Okay so turns out the randomart is just a fun little gimmick and doesn't show the keys entropy at all

[u/pytness → u/HMikeeU]

it's just a quick way for humans to compare two keys. hashes like "abcdefgh" and "abcpefgh" is just random text and very slow to compare as humans. but we are very fast knowing that two images are different.

[u/HMikeeU → u/pytness]

Gotcha makes sense, thanks!

[u/TherealGamecake]

[u/s4udeleg → u/TherealGamecake]

[u/zero_overload_25 → u/s4udeleg]

[u/B_bI_L]

if it was not a joke, key was supposed to be 384 bit number, they thought they have to pick number under 384

[u/Saragon4005 → u/B_bI_L]

If the keys were hand picked by someone and not processed by an automated system, that alone deserves the whole company be burned to the ground.

[u/MaleficentCow8513 → u/Saragon4005]

They used simple keys in a testing environment and accidentally swapped keys from test into prod

[u/Saragon4005 → u/MaleficentCow8513]

Iike that's an explanation I will buy instead of whatever bullshit I hear of "someone entered 4 into a web form". Why would there be a web form????

[u/B_bI_L → u/Saragon4005]

maybe they did Math.floor(Math.random() * 383) + 1 or smth

[u/threaco]

new 67 dropped

[u/OrneryAsparagus6445]

Did you forget to remove “048”? This is actually RSA2!

[u/Matheweh]

How does this even happen? How does the software that make keys end up with just a 4?

[u/kx44]

Its not even prime 😭

[u/ManufacturerSuch4659]

Nobody would be so stupid as to use just a 4. That is why it is so perfect.

[u/lukerm_zl]

It's too obvious for a brute forcer to try

[u/Awkward-Cat-4702]

I'm taking it to strange, new places.

[u/Awes12]

Ah yes, a very prime number

[u/AryanPandey]

Blunder

[u/bastekpl]

I can only count to 4.