Uhm, yeah more than half wrong…
An indian certificate authority had produced a set of faulty certificates with private keys between three and eight bits long, when the standard is 384 bits. There is no malicious reason to do this, it was likely incompetence. The effect is that these certificates are trivially easy to reverse-engineer, meaning a bad actor could use them to sign certificates for any web domain, defeating the protection TLS provides against man-in-the-middle attacks. The certificates have already been marked as un-trustworthy on all major web browsers and operating systems, the risk lies with devices that do not get regular updates.
Edit: additionally, we know exactly when these faulty certificates were made and thus we also know for how long they have been exploitable
No malicious reason to do this he says, while Modi’s coalition or at least the money behind it was known for having backdoor access to all their enemies somehow
Uhm, yeah more than half wrong… An indian certificate authority had produced a set of faulty certificates with private keys between three and eight bits long, when the standard is 384 bits. There is no malicious reason to do this, it was likely incompetence. The effect is that these certificates are trivially easy to reverse-engineer, meaning a bad actor could use them to sign certificates for any web domain, defeating the protection TLS provides against man-in-the-middle attacks. The certificates have already been marked as un-trustworthy on all major web browsers and operating systems, the risk lies with devices that do not get regular updates.
Edit: additionally, we know exactly when these faulty certificates were made and thus we also know for how long they have been exploitable
No malicious reason to do this he says, while Modi’s coalition or at least the money behind it was known for having backdoor access to all their enemies somehow
You don’t need shitty private keys to do that, if you control the key gen you can just copy the not-shitty private keys