HNHacker News
TopNewBestAskShowJobs

eqvinox

7,997 karma · joined June 18, 2019

https://github.com/eqvinox

https://chaos.social/@equinox

submissionscomments
eqvinox··on eMudhra intermediate CA compromise
Sure, but there are three major issues with your statement, all related to how you actually look at and count things.

First, not using DANE doesn't mean using MTA-STS. In particular, between the giant mail hosts, even if both sides publish MTA-STS information and validate MTA-STS elsewhere — I'm quite willing to bet they have a bunch of policy overrides for each other. In a way, MTA-STS is nothing other than standardizing those policy overrides so things don't break as much when they have to change something.

Second, in terms of installations, DANE absolutely wins, just because there are a few giant installations and a ton of small ones. Even if the quota on the small ones is bad, it'll still outweigh the giants by orders of magnitude. And it's technically far easier to roll out a new mechanism on a handful of giant, well-automated, well-monitored installations. They could all do DANE in a few weeks or months. They just don't want to operationally/politically. Conversely, updating millions of small shoestring installations to MTA-STS (or something else) is a herculean task.

(Related question: what about domains? That's yet another statistical perspective, considering a lot of domains point at Gmail & co.)

And lastly — I'm not sure your statement is in fact correct, because the medium-sized enterprise senders sending in bulk generally don't use the actual e-mail giant infrastructure (e.g. Outlook.com, Gmail.com), even if they're hosted at a corporate cousin (Azure, GCP). And that's probably enough volume to shift the outcome for "most Internet mail". For this, it'd be interesting to know what the various cloud-ish mail solutions (aaS & products) do, which I unfortunately don't.

eqvinox··on eMudhra intermediate CA compromise
Nope, it likely just would've made the problem completely unfixable.
eqvinox··on eMudhra intermediate CA compromise
That's an issue primarily with the hyperscalers, who're refusing DANE. Anything outside of Gmail, Outlook and the likes, you're much more likely to see DANE than MTA-STS.

(Most open source SMTP stacks don't integrate an HTTP client and are completely unable to do MTA-STS without hacks, patches or other fragile bolt-on bits.)

eqvinox··on eMudhra intermediate CA compromise
I'm not connecting at all on this discussion because I don't understand what entity/role in DNS/DANE is the equivalent to eMudrah that is to be distrusted and can't / has to deal with compromised key material. It could be either the registrar or the TLD operator. The former you can switch to another one. The latter just makes the entire TLD unusable no matter how you spin it and whether you use DANE or not. Is there some third role you're considering here?
eqvinox··on eMudhra intermediate CA compromise
> I've seen speculation that there was a language barrier, given that this is an Indian company.

The discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 really doesn't sound like that, but who knows what's getting lost in the "fog of war" we're currently getting on this all.

eqvinox··on eMudhra intermediate CA compromise
I don't think I understand what you're trying to argue here; if you can't find a usable registrar for your domain… you can't really use that domain anyway, can you? They can just break it. But… let's not get into yet another DNSSEC/DANE discussion.
eqvinox··on eMudhra intermediate CA compromise
I would {hope,expect,urge} the people who can easily convert those numbers into proper key form to just not do that, to leave the tiniest of barrier of entry for trolling scriptkiddies.

Browsers might've gotten their magic revocation updates, but a lot of other things haven't… (and yeah this is "security by hoping hard enough", but still better than nothing.)

https://emudhra.we-have-a-problem.com/ tests all certs. If you don't trust that for whatever reason, https://bgp.tools/ also shows a banner at the top if you're vulnerable.

eqvinox··on eMudhra intermediate CA compromise
Sure, but a client that doesn't do CT wouldn't care if they don't include a SCT promise. [ed.: this said "break the SCT promise", that doesn't quite make sense] Which you'd only notice if you see the certificate somewhere else afterwards…

It's all rather hypothetical and unlikely, but you could certainly try attacking something like downloads.openwrt.org¹ like that — especially if you can tell apart the TLS client in opkg from a normal browser.

(¹ luckily, OpenWRT and most other package repos don't actually rely on HTTPS for package integrity and authenticity. And OpenWRT would be the most susceptible due to the "exotic" TLS client stack, if any.)

eqvinox··on eMudhra intermediate CA compromise
None of the roots were compromised. (Some of) Their own sub-CAs for TLS certs, which are also cross-signed by Sectigo (since their own roots are rather recent), are affected.

How you have that root cert on your phone with a 3 year old CA set I have no idea, presumably something updated your CAs in the meantime? (Also, aren't you incredibly exposed to the general onslaught of vulnerabilities from the past 3 years?)

eqvinox··on eMudhra intermediate CA compromise
They used the "correct" key for signing the CRLs (which of course was then an invalid signature):

> The CRL's were signed with the original private keys (which were supposed to be the correct keys with appropriate entropy) but given that this resulted in incorrect signatures, they were resigned with flawed keys.

And THAT is where I'm drawing the line between "honest mistake" and "gross negligence". For that to not raise giant red flags is an unacceptable failure in process and work culture.

eqvinox··on eMudhra intermediate CA compromise
> Keys were generated in hardware and the hardware in use was Ultimaco HSMs.

The plot thickens.

Broken HSM? Misconfiguration? Confusion? Straight up lie?

> Excel attached. The Ultimaco devices were used to generate the ECC, RSA key pairs for the issuers. They were not used to generate any other key material. But it doesnt look like the device is at fault.

> We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)

…

eqvinox··on eMudhra intermediate CA compromise
Slightly funny about this: even Wayne (the person who reported it to Chrome & Mozilla) got confused [https://bugzilla.mozilla.org/show_bug.cgi?id=2083449]:

  2026-10-17 20:18 - Full CCADB check finds the cross-signs by Sectigo are also affected
(…the "cross-signs" use the same keypair of course.)
eqvinox··on eMudhra intermediate CA compromise
Humans are generally considered to have been around for only ca. 300'000 years.

Also, the interpersonal web of trust is IMHO quite clearly failing in the age of mass media, and not just recently.

eqvinox··on eMudhra intermediate CA compromise
In the most extreme case, you can just issue a certificate and not use it anywhere. If it leaks, it's still a security issue, because it's valid.

More realistically, especially with sub-CAs, they might only be used on e.g. corporate networks. TLS scanners may not be able to reach any of the hosts that uses such a cert. As the sibling post points out, clients checking for the cert in Certificate Transparency logs counters that (adding a requirement that the cert be publicly known, which TLS/X509 by itself very much does not have) — but of course this only helps if your client does CT…

eqvinox··on EMudhra Intermediate CA Compromise
Argh. Thanks for clearing that up.
eqvinox··on eMudhra intermediate CA compromise
I can't help but read your post as "OpenSSL didn't make a mess of EKUs so the CA/B had to fill that role instead" :/

(I really am salty about the EKUs. In a few years the EKU field will just be useless, due to operational annoyance driving devs to ignore it. Except in browsers of course.)

eqvinox··on eMudhra intermediate CA compromise
They chain up to emSign & Comodo:

https://groups.google.com/a/mozilla.org/group/dev-security-p...

eqvinox··on eMudhra intermediate CA compromise
Y'know… let's just check…

https://ctlogs.io/search?mode=fingerprint&q=42c4accd12c4f595...

https://ctlogs.dev/search?q=42C4ACCD12C4F59597925E1A08A7A901...

https://ctlogs.io/search?q=EBED6475C2C2D80FCB199F3FE8DD6E6B3...

https://ctlogs.dev/search?q=EBED6475C2C2D80FCB199F3FE8DD6E6B...

Nothing for "CN=EM DV TLS CA - G3B,O=eMudhra BV" (not sure which sha256 this uses, 2nd is the spki sha256)

I should be clear here my understanding is/was these are sub-CAs. Apparently they're (trying to be?) roots themselves? The point of logging a root cert in CT is somewhat moot… though tbh I would argue anything issued by a CA should be in CT logs, even cross-signing another CA that is becoming a root itself.

eqvinox··on EMudhra Intermediate CA Compromise
Wow, Thanks for digging up/working out that support list! Actually a glint of hope.

…but, yeah, the issue is on layer 9. Even just nailing sub-CAs to ccTLDs breaks the moment a marketing person registers a .lol domain.

Then again, the CA/B is essentially a layer 9 entity. I just refuse to believe this is an unsolvable problem (though it might need NCv2 with a whole bunch more shit to cover more human creativity in policymaking.)

eqvinox··on eMudhra intermediate CA compromise
There is a variety of projects and researchers scanning for weak keys; possibly that's how this was found (haven't seen anything on that). These certs existed for a year and a half; that's bad but could be worse still.

One of the issues with sub-CAs (well, X509 certs in general) is that they can be ghosts in that there's no way you'll ever get it as a response on a TLS connection, so automated scanners on that won't find it.

CT should cover this (i.e. expose the cert so you can check for weak keys), but I have no idea if/how CT works for sub-CAs. [ed.: see below, doesn't seem to be in CT]

[ed.: these are technically sub-CAs, but rather cross-signed for bootstrapping a new root CA. Thanks @agwa for pointing that out.]

eqvinox··on eMudhra intermediate CA compromise
Since I haven't seen this mentioned enough yet:

The private key for all 8 "compromised" CAs is a single byte: https://mastodon.catgirl.cloud/@49016/117474217042191790

One of the private keys is literally "4".

I'm putting "compromised" in quotes here, because I can't call it that without cringing and cursing.

[cf. also: https://news.ycombinator.com/item?id=50169109]

eqvinox··on EMudhra Intermediate CA Compromise
> But that's not something we can really save in the Web PKI's current state.

I agree with your assessment but it's not an excuse to give up without trying. I hope this is just because I'm not looking in the right places, but I don't see people trying.

What really makes me salty is that there was enough energy to mess with the rules around EKU, the primary effect of which is that non-browser software is now starting to just ignore the EKU bits. Even if it would've amounted to nothing, I'd really rather that effort had gone into NCs.

eqvinox··on eMudhra intermediate CA compromise
> aw, shucks, someone proved to be untrustworthy and they're in such a critical role in the ecosystem

You mean until the DNSsec key rollover completes and they're no longer in that role?

As opposed to what we have now, an indefinite period where crappy non-updated devices will still accept these certs and nothing can be done about it?

The Web PKI works great for browsers. Everything else, not so much.

(To be fair, the crappy devices¹ would probably fail to deal with the periodic DNSsec root key rollovers. But at least that's a fail-closed.)

¹ a label that includes older versions of systemd-resolved, for whatever that may mean

eqvinox··on eMudhra intermediate CA compromise
To my knowledge, name constraints are very rare in actual use, and a bunch of implementations don't even support them. Am I wrong?
eqvinox··on eMudhra intermediate CA compromise
> It's strictly worse than this.

Maybe if people implemented name constraints and the CA/B forced CAs to use them. But not as it is; unconstrained sub-CAs are a scourge on the Web PKI.

eqvinox··on eMudhra intermediate CA compromise
> uncommon on Windows for applications to use a third party certificate verification library

I bet you have at least one copy of OpenSSL on your Windows system, probably multiple. Using the Windows native APIs is work. OpenSSL just works everywhere.

(Also, "the platform" doesn't technically even provide the cert bundle, depending on exact distro & packages.)

eqvinox··on eMudhra intermediate CA compromise
They didn't lose the keys, a sub-CA did.

Which is to say, sub-CAs in itself are a giant loophole that needs plugging. Especially since AFAIK nobody is bothering with name constraints (RFC5280 section 4.2.1.10).

eqvinox··on They war-gamed dimming the Sun. It went worse than you think
It would help if you (and the GP) actually read the article

> These technologies promise to reverse global warming by reflecting away a portion of the sunlight reaching Earth, for example by spraying particles of sulphur dioxide or some other manufactured substance into the atmosphere.

The global maritime shipping industry has already been doing this, by accident, and their stopping (going to better fuel oil with less sulfur in it) has detectably raised global temperatures. [https://cpo.noaa.gov/the-unintended-consequences-of-reducing...]

eqvinox··on British Airways: Filming Crew W Meta Glasses Could Get Your Tickets Cancelled
> Trying to police the shape of the camera is silly.

Why?

eqvinox··on Something is falling apart at GNOME, and it's not subtle
Calling out fascism is a civic duty; the other parts are concerning though...
← PreviousPage 3 of 34Next →