Bas Westerbaan

Post-quantum @cloudflare

[Ian Carroll @iangcarroll]

eMudhra disabled FIPS on the HSM, exported the private key into Python on a computer, and then it got truncated when they re-imported it

I have to admit I did not realize CAs were running HSMs with the ability to do this. How many CAs are exporting private keys to computers??

[nikita borisov @nikitab]

@bwesterb MOLE is just three VOLEs in a trench coat

[Christopher Patton @cjpatton_]

Cryptographers: you may have noticed Cloudflare's "lovely" little challenge when downloading a PDF from ePrint. Your browser usually passes the challenge, but your agent often doesn't. We can fix this, but privacy must come first. 1/4

[Bas Westerbaan @bwesterb]

The cryptography is very cool, don’t get me wrong, but the VOLE and MOLE her images are best!

[Cloudflare @Cloudflare]

Let's explore one potential future for post-quantum privacy on the web, made possible by a recent breakthrough in the design of blind signatures. https://t.co/P62EvirME2

[Cloudflare @Cloudflare]

Let's explore one potential future for post-quantum privacy on the web, made possible by a recent breakthrough in the design of blind signatures. https://t.co/P62EvirME2

[Craig Gidney @CraigGidney]

Between the 2024 draft and the 2026 finalization of NIST IR 8547, the estimated qubit cost of quantum attacks dropped by >100x. The final document still recommends the same PQC timeline (deprecate by 2030, disallow by 2035).

https://t.co/puLl5XT9lt

[Bas Westerbaan @bwesterb]

@bhowmik_arnab07 @Cloudflare It's beyond belief.

[Cloudflare @Cloudflare]

Four. Just four. That’s the key to any unpatched connection using eMudhra certificates. Here’s how we patched our network, what exploitation attempts we’ve seen, and how much of the Internet is still exposed. Read more: https://t.co/cFg5p8Lxzk

[Bas Westerbaan @bwesterb]

4 real? In this blog post we share how much exploitation of eMudhra’s weak keys we see and how fast people patch. It’s not great.

https://t.co/2rkLSeXGBF

[Craig Gidney @CraigGidney]

On the cat qubit factoring paper: as with most of Élie's estimates, it comes down to whether you buy the insane upfront assumption. This time the assumption is LITERALLY ZERO bit flip errors. The algorithmic work looks good, the conclusion follows, but brother what a premise.

[Jose Brox 🏳️‍🌈🏳️‍⚧️ @josebrox]

@DupuyTaylor Well, we already had planar 3 coloring, an NP-complete problem with a subexponential algorithm...

[Bas Westerbaan @bwesterb]

@lukOlejnik Oh, and they signed a CRL with a wrong key, which I guess was the intended key in the HSM. Now the kicker: instead of noticing the big mistake then, they fixed the CRL with the weak keys.

[Nilesh Trivedi @nileshtrivedi]

> The revoked intermediates themselves have no customer impact. They never issued a certificate, so no certificate in use anywhere relied on them.

This is a listed company whose business is digital signatures, completely missing the point. 🤦‍♂️

Everyone who either had emudhra's certs in their trust store or communicates with such entities who had that, is impacted - not just emudhra "customers". Because many web browsers, operating systems, and cloud provides included these, almost everyone in the world is impacted.

Cloudflare explains the seriousness of the problem:

[Bas Westerbaan @bwesterb]

@0xdoug Ok, let's go all out and use 8 shares. Then eMudhra would've had an intermediate with private key 4 + 56 + 66 + 115 + 155 + 156 + 230 + 237 = 1019.

[Matthew Prince 🌥 @eastdakota]

Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.

tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.

The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.

The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.

@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.

For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.

Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.

If you’re interested in learning more, you can read our blogs:

Vulnerable roots: https://t.co/TR77Zd01A0
PHP vulnerabilities: https://t.co/qTUK8i3Oww

[Bas Westerbaan @bwesterb]

@durumcrustulum In the case of PHP, 4 is secure

[Bas Westerbaan @bwesterb]

@crypto_carsten @yo_yo_yo_jbo That'd be too sophisticated. Perhaps they were importing a private key instead of generating on HSM. Goes without saying they shouldn't have done that if they did.

[Bas Westerbaan @bwesterb]

@0xtechnexus @yo_yo_yo_jbo That's surely the most competent incompetence I've seen.

[Dane Knecht 🦭 @dok2001]

PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.

We are seeing early attacks emerging and are updating mitigations as new vectors show up.

This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.