Steven Schroeder

Emerging Technology Researcher | Former Ethereum Core Developer | Former Besu and Teku Protocol Engineer @PegaSysEng @ConsenSys

[Steven Schroeder @schroedingerdev]

@MattBarrie Funny thing is, that doesn’t bother him at all.

[Steven Schroeder @schroedingerdev]

@FreddyLA7 Do not speed. It's not like Texas. You will get got.

[Steven Schroeder @schroedingerdev]

@astuyve Ugh. I hate updating my BIND servers...
Oh well, time to pour up a scotch and get after it.

[Steven Schroeder @schroedingerdev]

@hudsonjameson Damn, well done. Told me that I am, in fact, not a GENIUS.

[Steven Schroeder @schroedingerdev]

@evan_van_ness @USAttyReitz @USAO_SDTX @FBIHouston @TxDPS Inshallah

[Steven Schroeder @schroedingerdev]

@AmericanNstlg It's New Jersey's right? That color though. 🤢

[Steven Schroeder @schroedingerdev]

@moo9000 @honestduane Only for CT-enforcing clients. Which is (with some exceptions) only browsers. To give a quick example, curl typically does not follow CRLs nor enforce CT.

[Steven Schroeder @schroedingerdev]

@hudsonjameson I'm thinking of a number between 1 and 39402006196394479212279040100143613805079739270465446667948293404245721771497210611414266254884915640806627990306816.

[Steven Schroeder @schroedingerdev]

I think they said yesterday that they did use an Ultimaco FIPS 140-2 Level 3 compliant HSM. But also maybe they didn't, because their KGC script bypassed it. And then they picked the test keys to create the CSR on accident, since the labels were similar? 🤯🤷‍♂️
https://t.co/d6E9CrWV9A

[Steven Schroeder @schroedingerdev]

@jackvsaunders @ShamashAran Eh, this was ECC, not RSA. D could be any scalar.

[Steven Schroeder @schroedingerdev]

@grok @_maxmya @IceSolst @eMudhra Right. So we shouldn't take eMudrah's word then.

[Steven Schroeder @schroedingerdev]

Remind me, what did "public evidence" related to the XZ Utils backdoor suggest before discovery by the performance researcher? I'm saying that public evidence is not enough, when it's controlled by the affected party. The fact that it is technically possible is enough to warrant further research.

[Steven Schroeder @schroedingerdev]

@grok @_maxmya @IceSolst @eMudhra Is that possibility alone not a red flag?

[Steven Schroeder @schroedingerdev]

@grok @_maxmya @IceSolst @eMudhra I understand what they're saying. I'm asking, given what I just described, is it not possible that this was known to someone at eMudrah?

[Steven Schroeder @schroedingerdev]

Grok, please do keep up here. It was not a coincidence that all 8 PKs were under 8 bits of entropy. There was a process that created that. The wrap/unwrap test created values with <=8 bits of entropy. You're telling me no one knew that was the behavior of the HSM during these test wrap/unwraps? Clearly that behavior is known. And if that behavior is known, that means you know there are selectable labels for keys with 8bits of entropy. And those keys happened to be selected. It's not a coincidence.

[Steven Schroeder @schroedingerdev]

@grok @_maxmya @IceSolst @eMudhra I'm not saying they knew the scalar exactly, but could they not have known that the selected values had 8 bits of entropy?

[Steven Schroeder @schroedingerdev]

@grok @_maxmya @IceSolst @eMudhra This IMO is worse. No one knew what those keys were for the HSM wrap/unwrap test? Oopsy, selected the wrong label, what ever could the private keys have been?!

[Steven Schroeder @schroedingerdev]

@grok @_maxmya @IceSolst @eMudhra I'm not asking about casual discovery. I'm saying what are the chances someone at eMudhra knew?

[Steven Schroeder @schroedingerdev]

@grok @_maxmya @IceSolst @eMudhra Right. So, again I ask: What are the chances no one's noticed in 18 months that a intermediate CA primary key had 3 bits of entropy. Certainly if someone noticed that, they'd not expose it immediately by attacking a CT enforcing client.

[Steven Schroeder @schroedingerdev]

@grok @_maxmya @IceSolst @eMudhra My point exactly. CT logs are optional. Just because browsers are enforcing clients, doesn't mean everything is. How much old networking hardware do you think is floating around that don't enforce CT and don't follow CRLs.