Can someone please explain to me what 4 has to do with the PHP security thingymajiger lol

Imagine a big stamp. Anything stamped with it, the internet in general trusts. Because we all trust that nobody knows how to stamp things like that big stamp. Except instead of a literal stamp, it's a secret combination of numbers and letters that works like a password. It now turns out that this secret combination of numbers and letters was just the number 4.

It's a different thingymajigger.

One of the orgs that does TLS infrastructure was found to have used 4, a number from Sesame Street, as a private key on a TLS cert that was used to sign other certs.

Just to add. Those private keys are a 85 to 170 digits random number.

A very central company whose security the entire internet depends on picked 00000000000....0000004.

My favourite analogy on this is that they had a master key with 398 slots for bumps, and they decided to only use one notch/bump for the whole thing.

You can’t open that with most regular keys, but if you try the most basic of picking you’ll find it pretty quick.

sigh This isn't going away anytime soon, is it? :)

I mean, I assume it had the correct number of bits in it, it's just that all but the 3rd least significant bit were all 0s.

I can’t tell if it’s like, completely awful or kind of awesome. I mean, no one brute-forces private key space one bit at a time, do they?

Hey America’s nuclear launch code was eight zeros (“00000000”) at some point in the 1960s; technically we’ve survived worse

It's gonna be around 4 the 4seeable future.

Almost assuredly someone is brute forcing all single-byte keys. In fact the private key equal to 4 is a single-bit, or "one hot" key, so an attacker could have found it by brute-forcing 384 different keys 😂

I originally thought nobody would try brute forcing simple keys like this, but then the person who found the vulnerability did it so I bet other people have done it. It's less "gee hope this works" and more "If someone screwed up there key generation this might work," and screwing up key generation is a known problem. Rare, but it does happen as this case demonstrates.

And here I am, thinking about bits of entropy for my toy project's API key.