You're viewing the front-end.social public feed.

Federated feed Local feed

ira grachevskaya from the hit vn Z.A.T.O. // I Love the World and Everything In It49016@catgirl.cloud
Oct 20, 2026, 6:22 PM
also, this entire ordeal could have been prevented by SIMPLY NOT TESTING IN PROD, and this testing in prod was APPROVED BY EVERYONE INVOLVED
there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)
(emphasis mine; source)
eMudhra should, under no circumstances, ever be trusted again
💬 1🔄 8⭐ 18

Replies

ira grachevskaya from the hit vn Z.A.T.O. // I Love the World and Everything In It49016@catgirl.cloud
Oct 20, 2026, 6:35 PM
from some rudimentary attempts to verify their story with a soft hsm, it seems to all check out. a plausible story does not mean that there was no malice behind it, but if they fucked around with wrapping, they may genuinely have done this as a honest mistake with many, many preventable steps
💬 1🔄 0⭐ 13
ira grachevskaya from the hit vn Z.A.T.O. // I Love the World and Everything In It49016@catgirl.cloud
Oct 20, 2026, 6:37 PM
it is actually plausible that this was an honest mistake aber den salat haben wir jetzt trotzdem
💬 1🔄 3⭐ 15
ira grachevskaya from the hit vn Z.A.T.O. // I Love the World and Everything In It49016@catgirl.cloud
Oct 20, 2026, 6:44 PM
the only thing really giving it the creeps is this sentence:
d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root
by looking at the notBefore fields, we can see that they are not created in batch:
```
15:35:09    DV TLS G3C
15:37:41    OV TLS G3C
15:39:31    EV TLS G3C
15:54:08    DV TLS G3B
16:00:12    OV TLS G3B
16:03:31    EV TLS G3B
16:08:27    OV CS  G3B
16:38:40    OV CS  G3C
```
so, was this mistake made in a script somewhere, or did a human make this mistake 8 times?
it seems more plausible for this mistake to happen once in its opinion, and not 8 times
💬 1🔄 7⭐ 12
Colin Watsoncjwatson@mastodon.ie
Oct 21, 2026, 3:05 AM
@49016 That feels like what one would see if the mistake was encoded in the plan for a signing ceremony and then everyone involved faithfully followed the plan without engaging brain properly
💬 0🔄 0⭐ 0