• HereIAm@lemmy.world
      2·
      1 hour ago

      Don’t need it cracked today if you can store all the encrypted data in the world existing now, waiting for the day cracking it becomes feasible. It might be a bit outdated, but boy would the AI companies still over that training set.

        • HereIAm@lemmy.world
          1·
          57 minutes ago

          I don’t know what the state of it is today, but one if the things that Snowden’s leaks showed was that NSA was/is hording massive amounts if yet unencrypted data. So it’s been going on for a while.

      • testaccount372920@piefed.zipEnglish
        9·
        10 hours ago

        I wouldn’t be surprised if the agencies set it up. Although tbf, they probably would’ve done something more sophisticated.

    • blibla@slrpnk.netOP
      58·
      23 hours ago

      hey now!

      4 is just as random as 29833638292F9373638292926262141414331252526283994040218 is

      • ChaoticNeutralCzech@feddit.orgEnglish
        1·
        7 hours ago

        I’m willing to sacrifice about 10 % of the range by re-rolling if the number generated has too low/high value or low entropy (for example if its GZ compression is shorter than original). The range should taper off too, for instance if 2¹²³+1 is the technically lowest number possible, it should still have a 99% chance for a re-roll, so there’s no “hard” lowest possible number. I don’t want to be in the “front line”.

        Of course, here the RNG was clearly compromised.

      • ramble81@lemmy.zip
        19·
        20 hours ago

        For one value, yes…. But for 8 different keys having stupidly low numbers? They either had a seriously faulty RNG, or more likely were hand creating the keys.

        • halcyoncmdr@piefed.socialEnglish
          10·
          15 hours ago

          And the only reason to make a key that short is if you were trying to give them to someone who shouldn’t have them, and needed to avoid any sort of digital trail, even copy and paste… so you would obviously just memorize them.

          Memorizing a bunch of 384 bit keys is basically impossible… But memorizing a couple dozen numbers? Child’s play.

          • Corn@lemmy.mlEnglish
            2·
            6 hours ago

            If that’s what they needed, just remember an equation that turns easily remembered numbers into a 384 bit key.

            • halcyoncmdr@piefed.socialEnglish
              9·
              14 hours ago

              Considering keys like this are usually copied and pasted anywhere they might need to be manually entered… There is zero reason to make them small enough to be human-readable, unless that’s your actual intended use.

                • halcyoncmdr@piefed.socialEnglish
                  5·
                  14 hours ago

                  Anyone in a position where they are responsible for generating a root key for a certificate authority, 100% knows how to generate a key in their sleep.

                  The only explanation is that it was made easy intentionally, not lazily.

  • rizzothesmall@sh.itjust.works
    47·
    23 hours ago

    “Now?” “Now,” said Deep Thought. They both licked their dry lips. “Though I don’t think,” added Deep Thought. “that you’re going to like it.” “Doesn’t matter!” said Phouchg. “We must know it! Now!” “Now?” inquired Deep Thought. “Yes! Now…” “All right,” said the computer, and settled into silence again. The two men fidgeted. The tension was unbearable. “You’re really not going to like it,” observed Deep Thought.

    • halcyoncmdr@piefed.socialEnglish
      18·
      15 hours ago

      Probably not, until now.

      A sequential brute force on a 384 bit key would take forever given how random they are. There’s no reason to even try it. Well, there wasn’t a reason to try it before.

      • refalo@programming.dev
        12·
        19 hours ago

        Thankfully modern browsers use Certificate Transparency, and there’s no indication that any compromised certs were actually used publicly.

        However, there are many devices that use TLS which are not browsers, and those devices could in theory be selectively targeted with an evil cert without alerting the public CT servers.