badkeys author says he already scans CCADB certs for weak keys
Original title: Re: eMudhra Intermediates Compromise
Hanno Böck has not yet added checks for small ECDSA keys and plans a later write-up.
Hanno Böck replied on the oss-security thread about the eMudhra intermediates compromise. He says his badkeys project already scans all CCADB certificates for known weaknesses, but finding every known weakness is hard without knowing what to look for. He was advised to look for small ECDSA keys and had not implemented that check.
Unconfirmed: The post does not describe what was found in the eMudhra intermediates or in the CCADB scan.
- Böck says the scan covers all CCADB certificates.
- A suggested small-ECDSA-key check is not implemented yet.
- He plans to post a fuller account when he has time.
From the original article
Posted by Hanno Böck on Oct 21 Hi, I am definitely already doing that. That's what my badkeys project is all about. I do automatically scan all CCADB certs for known weaknesses.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.