<html><head></head><body><div class="ydpab22c9b7yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div></div>
<div>How many bits make something "secure"? 64 bits was deemed to be "enough" in 2016, but that was 3 years ago. When does the 64 bit requirement need to be increased?<br></div><div><br></div><div>It's hard to get excited about 63 vs 64 bits except as an embarrassment to big companies that should have done better.<br></div><div><br></div>
</div><div id="ydp4c96f8a6yahoo_quoted_3485979771" class="ydp4c96f8a6yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Monday, March 18, 2019, 12:33:29 PM PDT, Deirdre Saoirse Moen <deirdre@deirdre.net> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div dir="ltr"><a href="https://arstechnica.com/information-technology/2019/03/godaddy-apple-and-google-goof-results-in-1-million-misissued-certificates/" rel="nofollow" target="_blank">https://arstechnica.com/information-technology/2019/03/godaddy-apple-and-google-goof-results-in-1-million-misissued-certificates/</a><br></div><div dir="ltr"><br></div><div dir="ltr">"The snafu is the result of the companies' misconfiguration of the open source EJBCA software package that many browser-trusted authorities use to generate certificates that secure websites, encrypt email, and digitally sign code. By default, EJBCA generated certificates with 64-bit serial numbers, in keeping, it seemed, with an industry mandate that serial numbers contain 64 bits of output from a secure pseudo-random number generator. Upon further scrutiny, engineers discovered that one of the 64 bits must be a fixed value to ensure the serial number is a positive integer. As a result, the EJBCA default produced a serial number with 63 bits of entropy.”<br></div><div dir="ltr"><br></div><div dir="ltr">Deirdre’s note: unsigned ints are a thing y’all.<br></div><div dir="ltr"><br></div><div dir="ltr">Deirdre<br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">_______________________________________________<br></div><div dir="ltr">conspire mailing list<br></div><div dir="ltr"><a href="mailto:conspire@linuxmafia.com" rel="nofollow" target="_blank">conspire@linuxmafia.com</a><br></div><div dir="ltr"><a href="http://linuxmafia.com/mailman/listinfo/conspire" rel="nofollow" target="_blank">http://linuxmafia.com/mailman/listinfo/conspire</a><br></div></div>
</div>
</div></body></html>