I think it technically was not “brute forcing” (since it wasn’t found by searching the entire key space), but specifically someone tried generating CA cert private keys from numbers 0-255, and surprisingly found a few.
It’s just as arbitrary as any other number. You can pick at random, but starting with a dictionary attack of easy, non-random keys would probably be a better start.
I remember playing a game of dvd-deal or no deal, where you would pick random number from one to twenty and see if you won money. The people I was playing with were mad because I just started guessing 1, 2, 3, 4…
I told them statistically it was just as likely to be those numbers as anything else.
No it absolutely does, the method they used to generate private keys ended up having just 8 shannons of entropy which led to the discovery we are discussing
But, since nobody would expect an organization like that to have a one digit key, wouldn’t that make it extremely hard to guess?
Half kidding here.
Not if you’re brute forcing it.
I think it technically was not “brute forcing” (since it wasn’t found by searching the entire key space), but specifically someone tried generating CA cert private keys from numbers 0-255, and surprisingly found a few.
Ain’t no way I’m starting from 0 if the standard key is 256-bit
It’s just as arbitrary as any other number. You can pick at random, but starting with a dictionary attack of easy, non-random keys would probably be a better start.
I remember playing a game of dvd-deal or no deal, where you would pick random number from one to twenty and see if you won money. The people I was playing with were mad because I just started guessing 1, 2, 3, 4…
I told them statistically it was just as likely to be those numbers as anything else.
Well, someone did guess it so it’s not that hard. The entropy was really low.
‘Entropy’ doesnt apply here
No it absolutely does, the method they used to generate private keys ended up having just 8 shannons of entropy which led to the discovery we are discussing