The Internet goes on high alert after discovery of 8 compromised TLS certs

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet. As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates.

周二，全球安全人员处于高度戒备状态，此前人们发现了八个 TLS 证书，其私钥极其脆弱，可能允许任何人伪造互联网上任何站点的受信任浏览器和应用程序凭据。截至周二上午晚些时候，浏览器制造商以及一些主要的应用程序和编程语言已经封锁了所有八个中间证书。

There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet of Things devices.

目前尚无证书透明度日志（用于跟踪所有浏览器受信任证书的签发情况）显示这些被泄露的密钥被恶意使用的报告。然而，威胁远未结束，因为更新互联网的其他关键部分（如 Linux 发行版、嵌入式设备和物联网设备）将既困难又耗时。

The eight intermediate certificates belong to India-based certificate authority eMudhra Limited. An informal advisory published to emudhra.we-have-a-problem.com over on Tuesday posted the message “We have a problem here – Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates.

这八个中间证书属于总部位于印度的证书颁发机构 eMudhra Limited。周二发布在 emudhra.we-have-a-problem.com 上的非正式公告中写道：“我们这里出了点问题——韦恩。”这段文字使用了其中一个 eMudhra 证书的私钥进行了数字签名。

“This will be a massive cleanup job, bigger than Heartbleed,” Filippo Valsorda, a cryptography engineer and a cryptography maintainer for the open source Go programming language, told Ars. “There will be a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python).”

“这将是一项巨大的清理工作，比‘心脏出血’（Heartbleed）漏洞还要严重，”开源 Go 编程语言的密码学工程师兼维护者 Filippo Valsorda 对 Ars 表示。“后续影响将非常漫长，涉及物联网设备、Docker 容器、被遗忘的 Linux 机器，以及那些自带根证书副本且无人维护的命令行工具（这在 Python 等某些生态系统中很常见）。”

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits.

这些被泄露的 eMudhra 密钥的缺陷程度超出了许多研究该事件的工程师的想象。NIST P-384 椭圆曲线加密私钥的正常大小包含大约 384 位的熵，允许产生近 2^384（即一个 116 位的数字）种不同的可能性。而这些被泄露密钥的私钥大小仅为 3 到 8 位。

At this early stage, the most immediate threat appears to be for those using VPNs, especially in countries with governments likely to maliciously intercept traffic. There are likely many other cases for concern. End users largely have no recourse other than to hold off using many non-browser forms of TLS communication until they receive assurances updates are in place.

在现阶段，最直接的威胁似乎针对那些使用 VPN 的用户，特别是在政府可能恶意拦截流量的国家。可能还有许多其他令人担忧的情况。对于终端用户而言，除了在收到更新已到位的保证之前暂停使用许多非浏览器形式的 TLS 通信外，基本上别无他法。

One caveat: exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers.

需要注意的一点是：利用被泄露的证书需要进行主动的中间人攻击，这意味着攻击者必须充当两个 TLS 通信方之间的代理，接收加密流量，对其进行解密、重新加密，然后发送给另一方。在某些情况下，这种能力通常仅限于资源最充足的攻击者。