https://www.hezmatt.org/~mpalmer/blog/2023/06/12/private-key-redaction-redux.html

Brane Dump

The thoughts of Matt Palmer

  * BlogNav:
  * Archive of all posts

Private Key Redaction: Redux

Posted: Mon, 12 June 2023 | permalink | No comments

I have spoken before about why it is tricky to redact private keys.
Today's post is another real-world case study, with some rather
unfortunate real-world consequences.

Meet Sven Shen. He attempted to do a very good thing: he wrote a blog
post about using HashiCorp Vault to store certificates and their
private keys. In his post, he included some "test" data, a
certificate and a private key, which he redacted.

Unfortunately, Sven did not redact these very well. If you follow the
steps I discussed previously, it is relatively straightforward to
retrieve the entire, intact private key.

From Bad to OMFG

Even more unfortunately, Sven didn't generate a private key just for
use in his blog post. Instead, Sven grabbed a private key he
presumably had laying around from some previous work. That work
appears to have been configuring the SSL certificate for
hiltonhotels.jp.

If you reconstruct that partially-redacted private key, you end up
with a key that has a SHA256 fingerprint (in hex) of:

72bef096997ec59a671d540d75bd1926363b2097eb9fe10220b2654b1f665b54

Searching for certificates which use that key fingerprint, we find
one result: a certificate for hiltonhotels.jp (and a bunch of other,
related, domains, as subjectAltNames). As of the time of writing,
that certificate is not marked as revoked, and appears to be the same
certificate that is presented to visitors of that site.

Sven, mate, I admire your attempts to educate the Internet on better
key-management practices. Just use better key redaction practices
next time, and perhaps don't re-use production private keys for blog
posts?

---------------------------------------------------------------------

Post a comment

All comments are held for moderation; markdown formatting accepted.

This is a honeypot form. Do not use this form unless you want to get
your IP address blacklisted. Use the second form below for comments.
     Name:       [                         ] (required)
    E-mail:      [                         ] (required, not
                 published)
    Website:     [                         ] (optional)
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[Submit Comment]

     Name:       [                         ] (required)
    E-mail:      [                         ] (required, not
                 published)
    Website:     [                         ] (optional)
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[                                                            ]
[Submit Comment]

  
<< dev-dependencies and Rust's unused_crate_dependencies lint
 
Best Viewed with a brain Powered by Jekyll! Valid HTML 4.0!