byteknight

I may be too quick to pitchfork, but this seems FAR too implausible to be true:

This is so bad.

They're asking us to believe that a script flaw, on this specific day, for critical keys, silently generated a second, weaker key pair, and that the wrong pair was then used for the CSR because the labels looked similar. And "used by mistake because the labels were similar" means nobody checked the CSR's public key against the intended key before the root signed it. Worse, they had a direct signal months ago in Bug 1970728 their CRLs failed verification, and by their own account the fix was to re-sign with the flawed keys rather than ask why the "correct" keys didn’t match the certificates.

--

> We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)

Kait actually made SCAR too :)

Only use of Delphi I have ever seen personally.

No sooner than I replied to OP, your message mirrors my experience. I really am interested now how many people had their introduction from similar things.

I too got started because of RS. Writing scripts for SCAR to automate RS :)

This is literally how memory works.

You can't have hair gap and have it load something to a remote system.

Never thought about it from that perspective, but I think you're right. It is by design, not deceptive intent, just the infinite monkeys theorem where we've replaced randomness with pattern matching trained on massive datasets.

Isn't that specific to pictures?

Encryption is defined as "the process of converting information or data into a code, especially to prevent unauthorized access."

What you describe is the same thing just not cryptographic.

Are you doing roleplay?

Seems so easy! You only need the entire world even tangentially related to video to rely solely on your project for a task and you too can have all the developers you need to work on performance!

"Just ask AI" is a phrase you will hear around enterprises now. You less often hear "Google it". You hear "ChatGPT it".

Not sure how that fits. Do you produce good results every time, first try? Didn't think so.