[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <fba3f0859b33de054413dbf01be985716a4609f1.camel@sec.16bits.net>
Date: Mon, 08 Apr 2024 03:18:21 +0200
From: Ángel <oss-security@....16bits.net>
To: oss-security@...ts.openwall.com
Subject: Re: Re: finding similar compromises (was Re: From xz
to ibus: more questionable tarballs)
On 2024-04-02 at 17:41 +0000, Tavis Ormandy wrote:
> FYI, of the 22,885,940 signature packets in my SKS dump, 1186 had the
> same options as Jia's (algo, keylen, expiry, prefs).
>
(...)
> There was a cluster from Warwick students, I'm thinking they use the
> same distribution as Jia? e.g, these all look similar:
>
(...)
> Anyway, I feel like my eyeballs did their part :)
>
> Tavis.
Hi Tavis
The Hash algorithm (SHA512), key flags, list of preferred symmetric
algorithms (AES256, AES192, AES128, 3DES), list of preferred hash
algorithms (SHA512, SHA384, SHA256, SHA224, SHA1) and list of preferred
compression (ZLIB, BZip2, ZIP) are all the default for gpg. It all
looks like gpg-created.
Only the 4096 bits of RSA and the 5y expiry are non-default.
If Jia wanted to create a 5y expiry key, he would have needed to use
--full-generate-key, which would then have requested the key size, and
4096 would have been a pretty normal answer.
Also relevant, the key seems to have been created with those options
(signature creation time matches the public key creation time), not
adjusted later.
The key creation time 2022-12-28 15:23:29 UTC, under Asia/Shanghai
timezone would be 2022-12-28 23:23:29 CST.
for... whatever the datetime may tell us
https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
