Case screws, PHP2Shell, and eMudhra⁴

Last week I was organising a drawer full of wood and computer case screws, then sneezed, banged my knee hard against it reflexively, and sent a not insignificant number of the screws across the floor, which I then stepped on, jumped, slipped, fell on my arse, and banged my head against the table. It was, as my late grandad Jim would say, fun. It’s been a similarly fun few days for security. Dan Goodin at Ars Technica: The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237. It makes me worry how many other authorities have done this; 4 is a perfectly valid key. We’re going to…