The Private Key Mistake! (TLS Key set to "4") - Computerphile

Summary

The video examines a certificate-authority security failure in which some private keys were set to very small numbers—including 4—instead of being generated securely at random. A typical elliptic-curve key discussed in the demonstration uses the P-384 curve. Its private value should be large and unpredictable, roughly 120 decimal digits. A tiny value makes the key easy to guess.

How TLS certificates establish trust

When a browser connects to a website over TLS, it checks a certificate chain:

1. The website’s certificate identifies the site and contains its public key.
2. An issuing authority signs that certificate.
3. The issuer’s certificate is vouched for by another authority, continuing up the chain.
4. The chain ends at a root certificate that the browser or operating system already trusts.

A signature is made using a private key and checked using the corresponding public key. If an attacker obtains an authority’s private key, they can create certificates that appear to be legitimately signed by that authority.

Demonstration and analysis

The presenter uses OpenSSL and a Python script to examine a certificate, extract its public key, and test candidate private keys. OpenSSL normally generates private keys randomly and does not provide a straightforward option for specifying an arbitrary private value. The demonstration works around this by editing a PEM key file, removing its public-key portion so OpenSSL reconstructs it, and then trying successive small private-key values.

For each candidate, the script derives a public key and compares it with the public key from the certificate. In the selected example, it finds 115, matching one of the weak values cited in the video. Other reported values mentioned in the subtitles include 4, 56, 151, 66, 155, 156, 230, and 237.

The attack succeeds because the search space is tiny—not because properly generated P-384 keys are practically brute-forceable. The presenter says an up-to-date computer would reject a forged certificate because the relevant certificate chain had been fixed or was no longer trusted. An older, unupdated system might still accept it.

Guide or tutorial shown

The demonstration covers how to:

• Inspect a certificate’s readable contents with OpenSSL.
• Extract its public key.
• Generate and inspect a P-384 key pair.
• Modify a PEM file to test chosen private-key values.
• Automate candidate testing by deriving public keys and comparing them with the certificate’s public key.

Main speakers and sources

• Dr. Tim Muller explains the certificate system and demonstrates the key-recovery process.
• The Computerphile interviewer/host asks questions during the explanation and demonstration; the subtitles do not clearly identify them.
• Sources discussed include certificate files available online, OpenSSL, and a press release describing the weak-key incident.