Monthly Archives: January 2015

Weak ssh public keys in github

A presentation slide, named “Attacking against 5 millions SSH public keys – 偶然にも500万個のSSH公開鍵を手に入れた俺たちは” is published, it is a lightning talk in “Edomae security seminar” in Jan 24, 2015.

 He grabbed ssh public keys with  GitHub API (https://github.com/${user}.key), the API is obsoleted, but not closed.

He found short (<= 512 bit) DSA/RSA keys and can solve prime decomposition 256bit RSA key in 3 seconds.

And he repoted there are 208 weak ssh keys generated by Debian/Ubuntu (CVE-2008-0166). It was already announced  by GitHub.

On the other hand, such ssh keys couldn’t solve prime decomposition with fastgcd. It means almost ssh keys in GitHub has no bias in almost random number generators implementations, it is a good news.

Use Module::Build::Tiny as Debian policy compliant

I tried to make Google::API::Client deb package, it requires Module::Build::Tiny, and dh-make-perl don’t suppot it, so I worte a override code in debian/rules.

[sourcecode]
override_dh_auto_install:
./Build install –destdir=$$(pwd)/debian/$pkgname –installdirs=vendor
[/sourcecode]

More elegant answer should be to add Module::Build::Lite support to dh-make-perl.

Update:

This probrem is only wheezy, I don’t need such workaround on sid. Thank you greoga.

New year 2015

In Japan, winter holiday is a special for many people, they go back to their hometown, and take a time with family.

Of cause, I do too. Last weekend I went back to Nagoya and now I still in there. Tomorrow I’ll go to Tokyo and work after this weekend.

Many asian countries have same practice, but almost celebrate the lunar(Asian) New Year. Some countrysides in Japan people also celebrate the luna New Year, but not major in Japan.

I can take a good holiday, and I hope this year is good for everyone.