2087918 - TWCA: Subscriber certificate serial numbers have 63 bits of CSPRNG output instead of 64 bits

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Daniel C]

Attachment: twca-serials.csv

(Note that I think this is different to the trusted CA certs themselves in bug 2087236, as this is for subscriber certificates, and that bug describes a different serial number structure to this one. I don't mind if someone decides to merge this one into that one though).

I've analysed ~1600 certificates from 2025 CT logs, and a few more recent unexpired ones to confirm that it's still an issue, and the top bit of the final 8 byte section of the serial number that is declared (https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/Qr8G-6J5ENs/m/O31k7pbABAAJ) to include 64 bits of CSPRNG output from an HSM is always 0 (top byte is always 0x00 to 0x7F), which is mathematically improbable over such a sample.

https://cabforum.org/2016/03/31/ballot-164-certificate-serial-number-entropy/ is the ballot that passed in 2016 which added this requirement to the Baseline Requirements.

I've attached a set of serial numbers in CSV form with the top byte and top bit pulled out and they can be tied back to their certs by the SHA-256 fingerprint.

This was seen under:

• TWCA EVSSL Certification Authority
• TWCA Global EVSSL Certification Authority
• TWCA Secure SSL Certification Authority
• TWCA SSL Certification Authority

The total affected certificate population is likely much larger as I have only looked at a sample.

Comment 1

[TWCA]

TWCA is aware of this matter. Both incidents involve insufficient serial number entropy. For the community's convenience, we will consolidate the full report under Bug 2087236.