DigiCert: Insufficient entropy in serial numbers

This case reports that DigiCert’s v1 validation system used random numbers with insufficient entropy for WHOIS-based email validations. DigiCert stated that instead of the required 112 bits of entropy, the system used only 77 bits, due to a developer confusion during implementation of the “blessed 10” methods. DigiCert said the issue was reported to them on Nov 1, 2017 by CTJ, and that they began investigating on Nov 2 and confirmed insufficient entropy on Nov 2. DigiCert patched the system on Nov 3 to increase entropy and then investigated other systems, concluding that other random value uses had sufficient entropy and that the problem was limited to the v1 validation system. DigiCert also described root cause analysis as identifying a single developer misunderstanding the entropy requirement and said they provided training to the team. Mozilla asked DigiCert for proof and for implementing randomness tests for serial number generation code; DigiCert responded that it would add a test, though it expected deployment after Dec 1. The bug is marked RESOLVED with resolution FIXED.

1. 2017-11-01 CTJ reported to DigiCert that the random value used for WHOIS-based email validation appeared to have insufficient randomness.
2. 2017-11-03 DigiCert patched the v1 validation system to increase entropy and began investigating other random value uses.
3. 2017-11-10 DigiCert completed root cause investigation and concluded the issue was due to a developer misunderstanding the entropy requirement.
4. 2017-12-01 DigiCert planned to use the new validation engine for Symantec certs and partners ordering through DigiCert.

1. 2017-11-16 DigiCert — Jeremy Rowley reported that DigiCert’s v1 WHOIS-based email validation random values had only 77 bits of entropy instead of 112, and described investigation and a Nov 3 patch to fix it.
2. 2017-11-16 DigiCert — Jeremy provided a structured timeline and stated that all random values now use at least 112 bits of entropy, with root cause attributed to a developer confusion and training provided.
3. 2017-11-16 Mozilla representative — Gerv asked whether DigiCert could provide code or pseudocode proving at least 77 bits of entropy were used and suggested randomness testing instead of revoking/replacing all certificates.
4. 2017-11-16 DigiCert — Jeremy provided pseudocode and calculations showing the entropy based on the character set and input length.
5. 2017-11-16 Mozilla representative — Gerv requested that DigiCert implement randomness tests for serial number generation code not already deprecated and referenced https://en.wikipedia.org/wiki/Randomness_tests.
6. 2017-11-17 DigiCert — Jeremy agreed to add a randomness test, noting it would likely deploy after Dec 1.