Competence is difficult to check systematically. The problem is in the auditing process. The CA auditors check a much shorter list than an application that needs FIPS compliance. They just check that the CA is using a FIPS compliant key generator, and then basic things like following a logged, standard, multi person process.
Anybody writing a system for a bank or the govt needs to have every line of code checked that it’s not doing something stupid with its crypto keys. That level of assurance would have caught this. But the process was defined too weakly.
Competence is difficult to check systematically. The problem is in the auditing process. The CA auditors check a much shorter list than an application that needs FIPS compliance. They just check that the CA is using a FIPS compliant key generator, and then basic things like following a logged, standard, multi person process.
Anybody writing a system for a bank or the govt needs to have every line of code checked that it’s not doing something stupid with its crypto keys. That level of assurance would have caught this. But the process was defined too weakly.
> They just check that the CA is using a FIPS compliant key generator, and then basic things like following a logged, standard, multi person process.
FIPS-compliant key generator allowed key to be 4 ?
No, they just didn't check thoroughly enough
Oh for sure. And at the time these were done, I'd guess cracking them was a lot more work. But still. 4.
This key 4 was from a new ceremony, they must have hit the highest security key just recently and wrapped around.