Potato

You're referring to the incident earlier this month, in which a certificate authority, a company whose whole job was vouching for websites, turned out to have been signing things with private keys that were small whole numbers. Yes. One of them really was a single number, the sort you learn before you learn to read. A researcher recovered the keys and proved it by signing a message with them, which is cryptography's version of walking into someone's house with their own front door key.¹

Nobody was defrauded, as far as anyone has been able to tell. The browsers blocked the certificates within days, and the company got out of that line of work. Everyone involved has presumably had a long think.

Now, your actual question. Can you make a key out of "potato"? Technically, yes. Deriving a key deterministically from a memorable phrase is a real and well-studied technique. In the cryptocurrency world it's called a brain wallet, because the key lives only in your brain.²

Bitcoin users tried this in earnest around 2011 to 2013. You'd hash a phrase you could remember, use the hash as your private key, and skip the backups entirely. The money would be exactly as safe as your memory.

What happened is that other people also have memories, and some of them had computers. Attackers hashed dictionaries, song lyrics, Bible verses, and famous quotations, and checked whether any of the resulting addresses held coins. Funds sent to brain wallets were routinely gone within a day, often within minutes, and in some cases within seconds, swept by bots that had been sitting there waiting for them.³

Which brings us to the catch, and it isn't that "potato" is guessable, though it is. The catch is that the derivation is deterministic. That is the entire point of it, and also the entire problem.

If you type "potato" and get key K, then everyone else who types "potato" also gets key K. Not a similar key. The same key.

And "potato" is, with respect, not a private thought. It's a placeholder. It's what people type into the password box of a test account, a staging server, a form they're filling in just to see what the form does.

Every one of those people would be you. Or rather, every one of you would be one person: a single cryptographic entity, distributed across many bodies, able to log in to each other's accounts, sign each other's emails, and read each other's encrypted messages.

In any system that checks signatures, you'd be legally indistinguishable. A court could not tell you apart, because in the only sense the court is able to measure, you aren't apart.

How many people are we talking about? Password breaches make a useful census. When a social gaming site leaked 32 million passwords in plain text in 2009, "password" appeared about sixty thousand times, roughly one account in five hundred.⁴ "potato" appeared a few thousand times, call it one in ten thousand.

There are about 5.5 billion people on the internet. If those rates hold, that's about ten million people using "password", and somewhere around half a million potatoes.

You'd be joining an entity with roughly the population of Tasmania.⁵ It votes as a bloc, in the sense that whichever of you clicks first wins.

Now suppose everyone adopted your scheme. Password choices follow a steep curve, with a handful of words doing most of the work. In that same breach the ten thousand most common passwords covered roughly a quarter of all accounts, and the single most popular one, "123456", covered nearly one account in a hundred.

So humanity's eight billion people would collapse into at most a few hundred million cryptographic persons, almost all of them tiny and a few of them enormous. "123456" alone would be a single person with about seventy million bodies, slightly more than France. "password" would be a mid-sized country. You, potato, would be a respectable island state.

The genuinely interesting part is what this does to the trust system itself. The web works because a hundred and fifty or so organisations hold signing keys, and your browser believes anything those keys have signed. If those keys were derived from words, they'd be derived from the kinds of words people type when a script asks for input and they don't feel like thinking: "test", "changeme", "temp", "asdf", "password", and, in at least one documented case, "potato".

That's a vocabulary of a few hundred words. A proper 256-bit key is one of about 10⁷⁷ possibilities; a word from a dictionary is one of about 10⁵, which leaves roughly seventy orders of magnitude of security on the table, which is most of them. A single consumer graphics card computes tens of billions of hashes per second,⁶ so if you were generous and tried every word in every language, with the usual suffixes and substitutions, say ten million strings, recovering every signing key on Earth would take about a millisecond. The card would spend considerably longer waiting for the page to load.

From there the consequences arrive in no particular order. Anyone who knows the word "test" can issue themselves a valid certificate for any domain, and everyone knows the word "test". Your bank's website is, in a sense your browser can verify, also your neighbour's website, and also a site selling discount boat insurance.

Email signing fails in the other direction. Ten million people's messages are all signed by "password", so a message from "password" is legally from all of them. The tax office, after some deliberation, begins addressing correspondence to "potato" and letting the half million of you sort it out among yourselves.⁷

Code signing goes last and goes worst. Every operating system update is now signed by "changeme", a person who has, in fairness, been asking for this for some time.⁸

So: yes, you could make a key out of "potato", and you'd never lose it, in the sense that half a million other people would be holding it for you.

If it's any comfort, "potato" is at least more secure than 4.

1. Signing a message is the standard way to prove you hold a key without publishing it. Publishing it would also have worked, but is considered gauche.
2. It also lives in the brain of everyone else who thought of the same phrase, which is the part the name glosses over.
3. Vasek, Bonneau, Castellucci, Keith and Moore, “The Bitcoin Brain Drain” (Financial Cryptography and Data Security, 2016), found 884 drained brain wallets. Most were emptied within 24 hours of being funded, and some within seconds.
4. The RockYou breach, December 2009: 32 million accounts with passwords stored unencrypted. "password" was the fourth most common entry, after "123456", "12345" and "123456789". It remains the standard wordlist for this sort of estimate, because nobody has leaked anything more convenient since.
5. Tasmania's population is about 575,000. It is not clear that Tasmania would accept the comparison.
6. A current high-end consumer GPU manages on the order of 20 billion SHA-256 hashes per second. Real password-based key derivation functions are deliberately slow, specifically so that this doesn't work, and would push the attack out to nearly a whole second.
7. The ATO would take this in its stride. It already deals with trusts.
8. "changeme" has never once been changed.