Comprobador de claves débiles online

Why good algorithms end up with broken keys

RSA-2048 and P-256 are not broken. Individual keys are — because of the software or hardware that generated them. A random number generator with too little entropy, a "fast" prime generator with structure in it, a test key shipped in firmware: each produces keys that look normal and can be broken from the public key alone. Such weak keys have been found by the hundreds of thousands in certificates, SSH servers and smart cards. This tool runs the checks of badkeys, the open-source scanner by Hanno Böck, on any key you paste: a certificate, a CSR, a public key, an OpenSSH public key line, or an RSA modulus as openssl rsa -noout -modulus prints it.

Checks that run in your browser

Everything below needs only the public key and runs on your device; nothing is sent while you type.

• ROCA (CVE-2017-15361). Infineon's RSALib, used in smart cards, TPM chips, ID cards and security keys, built its primes from a small structured set. Nemec, Sýs, Švenda, Klinec and Matyáš showed in The Return of Coppersmith's Attack (ACM CCS 2017) that such moduli carry a fingerprint — a discrete logarithm test anyone can run — and can be factored.
• Primes too close together. If the two primes of an RSA key share their upper half, Fermat's 17th-century method factors the modulus in a few steps. Böck found such keys made by the Rambus SafeZone library in Canon and Fujifilm printers (CVE-2022-26320). The checker runs 100 Fermat rounds, as badkeys does.
• Malformed moduli. A modulus that is prime, divisible by a small prime, a perfect square, or not larger than its exponent is no RSA key at all, whether through a bug or a bit flip.
• A small private exponent. When a generator swaps the public and private exponents, Wiener's continued-fraction attack (1990) recovers the private key from the public one.
• Patterns and bias. Moduli made of blocks with long runs of zero bits (keys of this shape were generated by CompleteFTP) can be factored; a modulus whose bits are far from half ones points to a faulty generator. "Vanity" keys with a chosen pattern in their upper half are reported but are not a weakness by themselves.
• Size, exponent and curve. RSA below 2048 bits, unusual exponents, binary or explicit-parameter curves, and the post-quantum horizon, with the same assessment as the other PKI tools of this site.

A private key also works as input: only its public half is computed and checked, in the page. It is never sent anywhere, and it never goes into a share link.

The lookup that runs on the server

Two checks need data that is too large for a browser, so they run on our server — and only when you press "Check on the server":

• Known compromised keys. The Debian OpenSSL bug (CVE-2008-0166, DSA-1571) left the process ID as the only entropy of every key generated on Debian and Ubuntu between September 2006 and May 2008, so every possible key could be listed — 2.6 million of them across key types and sizes. badkeys adds private keys that were published: in RFCs and documentation, test suites, firmware images, software packages and source repositories. A key on these lists has a public private key; anyone can impersonate its owner.
• Shared primes. Devices that generate keys right after boot, before their random number generator has gathered entropy, produce moduli that share a prime with other devices' keys; one greatest-common-divisor computation then factors both (Mining Your Ps and Qs, USENIX Security 2012). badkeys publishes the products of the shared primes its scans found.

The request carries only public values: for each key, the badkeys hash — SHA-256 of one number of the public key (the RSA modulus, the x coordinate of an EC point, the raw Ed25519 key) — and, for RSA keys of the sizes the shared-prime data covers, the modulus itself. The page lists exactly what will be sent before you press the button. Nothing else travels: no certificate, no subject, no private key, which the server refuses before reading a request anyway. Requests are rate-limited like the public API and are not stored.

What a pass does and does not mean

No finding means the key has none of the known, detectable flaws above. It does not prove the generator was sound: a key from a weak random number generator that happens not to collide with any listed key passes every check. If a key fails, replace it — generate a new one with current software, on a machine with a healthy random source, for example with the CSR generator in your browser — and revoke certificates issued for the old key. For ECDSA, a different failure breaks keys: two signatures that reuse a nonce reveal the private key; the nonce reuse checker and the article on ECDSA nonce reuse cover that case.