The Mechanics of Compromising Low-Entropy RSA Keys
Austin Allshouse explores mathematical factorization attacks against low-entropy and defective RSA keys in embedded firmware and IoT devices.
Summary
The Fragility of Imperfect RSA Key Generation
While RSA encryption with sufficiently random primes is mathematically secure, flawed random number generators in embedded hardware yield low-entropy, factorable keys.
Mathematical Factorization Methodologies
Austin Allshouse reviews classical and modern cryptanalytic algorithms—including Pollard’s p-1, Fermat’s factorization, and the General Number Field Sieve (GNFS).
Scanning Global Internet Datasets for Weak Primes
By analyzing millions of public TLS certificates and SSH host keys, the author identifies thousands of shared factors and predictable prime distributions across live infrastructure.
Remediation and Secure Key Generation Practices
Allshouse provides guidelines for developers to audit hardware RNG sources and regenerate cryptographically sound RSA keypairs.
Related talks
Main Stage·18 min
David McGrew · Brandon Enright · Andrew Chi
Cisco researchers run Batch GCD factorization across 100M+ public X.509 certificates, recovering private RSA keys from low-entropy embedded devices.
Main Stage·41 min
Walter C. Daugherity
Walter C. Daugherity explores quantum computing 101: how to crack rsa at DEF CON 10, examining quantum-computing and practical defenses.
Main Track 1·37 min
Elie Bursztein
Recounts the computation and cryptanalytic engineering behind the SHAttered project that produced the first practical SHA-1 collision.