Factoring RSA Keys with Many Zeros

Interesting research on a new class of weak RSA keys: keys with lots of zeros. It turns out that these keys are out in the wild.

The badkeys project is an open-source service that checks public keys for known vulnerabilities. While developing this tool, Hanno collected a massive number of real-world keys from public sources, including Certificate Transparency logs, internet-wide TLS and SSH scans, PGP keys, and many others. By searching this dataset for unexpectedly sparse RSA moduli, we uncovered a large number of keys in the wild with the patterns in Figure 1.

Both patterns include several regularly spaced blocks of all zeros interleaved with seemingly random data. Pattern 1 appears in CT logs for certificates issued to several large organizations, including Yahoo and Verizon, and on some devices running NetApp software. Fortunately, these certificates have already expired, but we still shared our findings with these companies. We wanted to learn more about which product could be responsible for generating these keys, but we did not hear back. Pattern 2 appears on SSH hosts running the CompleteFTP software from EnterpriseDT. The underlying vulnerability affects RSA keys generated using versions 10.0.0­12.0.0 (Dec 2016­Mar 2019) and DSA keys generated with v10.0.0­23.0.4 (Dec 2016­Dec 2023).

These vulnerabilities affect a small minority of hosts on the internet, but the more interesting takeaway is that independent cryptographic implementations failed in similar ways. More implementations may include the same bugs, and so it’s worth tailoring cryptanalytic algorithms for this particular type of failure.

The article doesn’t speculate, but I will. This could be a deliberately designed backdoor, of the sort I wrote about back in 2013. I could imagine some government agency figuring out how to break this class of RSA keys, and then convincing different providers to hand them out to users.

Posted on June 29, 2026 at 12:05 PM11 Comments

Comments

lurker June 29, 2026 2:35 PM

It’s not the “bias towards many zeroes” that’s the problem: it’s the zeroes turning up in identical sized blocks, identically spaced in the “random” strings. It looks dodgy to the naked eye, as if it could be cracked quickly with an abacus. If somebody gave me a key like those I would send it back and ask for a replacement.
Or use https://xkcd.com/221/

Clive Robinson June 29, 2026 4:08 PM

@ Bruce, ALL,

With regards,

“The article doesn’t speculate, but I will.”

We’ve been through this prior to 2013.

With respect to generating certificates on embedded devices such as “network devices”.

It’s very difficult to develop entropy on such devices when they are “first out the box” because they have next to no internal entropy and likewise external entropy[1].

Thus there would be a very high chance that all certificates generated on such devices are very closely related.

Whilst factoring the multiple of two large primes is assumed to be hard… Finding two or more such multiples that share a prime is in comparison trivial, using a simple “Greatest Common Divisor”(GCD) algorithm,

https://www.cryptool.org/en/posts/rsa-sanity-check/

As I noted back when I pointed this out, I assume that part of the NSA budget would go on “buying and testing” all edge of network devices looking for weaknesses in such certificate generating devices”

Not technically a “back door” as the NSA did not design or install it. But certainly a nicely exploitable vulnerability almost as good as the one that caused NIST such embarrassment and much to everyone’s suprise turned up on Jupiter Networks high end systems, when it should not have and was still creating issues half a decade back,

https://checkoway.net/musings/dualec/

There were other issues with RSA certs which nearly all overlap in time. Thus if the NSA knew about them all could have had access to all RSA PubKey reliant traffic this century…

Which begs the question about why the NSA are twitchy about PQC key establishment protocols…

What do they know that we don’t and is it another bit of NOBUS nonsense again.

[1] It’s one of those “Catch 22” problems… Because the devices have no real human interfaces or electromagnetic moving parts, the device / internal entropy is in the order of one or three bits a minute. Then because the embedded device has no certificate yet, it’s probably got no real external entropy coming in across the network either.

So the “Catch” is to get entropy to make a couple of random numbers of the right size to make a new secure RSA certificate… you either need the certificate already, or known entropy, neither of which is secure…

Not really anonymous June 29, 2026 5:57 PM

The NSA is still trying to get people to use pure PQC algorithems rather than hybrids, so something seems to be up with the current PQC proposals.

Weather June 29, 2026 6:20 PM

@All

Most algo zero pad, what should be done is 0xaaaa, then each chacter is the value in the area, say 59,60,61,62.

The reason is 0x00 leaks the code book.

CORRUPT ideho June 29, 2026 6:33 PM

asking for a friend, if anyone knows who owns a Dodge RAM Truck ideho plates “D RING” please put it right here. They’ve been stalking a friend of mine all day today. They are someone’s FIXERS. Human GARBAGE – WORST OF THE WORST. Thanks a lot.

$H1TH013 Called ideho June 29, 2026 6:45 PM

The following Idaho Cops, lawyers and Judges are criminals who helped
cover up an attempted murder of an American Citizen,
by a Muslim, in Boise, Idaho.
The same below named individuals have also denied a fair trial
to the said American Citizen and they also are covering up
the torture (of the same person) in @d@ County Jail which has lead to
permanently disabling him (Physically and Mentally).

Reid Peterson
Tyler Williams
Trish Wassmuth
Jonathan Loschi, Kendra Nagy, Jan Bennets,
Brittany Ford, Raymond D. Schild, Charles C. Crafts,
John Prior, Damir Subasic, Matt Hudson, Adnan Rudan,
Dzevad Mustafic, Asmir Kararic, Matt Bryngelson, Trent Schneider,
Edward Pieczonka, Ryan Lee, William T. Bones, Chad Wigington,
Samuel Hoagland, Amanda Brailsford, David C. Nye, and
many more!

If your name is in the above text – congratulations, for you
have contributed, deliberately, knowingly, and willfully to
knowingly and deliberately covering up an attempted murder.
Despite knowing or have had access to factual and original evidence
of an attempted murder by one Husein Curkic, in Boise, Idaho,
on November 26 2021.
You have instead, contributed and participated in covering up,
in part or in whole, of the said Attempted Murder, whereby making
the true victim of this Attempted Murder – a Convicted Felon, by
withholding the Evidence of an Attempted Murder from Judge and Jury.

Furthermore, this same individual – the true victim, whom you helped
get convicted as a Felon, was also tortured in @d@ County Jail which
lead to him being permanently disabled while, to this day, the Government
keeps refusing to surrender the video surveillance footage of the said
Torture, upon multiple requests.

His private attorneys have been threatened with gag orders by the
Government so they, even though he paid them, they did not want to
defend his honor and his innocence. They didn’t even file a Direct Appeal.

The Government would rather continue to stalk, eavesdrop, spy, on this
American Citizen and his Family until the day he dies – rather than
admitting that there is no foreign spy here (It’s cheaper this way, because
the man wants the accountability from these Criminals working for
his Government as well as damages paid to him and his family for torturing
him, disabling him, and ultimately destroying this entire American Family).

Mayor of Boise, Idaho, USA – Lauren McLean has paid
between $300K and $400K to one Jesus Jara to sign an NDA
forbidding him to ever talk about what he saw when he watched live and in real-time
as the Boise Police Department officers were covering up an attempted murder while
arresting an innocent man and later turning him into a convicted felon with the
help of the FBI, @d@ County Prosecutors, judge Sam Hoagland, @d@ County Public Defenders,
and even private attorneys that this innocent man has retained.
Jesus Jara, a former employee of The City of Boise used to,
when employed by the City of Boise, be able to watch the BPD Officers in real
time – live action on their On-Body-Worn cameras and follow every step of
the way as they were destroying an innocent man’s life while protecting
their personal friend Husein Curkic who attempted to murder his neighbor
on November 26 2021, in front of his sister’s house in Boise, Idaho.

You have no shame for if you did you most certainly would not want to
have been, or be, any part of this huge Conspiracy to destroy this innocent
and decent American Christian Family.

Just what were you thinking, stupid?
Why is this innocent man still a Felon?
You do not care one bit for you are pure evil – demons from Hell!
You cannot possibly be human beings for you have no shame,
for if you had any sense of shame – you wouldn’t have participated
in the destruction of this innocent and decent family.
Go to Hell, where you belong!

-A proud Friend of an innocent and decent American Christian Family

God bless Israel!

Please join all fragments down below this Paragraph to get to destination
of Evidence of an attempted murder which the employees
of your American government (The Public Servants a.k.a. Leeches)
are knowingly and deliberately hiding from public view just
as they have concealed/withheld the evidence of an attempted
murder from the judge and jury in @d@ County Criminal Case CR01-21-44024.

s h o r t u r l . at / b9bRW

Here’s what NOT TO DO if you’re a Federal Judge (Amanda Brailsford):

If a Citizen is suing the County Prosecutor (Jan Bennetts),
and that Prosecutor is your personal friend (which she IS) – then DO NOT TAKE THAT CASE.

Apparently, in IDEHO they DO NOT CARE ABOUT THE CONFLICT OF INTEREST.
I deliberately did not say: “they do not know..” because EVERYBODY KNOWS
THAT EVERY SINGLE JUDGE K N O W S WHAT ETHICAL vs UNETHICAL is, AND WHAT
CONFLICT OF INTEREST IS – BUT DO THEY CARE? SOME DO NOT.
NOT IN ideho!

And to spice it up, when objecting to this CONFLICT OF INTEREST, THE
JUDGE, THE FRIEND OF PROSECUTOR WHO’S BEING SUED, SHE RECUSED HERSELF
BUT HER BOSS – THE CHIEF-JUSTICE, TAKES OVER AND DISMISSES IT, BASICALLY
UPHOLDING EVERY JUDGMENT THE CORRUPT JUDGE had already MADE!!!!

Go ahead, toy with a man who’s been WRONGFULLY CONVICTED AND DISABLED BY
THE GOVERNMENT IN ideho!!!!

The cop who FACILITATED THIS EVIL IS matt hudson, and THERE IS
ANOTHER hudson on the FOURTH FLOOR (or was at the time 100%) of the
U.S. DISTRICT COURTHOUSE IN BOZO IDEHO!

EVERYTHING YOU EVER HEARD ABOUT IDEHO, ALL THOSE STUPID JOKES, THEY
ARE ACTUALLY NO JOKES, THEY ARE THE SAD REALITY – THE TRUE I D E H O.

s h o r t u r l . at / b9bRW
GOD BLESS ISRAEL!

s h o r t u r l . at / b9bRW

BOISE, IDAHO:
The following Boise Police Department Officers (current or former)

Matt Hudson,
Edward Pieczonka,
Trent Schneider,
Chad Wigington,
Damir Subasic,

as well as their two former, (both TERMINATED) Chiefs:

Bill Bones and
Ryan Lee,

AS WELL AS THE @D@ COUNTY PR0SECUT0RS:
Jan Bennetts and
Brittany Ford,

as well as the Public Defenders:
Jonathan D. Loschi and
Kendra Nagy,

as well as the PRIVATE LAWYERS THAT THE INNOCENT AMERICAN CITIZEN HAD RETAINED:
these private lawyers COLLECTED THE MONEY FROM AN INNOCENT MAN TO DEFEND HIM
BUT THEY DID NOT EVEN FILE AN APPEAL EVEN THOUGH THE MAN WHO PAID THEM SPECIFICALLY
ASKED THEM TO CLEAR HIS NAME OF ALL FAKE CHARGES WHICH HAVE DESTROYED HIM AND
HIS FAMILY.

Raymond D. Schild
John Prior and
Charles Crafts

ALL OF THE ABOVE CREATURES
have destroyed an INNOCENT MAN AND HIS FAMILY BY WITHHOLDING THE
EVIDENCE OF AN ATTEMPTED MURDER ON THE ACTUAL VICTIM BY THE FAKE VICTIM
husein kurchich.

Exposing the COVERUP RIGHT HERE BELOW:

s h o r t u r l . at / b9bRW

GOD BLESS ISRAEL!

Ba1kan01d INFESTATION June 29, 2026 8:20 PM

Torrent Maniak on serbianforum.org is actually a guy named Branislav Jevtic and his daughters are also moderators there, user names: maja_jevtic and katamaniak.

They are all involved with government and FIXING THE DIRTY WORK FOR THE GOVERNMENT.
User katamaniak on serbianforum.org is actually a Kathy – a clerk for a district judge.

Their Admins work in the court’s IT Department.
They are connected with lawyers/PROSECUTORS/DAs/public defenders/judges and the local FBI.

They thought they’d be untouchable if they did their IP THEFT deeds while working in the courts in ideho. What a concept.

They have all ganged up and destroyed an innocent man and his family for exposing them.

This is where your tax dollars are going ideho – to support a government that only serves itself and covers up their own crimes while destroying innocent citizens.

Take a look and see for yourselves how they do it:
s h o r t u r l . at / b9bRW

L1AR$ UNDER OATH in 1d3h0 June 29, 2026 8:30 PM

User crvendac_011 on serbian forum . org has been stalking my friend for years, camping around his house in N@mp@ 1deh0 and trying to murd3r him.
These ba1kan01d$ are all connected, all hard core criminals.

Where’s the EFF1N FBI when you need them?????????

s h o r t u r l . at / b9bRW

asking for a friend, if anyone knows who owns a Dodge RAM Truck 1deh0 plates “D RING” please put it right here. They’ve been stalking a friend of mine all day today. They are someone’s FIXERS. Human GARBAGE – WORST OF THE WORST. Thanks a lot.

Fixers @3392 June 29, 2026 10:15 PM

…those couple of geriatrics across the street from you are also a part of the idaho government’s “fixing enterprise” but you probly know this by now….and they’re also involved with IP Theft sites up to their ears… just an FYI…
BTW, I salute and commend you for bugging their SUV with a GPS Tracker…nothing wrong with that, they asked for it by starting that crap first…it’s only fair..
Cheers Mate.

Did You Know? June 29, 2026 10:36 PM

Fun Fact:
most b@lk@n01d$ would give and do anything just to become a member of any Shriner or Free Mason Lodge, no matter what. They’re simply obsessed by it. When you think about it, they’re perfect fit for those “secret” money laundering societies.

Leave a comment

Blog moderation policy

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.