Sparse RSA Moduli Found in the Wild: Yahoo, Verizon, and CompleteFTP at Risk

Over 10,000 RSA public keys out in the wild contain long, regularly spaced blocks of zeros—making them trivially factorable. Hanno Böck and the Badkeys project found them by sifting through millions of keys scraped from Certificate Transparency logs, TLS and SSH scans, PGP key servers, and more.

Pattern 1 is a sparse modulus with several zero blocks interleaved with random-looking data. It appeared in CT logs for certificates issued to Yahoo and Verizon, plus devices running NetApp software. Those certificates have already expired, so no immediate operational risk—but the question is why they were generated that way in the first place.

Pattern 2 Infects SSH Hosts for Years

Pattern 2 shows up on SSH hosts running EnterpriseDT’s CompleteFTP software. RSA keys generated by versions 10.0.0 through 12.0.0 (December 2016 to March 2019) are vulnerable; DSA keys generated by versions 10.0.0 through 23.0.4 (December 2016 to December 2023) are also affected. That’s a seven-year window for DSA keys.

CompleteFTP is niche, so only a small minority of internet hosts carry these keys. But the broader lesson is sharper: two independent cryptographic implementations (the one in CT certificates and the one in CompleteFTP) made the same mistake. If two did, more probably do.

Backdoor or Bug? Schneier Bets on Deliberate

Bruce Schneier doesn’t stop at “implementation error.” He points out that the failure pattern—regularly spaced zero blocks—is exactly what you’d expect from a backdoor inserted by a motivated agency. In 2013 he wrote about the possibility of governments coercing providers to weaken RSA key generation. The discovery of sparse moduli in two separate codebases makes that theory more plausible than coincidence.

What comes next: cryptanalysts should tailor factoring algorithms specifically for zero-heavy moduli. And every organization that ever shipped an RSA generator needs to audit its output against the Badkeys dataset—before someone else does the math for them.

Source: Factoring RSA Keys with Many Zeros
Domain: schneier.com