Listen to this Post
A groundbreaking study has revealed a critical security flaw in millions of RSA keys used across the internet, with a particularly alarming impact on IoT (Internet of Things) devices. Researchers Jonathan Kilgallin and Ross Vasko from Keyfactor discovered that a significant number of RSA keys—about one in every 172—share a common factor with another key, making them highly susceptible to cyberattacks.
The root cause of this vulnerability lies in weak random number generation during the key creation process, especially in devices with low entropy. This issue is particularly prevalent in IoT devices, which often operate with minimal computational resources, making them prone to predictable key generation. The consequences of this security flaw are far-reaching, as IoT devices are deeply embedded in critical sectors such as healthcare, automotive, and industrial automation.
This study highlights the urgent need for manufacturers to adopt stronger cryptographic practices and improve entropy sources in their devices. Without immediate action, millions of connected devices could remain vulnerable, providing an easy gateway for cybercriminals to exploit sensitive data and critical systems.
Breakdown of the RSA Vulnerability
How the Vulnerability Works
RSA encryption relies on the secrecy of two large prime numbers that form the basis of a public key. If these prime numbers are not chosen with sufficient randomness, two different RSA keys can end up sharing a prime factor. This dramatically weakens their security.
An attacker can exploit this flaw by calculating the Greatest Common Divisor (GCD) of different RSA moduli. If a shared prime factor is found, both keys can be compromised without the need for complex factorization techniques. This method is significantly faster and more scalable than traditional cryptanalysis methods.
Findings from the Study
The researchers analyzed 75 million RSA certificates obtained from the internet and supplemented this dataset with 100 million certificates from Certificate Transparency logs. Their findings were staggering:
- At least 435,000 RSA certificates were found to be vulnerable to factor-based attacks.
- IoT devices accounted for a large portion of these vulnerable keys.
- RSA keys exposed on the internet had a notably higher rate of shared factors compared to those in Certificate Transparency logs.
Why IoT Devices Are at Risk
IoT devices are particularly vulnerable because they operate under strict design constraints that often limit their ability to generate truly random numbers. Factors contributing to weak key generation in IoT devices include:
- Limited entropy sources – IoT devices often lack access to high-quality randomness, leading to predictable prime numbers.
- Infrequent updates – Many IoT devices are deployed for long periods without security updates, making them persistent security risks.
- Increased network exposure – The rise of cloud computing and smart devices has expanded the attack surface, making it easier for hackers to collect and analyze RSA keys.
Potential Consequences of This Vulnerability
The implications of weak RSA keys in IoT devices are severe, especially in environments where security is paramount:
- Healthcare: Medical devices using compromised RSA encryption could allow unauthorized access to sensitive patient data or even control over life-critical systems.
- Automotive: Connected car systems could be hijacked, leading to remote exploitation of vehicle functions.
- Critical Infrastructure: Power grids, industrial control systems, and smart city technologies relying on compromised RSA keys could become targets for cyber warfare.
The Path Forward: Strengthening IoT Security
To mitigate this risk, IoT manufacturers must prioritize cryptographic best practices, including:
- Using stronger random number generators that provide adequate entropy.
– Regularly auditing and updating device cryptographic implementations.
- Transitioning to more secure encryption algorithms such as Elliptic Curve Cryptography (ECC) where feasible.
- Implementing robust firmware update mechanisms to patch vulnerabilities as they arise.
If these changes are not made, the vulnerabilities uncovered in this study will remain a ticking time bomb in the world of cybersecurity.
What Undercode Say:
This study brings to light a significant and preventable flaw in modern encryption practices, particularly within IoT ecosystems. While RSA encryption has long been a cornerstone of online security, its effectiveness is only as strong as the randomness of its key generation. The fact that one in 172 RSA keys shares a factor with another is a glaring red flag, emphasizing the industry’s failure to enforce best practices in cryptographic security.
The Role of Randomness in Cryptography
One of the fundamental pillars of secure encryption is the quality of random number generation. In an ideal system, RSA keys are created using two independent, unpredictable prime
References:
Reported By: https://cyberpress.org/critical-flaws-discovered-in-millions/
Extra Source Hub:
https://www.twitter.com
Wikipedia
Undercode AI
Image Source:
Pexels
Undercode AI DI v2
