The authors of the paper on the weak RSA keys generated by Infineon TPMs and smart cards have published code in multiple languages / platforms that provide for an efficient test for weakness by way of the Infineon TPM bug.
Perhaps this should be a category of issue identified by the crt.sh engine, etc? Should someone put together a ballot for incorporating this category of weak keys as a mandatory check before issuing certs? Code for testing keys is at: https://github.com/crocs-muni/roca It looks like the test is exceptionally easy math against the modulus of the public key. Thanks, Matt Hardeman _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
