Terms
These are devices such as routers, firewalls, VPNs, VoIP gateways, and printers that made up the majority of vulnerable keys discovered.
What is Network Devices?
What percentage of HTTPS hosts and SSH hosts had private keys that researchers were able to compute from publicly available information because of flaws in key generation?
What are approximately 0.5% of HTTPS hosts and 1% of SSH hosts?
What are public keys and what are they for?
Public keys are used to verify the server's identity and to allow a user to encrypt communication with the server.
In DSA, reusing this temporary value in two signatures can allow an attacker to calculate the private key.
What is an ephemeral key?
What limitation of Internet-wide scanning could cause researchers to miss vulnerable devices?
Scans only reach publicly accessible devices, so systems behind firewalls, offline devices, or unsupported services may not be detected.
What are the practical risks?
Compromise of these keys would allow an active attacker with access to the network connection between the client and server to perform a man-in-the-middle attack, intercepting or modifying the communication.
This cryptosystem uses two prime numbers, p and q, to create a public modulus.
What is RSA?
Researchers discovered that many vulnerable embedded devices relied on Linux's /dev/urandom during boot. What Linux-specific problem caused the random number generator to sometimes produce insufficiently unpredictable output?
What is the boot-time entropy hole?
Why is insufficient randomness a serious security problem when generating cryptographic keys?
Weak randomness can make keys predictable or cause different devices to generate related or identical keys, allowing attackers to recover private keys.