This story already came up about a year ago, I have written something about it back then: https://blog.hboeck.de/archives/872-About-the-supposed-factoring-of-a-

This story already came up about a year ago, I have written something about it back then: https://blog.hboeck.de/archives/872-About-the-supposed-factoring-of-a-4096-bit-RSA-key.html https://blog.hboeck.de/archives/872-About-the-supposed-facto... To sum it up: * If you do a batch gcd / mining ps and qs attack on the pgp keyserver data you will find a bunch of broken keys. However most of them are not valid keys, they are just broken copies of valid keys with errors in them. I don't know why they exist, but most likely either due to data transmission errors, disk failures or software bugs. But they don't pose any risk. Their self-signature is invalid, therefore gpg won't use them. * There are two very old keys that can really be broken with this attack. According to what I know and heard from other people researching this stuff they were created with a no longer developed email encryption tool called CryptoEx by a no longer existing company called Gluck&Kanja. (afaik this hasn't been public knowledge, so I'm dropping it here) This has been researched before by Arjen Lenstra, Nadia Heninger and myself: https://eprint.iacr.org/2012/064 https://eprint.iacr.org/2012/064 https://factorable.net/ https://factorable.net/ https://eprint.iacr.org/2015/262.pdf https://eprint.iacr.org/2015/262.pdf (On the factorable webpage there is an efficient free implementation of this attack by Nadia Heninger - in case you want to play with it)