You should only be worried about this if you generated keys on a vulnerable device, such as a smart card (e.g. Yubikey) or a TPM embedded in your computer. You

You should only be worried about this if you generated keys on a vulnerable device, such as a smart card (e.g. Yubikey) or a TPM embedded in your computer. You can detect if your card is affected with a variety of tools, both online and offline: https://crocs.fi.muni.cz/public/papers/rsa_ccs17#detection_tools_mitigation_and_workarounds https://crocs.fi.muni.cz/public/papers/rsa_ccs17#detection_t... Fair word of warning: the offline (as in, on-your-machine) tools use a cornucopia of crypto libraries, meaning that it's nontrivial to build. If you're on macOS and don't know what an LDFLAGS is, you probably want the online checker. Yubikey has their own tool: https://www.yubico.com/keycheck/ https://www.yubico.com/keycheck/ How does the attack work? The paper isn't released yet, but here's an educated guess. The authors have already indicated that this is not another variant of [BCCC13], a paper by Bernstein et al that relied on bugs in the CSPRNG of smart cards to find weak, factorizable keys. It does appear to build on earlier research by the same authors [SNSK16]. The detection tool is released, but that only shows us what the "fingerprints" (symptoms of a weak key) are, not how to factor them. My best guess is that this is a Coppersmith/Howgrave-Graham [HG] style attack. The crucial difference between this and previous attacks is that the problem results from poor prime selection algorithms, not limited entropy. Briefly: patterns in the low-order bits of N appear in the high-order bits of p (since N=p*q), Coppersmith allows factoring if you guess sufficient high-order bits of p correctly. So far the results I'm seeing appear to be cryptographically catastrophic but not so much operationally catastrophic. (please don't interpret this as me speaking ill of the paper: the paper is awesome) The range of real keys I've seen is currently between $40k and $4T (yes, trillion). That's pretty bad if you're running a company CA off of a $40k key, but probably not so bad you can't afford to wait for a replacement in most cases. If the fingerprints are to be believed, some keys can be factored in a matter of hours -- but I have no idea yet what the distribution of those keys is (i.e. is it 1 in 10 or 1 in 10k?). As usual, the issue here is different with signing keys and encryption keys. If you're not using forward-secure ciphersuites and merely signing with a smartcard key (as you typically would be with smartcard-powered SSH or TLS) and instead are really encrypting with the key itself (GPG), you've lost confidentiality on all messages once that key is compromised. A compromised signing key merely allows for forged signatures, and by then you've hopefully revoked trust in that key. Right now I have to go deal with immigration administrivia, but I'll get back to this. [BCCC13]: https://smartfacts.cr.yp.to/smartfacts-20130916.pdf https://smartfacts.cr.yp.to/smartfacts-20130916.pdf [SNSK16]: https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_svenda.pdf https://www.usenix.org/system/files/conference/usenixsecurit... [HG]: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.144.4244&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.144...