4 ms·
Show HN: Badkeys.info – checking cryptographic keys for known vulnerabilities
- hannob 5y agoThis is a project I've been working on for the past months. I figured out there's no easy tool to check cryptographic keys for past vulnerabilities like the Debian OpenSSL bug. The tools from the time the vulns were found are often hard to use or don't work on modern systems. badkeys.info provides a check for a variety of known cryptographic key generation vulnerabilities. If possible it directly calculates the private key. The backend code that does the checks is available under an open source license. (The webpage code itself will eventually also be published.)
- mdb31 5y agoCool idea, bad implementation. This really needs to be a local tool: uploading any kind of key material to a remote site is a privacy risk, and the disclaimer that "uploading private keys is obviously discouraged" is not sufficient, as anyone that has every dealt with 'users' will attest...
- hannob 5y agoWell, you can have that: https://github.com/badkeys/badkeys https://github.com/badkeys/badkeys The webpage is mostly just a frontend to the tool. (Also FWIW I'm not storing any keys that people submit to the form, but of course you can legitimately not trust me on that.)