3 ms·
This is a project I've been working on for the past months. I figured out there's no easy tool to check cryptographic keys for past vulnerabilities like the Deb
by hannob 5y ago
This is a project I've been working on for the past months. I figured out there's no easy tool to check cryptographic keys for past vulnerabilities like the Debian OpenSSL bug. The tools from the time the vulns were found are often hard to use or don't work on modern systems.
badkeys.info provides a check for a variety of known cryptographic key generation vulnerabilities. If possible it directly calculates the private key. The backend code that does the checks is available under an open source license. (The webpage code itself will eventually also be published.)