ROCA

cryptography

A 2017 flaw in RSA key generation in certain chips that made keys factorable.

Return of Coppersmith's Attack exploited a weak RSA keygen routine in a widely used cryptographic library, so affected public keys could be factored. It forced reissuance of many smartcards, TPMs, and identity certificates.

ROCA was a flaw in a widely used cryptographic library's RSA key generation, which produced primes with a structure that made the resulting public keys factorable far more cheaply than their size implied. The library was embedded in smartcards, trusted platform modules and national identity cards.

The scale is what makes it instructive. Keys generated over years by hardware from a major manufacturer were affected, including government identity documents that had to be suspended, and the flaw was detectable from the public key alone, which meant anyone could scan for vulnerable keys without any access to the systems holding them.

It illustrates a risk that is easy to underrate: the concentration of trust in a small number of cryptographic implementations. Hardware security modules and secure elements are chosen precisely because they are supposed to be more trustworthy than general-purpose software, and that concentration means a single defect propagates into millions of devices that cannot be patched, only replaced. ROCA is the strongest available argument for diversity in cryptographic implementations, and for treating hardware as something to verify rather than to assume.

Also known as: ROCA, Return of Coppersmith's Attack, CVE-2017-15361

← All glossary entries