Researchers have identified a new class of cryptographically weak RSA keys characterised by regularly spaced blocks of zeros, with affected keys traced to real-world certificates and SSH deployments.
Summary
- Researchers discovered RSA keys in the wild containing unusual, regularly spaced blocks of zero bits — a structural pattern that makes them easier to factor and therefore cryptographically weak.
- Affected certificates were issued to large organisations including Yahoo and Verizon; those certificates have since expired, but the generating software has not been publicly identified.
- CompleteFTP software from EnterpriseDT generated vulnerable SSH keys across versions 10.0.0 through 12.0.0 (RSA) and 10.0.0 through 23.0.4 (DSA), covering a period from December 2016 to December 2023.
- The badkeys open-source project, which checks public keys against known vulnerability patterns, was central to uncovering this issue across Certificate Transparency logs, TLS/SSH scans, and PGP datasets.
- Researchers note that multiple independent cryptographic implementations appear to have failed in similar ways, raising the possibility that further affected implementations remain undiscovered.
A new weak-key class surfaces
Security researchers examining large datasets of real-world cryptographic keys have identified a previously undocumented class of weak RSA keys. The keys share a distinctive structural characteristic: their RSA moduli contain multiple regularly spaced blocks of zeros interspersed with what otherwise looks like random data. This sparsity makes the keys significantly easier to factor than a properly generated RSA key, undermining the security guarantee that RSA is meant to provide.
How the keys were found
The discovery came out of work on the badkeys project, an open-source tool designed to check public keys against known vulnerability patterns. In assembling a large reference dataset for the project, researchers pulled keys from Certificate Transparency logs, internet-wide TLS and SSH scans, PGP key servers, and other public sources. Searching that dataset for unexpectedly sparse RSA moduli surfaced two distinct zero-block patterns — both consistent with a failure somewhere in the key generation process.
Where the affected keys appeared
The two patterns were found in different environments. The first appeared in Certificate Transparency logs for TLS certificates issued to several large organisations, specifically naming Yahoo and Verizon, as well as on devices running NetApp software. The researchers shared their findings with those organisations. The relevant certificates have since expired. However, the researchers were unable to determine which product or software library generated them, as none of the notified parties responded to their enquiries.
CompleteFTP: a confirmed source
The second pattern was traced to a specific product. SSH hosts running CompleteFTP, developed by EnterpriseDT, were found to be generating keys with the vulnerability. The affected versions span RSA key generation from version 10.0.0 to 12.0.0, released between December 2016 and March 2019. For DSA keys, the affected range extends further — version 10.0.0 through 23.0.4, covering December 2016 to December 2023. Any organisation that ran CompleteFTP in those version ranges and has not rotated keys since should treat existing keys as potentially compromised.
Scale is limited, but the pattern is the concern
The researchers characterise the number of affected hosts as a small minority of internet-facing systems. The broader concern, however, is what the pattern of failures implies. Two distinct product lines, developed independently, appear to have made similar errors in their RSA key generation code. That convergence suggests the underlying failure mode may be more common than the known cases indicate. Researchers note it is worth adapting cryptanalytic methods specifically for this zero-block pattern, since more affected implementations may yet be identified.
A speculative note on intent
Commentary accompanying the research raises the possibility — explicitly framed as speculation rather than a finding — that the structured zero patterns could represent a deliberately engineered backdoor rather than an accidental coding flaw. The basis for this suggestion is historical precedent: similar concerns were raised about certain cryptographic standards in 2013. The sources do not provide any evidence to support intentional design, and no attribution has been made. CISOs should note this as an open question, not a conclusion.
Why it matters
For CISOs, the immediate exposure sits with any organisation that ran CompleteFTP in the affected version range or that deployed certificates during the relevant period without scrutinising key quality. The broader implication is more uncomfortable: if independent implementations failed in similar ways, your cryptographic key estate — particularly long-lived SSH host keys and older TLS certificates — may contain weak keys that were never flagged by standard vulnerability tooling. The badkeys project offers a practical mechanism to check, but only if organisations actively run it against their key inventory. This is also a useful reminder that key generation quality is rarely validated at deployment time, creating a class of risk that can sit undetected for years.
What to do now
- If your organisation has run CompleteFTP versions 10.0.0 through 12.0.0 (RSA) or 10.0.0 through 23.0.4 (DSA), treat all keys generated in those versions as suspect and rotate them.
- Run your public key inventory — SSH host keys, TLS certificates, PGP keys — through the badkeys open-source tool to check for known weak-key patterns, including the newly identified zero-block patterns.
- Review key generation practices and libraries across your environment; consider whether any internally developed or vendor-supplied cryptographic tooling could produce structurally unusual keys.
- Where certificates have expired and keys rotated, verify that replacement keys were generated by a different, validated code path rather than the same potentially flawed library.
- Monitor for updates from the research community regarding additional products or implementations found to produce this zero-block pattern, as the researchers indicate further discoveries are plausible.
