Finding insecure cryptographic keys in DKIM, DNSSEC, OpenID Connect & elsewhere
summary
An open source scanner named badkeys automatically harvests keys from GitHub, firmware, DNS records and mailing‑list archives, normalizes many key formats and tests for known failures. A run against the Tranco top million yields about 350,000 DKIM RSA keys and finds roughly ~800 vulnerable to the 2008 Debian OpenSSL RNG bug. Firmware leaks expose about 100 still-valid TLS keys and 300 ACME account keys from FortiGate configs, and OpenID Connect endpoints sometimes publish private keys or 512‑bit RSA keys that are trivially breakable.
AI-written summary · about
chapters (9)
- 0:00Introduction and project
- 3:34Finding private keys sources
- 9:11GitHub secret scanning findings
- 9:33DNSSEC key scanning
- 10:17DKIM key vulnerabilities
- 15:25Debian weak OpenSSL keys
- 18:42Fortinet 40G gate devices leak
- 20:47OpenID Connect issues
- 23:15Conclusion and future work
related talks
12mCatch-22: Uncovering Compromised Hosts using SSH Public Keys
28mThe Million-Key Question—Investigating the Origins of RSA Public Keys
44mCryptography in the age of Heartbleed
24mHow to Find Secure Software in Open Source Repositories
12mKeyfactor on Cryptographic Discovery: Why Knowing What You Have Is Step One
26mThe Dangers of Key Reuse: Practical Attacks on IPsec IKE
45mMillions Of Public Certificates Are Reusing Old Private Keys
29mFragile by Design: Large-Scale Evidence of Supply Chain Risk