There have been some revelations circulating that researchers have determined that a very small percentage of public keys used for encryption are inherently weak. Bruce Schneier, a respected cryptologist and Chief Security Technology Office of BT, says in a blog post that the issue is almost certainly the result of a flawed random number generator.
Schneier explains, “This shouldn’t come as a surprise. One of the hardest parts of cryptography is random number generation. It’s really easy to write a lousy random number generator, and it’s not at all obvious that it is lousy.”
Schneier goes on to address the issue of what impact this has in terms of real-world security, and the encryption keys being used today:
What is the security risk? There’s some, but it’s hard to know how much. We can assume that the bad guys can replicate this experiment and find the weak keys. But they’re random, so it’s hard to know how to monetize this attack. Maybe the bad guys will get lucky and one of the weak keys will lead to some obvious way to steal money, or trade secrets, or national intelligence. Maybe.
The random number generator (RNG) forms the foundation for creating keys, so any RNG that is in any way predicatble weakens the security of the whole system.
