Documentation
¶
Overview ¶
Package roca detects RSA public keys vulnerable to CVE-2017-15361 (ROCA): the Infineon RSALib flaw that generated factorable primes of the form p = k*M + (65537^a mod M), making the modulus practically factorable by the Coppersmith-based attack of Nemec et al. (CCS 2017). Affected keys were produced by Infineon TPMs, Yubikey 4/Neo, Gemalto IDPrime, Estonian/Slovak eID cards, and code-signing/SSH keys generated on that hardware.
The detector implements the public, fast *fingerprint* test from the reference tool (crocs-muni/roca, roca/detect.py — has_fingerprint_moduli): for each of 38 small primes p_i, the ROCA generator structure forces the residue (modulus mod p_i) into a small subgroup, so 1<<(modulus mod p_i) must land in a precomputed marker bitmask prints[i]. A vulnerable modulus passes all 38 checks; any miss clears it. The primes and markers are transcribed verbatim from that file.
The fingerprint is a *screen*, not a factorisation: it has a negligible but non-zero false-positive rate (a flagged key is overwhelmingly likely ROCA-vulnerable but is confirmed only by the full Coppersmith attack), and it never flags a key generated by a sound RSA library. We surface that caveat in the Note rather than overclaiming.
Wrap-vs-native: native — pure math/big + crypto/x509 + a native ssh-rsa wire parser; no new go.mod dependency. crypto/x509 and encoding/pem are stdlib, and ssh-rsa is parsed directly off the base64 wire format so the x/crypto/ssh surface (and its govulncheck advisories) is not pulled in.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func HasFingerprint ¶
HasFingerprint reports whether modulus carries the ROCA fingerprint. It is the in-tree port of has_fingerprint_moduli: for every prime p_i, bit (modulus mod p_i) must be set in the marker prints[i]; the first miss clears the key. A non-positive modulus is never fingerprinted.
Types ¶
type Result ¶
type Result struct {
// Vulnerable is true when the modulus carries the ROCA fingerprint.
Vulnerable bool `json:"vulnerable"`
// KeyBits is the bit length of the modulus.
KeyBits int `json:"key_bits"`
// Source names how the modulus was obtained: "modulus", "pem-pkix",
// "pem-pkcs1", "certificate", or "ssh-rsa".
Source string `json:"source"`
// ModulusHex is the modulus in hex, for cross-checking against other tools.
ModulusHex string `json:"modulus_hex"`
// Note carries the ROCA caveat / interpretation guidance.
Note string `json:"note"`
}
Result is the outcome of a Detect call.
Source Files