ALT-24 · Paper · 23 Oct 2026
Debian's predictable keys: two lines that removed the randomness
A well-meant cleanup to silence a memory checker left Debian's OpenSSL with almost no entropy for two years. Every SSH and TLS key it generated could be listed in advance.
- Sep 2006The patch ships in Debian's openssl 0.9.8c-1.
- 13 May 2008Debian security advisory DSA-1571; CVE-2008-0166.
- Following weeksBlacklists of weak keys ship in OpenSSH and OpenVPN; certificates are reissued.
What went wrong
Valgrind complained that OpenSSL read uninitialised memory. The maintainer commented out the offending lines — but one of them was also how real entropy was added to the pool. What remained was essentially the process ID.
The change was discussed on a public mailing list before it shipped. Nobody involved saw the consequence.
Why it mattered
The flaw reached far beyond Debian: any key generated on an affected machine was weak wherever it was later used, including DSA keys whose signatures leaked the private key once a weak generator was involved.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Downstream patches to cryptographic code need upstream review.
- Tools that report “warnings” in crypto code may be flagging intended behaviour.
- A weak random number generator compromises every key and nonce it ever produced.
What it means for you
- Use the operating system's random source (
getrandom,/dev/urandom) rather than custom pools. - Keep cryptographic changes close to upstream and send patches there first.
- Check stored public keys against known-weak key lists when you inherit old infrastructure.
Sources
- Debian — DSA-1571-1 openssl: predictable random number generator
- Debian Wiki — SSLkeys
- NVD — CVE-2008-0166
Altumptic was not involved in this research. Figures are as published by the sources above.
Cite this entry
Altumptic Lab (2026). ALT-24 — Debian's predictable keys: two lines that removed the randomness. 23 Oct 2026. altumptic.com/research/debian-openssl-2008