ALT-23 · Paper · 23 Oct 2026
ROCA: when the key generator was the backdoor
A library inside millions of Infineon chips generated RSA keys with a hidden structure. Smart cards, TPMs and an entire national ID system had to be reissued. What the structure was, and what it cost to exploit.
- 2012Affected chips are in production.
- Feb 2017Researchers notify Infineon.
- Oct 2017ROCA (CVE-2017-15361) published at ACM CCS; fixes and reissuance follow.
- CPU-years to factor one 2048-bit key
- ~140Nemec et al., CRoCS (CCS 2017)
- CPU-days to factor one 1024-bit key
- ~97Nemec et al., CRoCS (CCS 2017)
How it worked
To generate primes quickly, the library built them from a fixed form. The result was not random enough: an adaptation of Coppersmith's method could find the factors far faster than a general attack.
Why it mattered
The keys lived in tamper-resistant hardware — certified, audited, trusted. Nobody could inspect how they were generated, so nobody noticed for years.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Certification of a chip is not verification of its randomness.
- Closed key generation is a single point of failure for everything built on it.
- Fast tests for weak keys are worth running across every public key you hold.
What it means for you
- Test public keys from hardware tokens with public detection tools.
- Prefer key generation you can audit, or verify the vendor's method independently.
- Plan for mass key reissuance; it happens.
Sources
- Nemec et al. — The Return of Coppersmith's Attack, CCS 2017 (CRoCS)
- CERT-EU — Security Advisory 2017-023
- SecurityWeek — Faster way to exploit the Infineon chip flaw
Altumptic was not involved in this research. Figures are as published by the sources above.
Cite this entry
Altumptic Lab (2026). ALT-23 — ROCA: when the key generator was the backdoor. 23 Oct 2026. altumptic.com/research/roca-2017