# ROCA vulnerability

From Wikipedia, the free encyclopedia

The ROCA vulnerability is a cryptographic weakness that allows the private key of a key pair to be recovered from the public key in keys generated by devices with the vulnerability. "ROCA" is an acronym for "Return of the Coppersmith Attack".[1] The vulnerability has been given the CVE identifier CVE-2017-15361.

The vulnerability arises from a problem with a software library used for RSA key generation in Infineon's Trusted Platform Module implementation.[2][3][4] All keys generated using this library are believed to be vulnerable to the ROCA attack.[5] The researchers who discovered the attack believe that it affects around one-quarter of all current TPM devices globally.[6] In particular, many millions of smartcards are believed to be affected.[1]

## See also[edit]

- BitLocker § Security concerns
- Infineon Technologies § Security flaw
- Trusted Platform Module

## References[edit]

1. ^ Jump up to: a b Goodin, Dan (2017-10-23). "Crippling crypto weakness opens millions of smartcards to cloning". Ars Technica. Retrieved 2017-10-25.
2. Jump up ^ "ROCA: Infineon TPM and Secure Element RSA Vulnerability Guidance". www.ncsc.gov.uk. Retrieved 2017-10-25.
3. Jump up ^ "ROCA: Vulnerable RSA generation (CVE-2017-15361)". crocs.fi.muni.cz. Retrieved 2017-10-25.
4. Jump up ^ Infineon Technologies AG. "Information on software update of RSA key generation function". www.infineon.com. Retrieved 2017-10-25.
5. Jump up ^ Khandelwal, Swati. "Serious Crypto-Flaw Lets Hackers Recover Private RSA Keys Used in Billions of Devices". The Hacker News. Retrieved 2017-10-25.
6. Jump up ^ Leyden, John (16 Oct 2017). "Never mind the WPA2 drama... Details emerge of TPM key cockup that hits tonnes of devices". Retrieved 2017-10-25.

## External links[edit]

- ROCA detection tool (Detection source code)
- ROCA Vulnerability Test Suite (Online tool for testing keys, files, GitHub accounts, GnuPG keys, and includes an S/MIME and PGP email responder)
- TrustMonitor ROCA Vulnerability Test (Online tool for testing multiple certificates)
- Detect Trusted Platform Modules Vulnerable to CVE-2017-15361 (Scripts)

| This cryptography-related article is a stub. You can help Wikipedia by expanding it.

Retrieved from "https://en.wikipedia.org/w/index.php?title=ROCA_vulnerability&oldid=807992632"
Categories:

- Cryptographic attacks
- Attacks on public-key cryptosystems
- Cryptography stubs

Hidden categories:

- All stub articles