The Patching Friars' AlmanacA calendar of CVE saints

Patron of January 8

FREAKHoly card for freak, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 512 1995 FREAK CLAVIS BREVIS
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint FREAK, Raiser of Export-Grade Crypto

Patron of 512-bit RSA keys and the 1990s laws nobody ever really buried.

Life

Child of an era when the United States banned the export of strong cryptography, FREAK (Factoring RSA Export Keys) let whoever sat in the middle of a connection force 512-bit RSA keys, factorable in a few hours with a few hundred dollars of cloud. A bug in OpenSSL, fixed in January 2015, accepted the weak key even when nobody had asked for it.

Prayer

O Saint FREAK, who brought export keys back to life, let our cipher suites look forward and never back. Amen.

How to celebrate

Celebrated by disabling every EXPORT cipher suite and toasting the end of the crypto cold war.

Short key, short secret.

Technical record

Disclosed on
January 8 2015
CVE
CVE-2015-0204CVE-2015-1067CVE-2015-2235CVE-2015-1637

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.

Sources: mitls.org · web.archive.org · web.archive.org · freakattack.com

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.