Skip to content

v0.1.0

Latest
Latest

Choose a tag to compare

View all tags
@jig jig released this 14 Jul 08:36
v0.1.0
f91832a

Initial release of the Go port of badkeys (tracking upstream 0.0.19).

Features

  • Vulnerability checks over math/big: fermat, roca, smalld (Wiener), smallfactors, sharedprimes (batch-GCD), rsainvalid, rsapoly, rsabias, pattern, xzbackdoor, rsawarnings, dsasparse — plus RSA private-key recovery.
  • Key parsing: DetectAndCheck and Check{Pubkey,Privkey,Cert,CSR,SSHPubkey,SSHPrivkey,JWK,DNSKEY}, including a dedicated ASN.1 path for RSA keys with oversized exponents that crypto/x509 rejects.
  • Blocklist of compromised keys downloaded at runtime (xz) with binary search; verified end-to-end against the live update.badkeys.info server.
  • CLI at cmd/badkeys. Dependencies: golang.org/x/crypto and github.com/ulikunitz/xz only — no cgo/GMP.

All vulnerability checks reach parity with upstream on the shared test fixtures. See the README for known key-parsing limitations (ML-DSA/ML-KEM, Ed448/X448, explicit-curve EC).

Install

go get github.com/jig/badkeys@v0.1.0
go install github.com/jig/badkeys/cmd/badkeys@v0.1.0
Assets 2
Loading