The software comes from a basic version of the SafeZone Crypto Libraries, which were developed by a company called Inside Secure and acquired by Rambus as part of its 2019 acquisition of Verimatri. The company said that the version is distinct from a FIPS-certified version that the company now sells under the Rambus FIPS Security Toolkit brand.

Researcher Hanno Bock said that the vulnerable SafeZone library doesn't sufficiently randomise the two prime numbers it used to generate RSA keys. The SafeZone tool selects one prime number, it chooses a prime in close proximity as the second one needed to form the key.

The problem is that both primes are too similar. So the difference between the two primes is really small. The SafeZone vulnerability is tracked as CVE-2022-26320. RSA keys that are generated with primes that are too close together can be trivially broken using Fermat's factorisation method which was developed in 1643 around the time that the British were fighting their King and the French were being beaten up by the Holy Roman Empire.

So far, Bock has identified only a handful of keys in the wild that are vulnerable to the factorisation attack. Some of the keys belong to printers originally branded as Fuji Xerox and now belong to Canon. Printer users can use the keys to generate a Certificate Signing Request. The creation date for the keys was 2020 or later. The weak Canon keys are tracked as CVE-2022-26351. Bock also found four vulnerable PGP keys, typically used to encrypt email, on SKS PGP key servers.

A user ID tied to the keys implied they were created for testing, so he doesn't believe they're in active use. Bock said he believes all the keys he found were generated using software or methods not connected to the SafeZone library.