Show HN: Badkeys.info – checking cryptographic keys for known vulnerabilities

Cool idea, bad implementation.

This really needs to be a local tool: uploading any kind of key material to a remote site is a privacy risk, and the disclaimer that "uploading private keys is obviously discouraged" is not sufficient, as anyone that has every dealt with 'users' will attest...

This is a project I've been working on for the past months. I figured out there's no easy tool to check cryptographic keys for past vulnerabilities like the Debian OpenSSL bug. The tools from the time the vulns were found are often hard to use or don't work on modern systems.

badkeys.info provides a check for a variety of known cryptographic key generation vulnerabilities. If possible it directly calculates the private key. The backend code that does the checks is available under an open source license. (The webpage code itself will eventually also be published.)