The Layer Nobody Monitors: Entropy Failures in PKI, from Factorable Keys to Silent Hardware Faults
· 14:30 – 15:00 Amsterdam time · Room E (10)
The randomness PKI assumes is there fails silently — certificates look valid, keys look fine, and nothing alerts until someone goes looking. This session walks four real entropy failures and the thread connecting them. The 2012 shared-factor research (Heninger et al.; Lenstra et al.) found a meaningful fraction of live TLS and SSH keys factorable by simple GCD, because devices generated keys at first boot before the entropy pool filled. The Debian OpenSSL collapse reduced a keyspace to a few thousand possibilities. Taiwan's national smartcards produced factorable keys despite FIPS and Common Criteria certification. And AMD's 2025 Zen 5 RDSEED fault (CVE-2025-62626) returned zeros while signaling success — a hardware source failing silently on current CPUs. The lesson isn't hardware versus software. It's runtime health-testing, validation that exercises the noise source, and no single point of dependence — as PQC and short cert lifetimes multiply randomness demand.
Speakers
- Founder · Real Random
I'm a curious person, and most of what I've done follows from that. I've always learned by taking things apart and thinking them through until they made sense, which is what drew me to options trading. It's a job where you can't fool yourself about probability, and it taught me how rarely people try.
My father-in-law shared that curiosity. He held a 2002 patent for a slot machine that used real, physical dice instead of software, because he believed that randomness you could watch happen was more trustworthy. He passed before he could build it. I picked up his idea, and more than eleven years later I'm still learning from it.
I believe trust should be observable, not taken on faith. It's how I run my company, and it's how I coach high school lacrosse in Florida: I'd rather show you the work than ask you to believe a claim about it.
I'm direct, I move fast, and I care about building things that outlast me.
Attendance
Open session · first come, first served
Saving interest does not reserve a seat. Admission remains first come, first served.
Save favorite
