# FREAK: Factoring RSA_EXPORT Keys to Impersonate TLS Servers

TLS clients accepted EXPORT_RSA ServerKeyExchange in normal RSA handshakes; factoring 512-bit export keys let a network attacker impersonate HTTPS servers like nsa.gov and Facebook.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: prosecco-inria
- Disclosed: 2015-04-01
- CVE: CVE-2015-0204
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/50170
- Library page: https://bugbountylibrary.com/r/h1%3A50170
- Tags: area:devices domain:network impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high technique:reverse-engineering vuln:crypto vuln:misconfiguration

**Target:** TLS client libraries and EXPORT_RSA TLS servers
**Root cause:** TLS clients (OpenSSL <=1.0.1j, SecureTransport, SChannel, BoringSSL, LibReSSL, IBM JDK) accept an EXPORT_RSA ServerKeyExchange during a regular RSA handshake, replacing the certificate's public key with a short signed ephemeral key. Servers still support obsolete EXPORT ciphersuites with 512-bit RSA keys that stay constant across the server lifetime.
**Steps:**
1. Identify a TLS server supporting EXPORT_RSA ciphersuites (e.g. `TLS_RSA_EXPORT_WITH_RC4_40_MD5`) with a 512-bit ephemeral RSA key.
2. Factor the server's 512-bit EXPORT_RSA key using cado-nfs on EC2 (7-11 hours, ~$70-$100).
3. As a network attacker, force the client into an EXPORT_RSA handshake and present a ServerKeyExchange signed with the factored key, substituting your own ephemeral key.
4. Client accepts the EXPORT_RSA ServerKeyExchange during the RSA handshake, trusting the attacker's key over the certificate's.
5. Complete the handshake and impersonate the site to the client.
**How found:** Researchers observed that many servers still advertise EXPORT ciphersuites with long-lived 512-bit keys, and that several client libraries accept an EXPORT_RSA ServerKeyExchange mid-RSA-handshake; combined with cheap cloud factoring of 512-bit keys, this yields impersonation.
**Exploitation:** Network attacker MITMs the TLS connection, downgrades to EXPORT_RSA, and uses the factored 512-bit key to sign an attacker-controlled ephemeral key. Demos hijacked HTTPS to www.nsa.gov (tampering the careers page) and to the Facebook JavaScript SDK (injecting malicious scripts into third-party sites) in Safari.
**Escalation:** Chaining server-side EXPORT_RSA support with the client-side RSA_EXPORT acceptance bug turns a weak-key factoring effort into full server impersonation for any vulnerable client.
**Insight:** Check whether clients honor a downgraded/export ServerKeyExchange inside a non-export handshake — protocol-version and ciphersuite negotiation mismatches between client and server are a recurring source of downgrade attacks. Also note export keys persist until server reboot, widening the attack window.