An RSA public key is, mathematically, just two numbers: a large modulus N (the product of two secret primes p and q) and a public exponent e. Everything about the key's strength comes down to whether anyone can recover p and q from N — because factoring the modulus recovers the private key completely. A PEM-encoded key wraps those two integers in DER/ASN.1 structure, either as a bare PKCS#1 RSAPublicKey or inside a SubjectPublicKeyInfo (SPKI) wrapper with an algorithm identifier. This inspector decodes both encodings client-side and reads out the modulus bit length and the exponent before running any weakness checks.
The modulus size is the first thing that matters. RSA-1024 is considered within reach of a well-resourced attacker and RSA-512 has been factored on ordinary hardware for years; NIST deprecated anything below 2048 bits. So a key under 1024 bits is flagged critical, and one between 1024 and 2048 as a warning to migrate. But size is necessary, not sufficient — a 2048-bit key can still be trivially breakable if the primes were generated badly, and that is what the remaining checks look for.
The most consequential of those is the ROCA fingerprint (CVE-2017-15361). A flawed key-generation library shipped in millions of Infineon smartcards, TPMs, and Yubikeys produced primes with a specific algebraic structure that leaves a detectable fingerprint in the modulus — and, crucially, makes the key factorable by Coppersmith's method without ever seeing the private key. tryb ships the fast fingerprint pre-filter from the original research (a membership test modulo a set of small primes), so it can flag a key as ROCA-family in microseconds. It reports a possible affected key, not a recovered secret — but a positive result means that key should be regenerated and revoked, not merely rotated.
Two more generation flaws are cheap to test directly. If the two primes were chosen close together, the modulus falls to Fermat factorization in a handful of steps — tryb runs a time-bounded Fermat attempt and, on a hit, the key is effectively already broken. And if the modulus shares a small factor (a sign of a broken or entropy-starved generator), trial division finds it immediately. The inspector also sanity-checks the exponent: e=1 means no encryption at all, an even e cannot be a valid RSA exponent, and a very small e like 3 is worth noting for padding-attack exposure. Every check is bounded to run in well under the analysis budget, and any check that hits its bound is reported as inconclusive rather than as a clean bill of health.
Edge cases worth knowing
- A key that trips the ROCA fingerprint
- The fingerprint is the fast pre-filter from the Nemec et al. research, not the full factorization. It has effectively no false negatives but a tiny false-positive rate, so tryb reports a POSSIBLE ROCA-family key and links CVE-2017-15361 — it never claims to have recovered the private key. A positive result means regenerate and revoke that key on hardware known to be affected.
- A pasted private key
- If you paste an RSA private key instead of a public one, tryb refuses to parse its contents — it does not decode, display, or analyze the private material. It raises a single critical finding telling you the key is now compromised by being pasted anywhere and should be rotated, and stops there.
- A healthy 2048-bit key
- A well-formed key with no small factor, well-separated primes, no ROCA fingerprint, and the standard F4 exponent (65537) reports as informational — with the explicit caveat that passing tryb's bounded checks is not a proof of strength, only the absence of the specific cheap-to-detect flaws it tests for.
Common mistakes
- Assuming a 2048-bit key is safe purely because of its size — the ROCA and close-prime flaws break keys of exactly that size when the primes were generated badly.
- Continuing to use hardware-generated keys (smartcards, TPMs, Yubikeys) from the 2012–2017 Infineon batches without checking them for the ROCA fingerprint.
- Pasting an RSA private key into an online tool — the moment it leaves your machine it should be considered compromised and rotated.
- Using a public exponent of 3 with no or improper padding, which historically enabled Bleichenbacher-style and low-exponent attacks; 65537 is the safe default.