FREAK (Factoring RSA Export Keys)
Definition
FREAK is a 2015 attack in which a man-in-the-middle tricks vulnerable TLS clients into accepting a 512-bit export-grade RSA key that can be factored.
FREAK was disclosed in March 2015. In the 1990s, US export rules limited the strength of exported cryptography, so SSL and TLS gained "export" cipher suites with 512-bit RSA keys. Vulnerable clients, including OpenSSL (CVE-2015-0204) and the TLS stacks of Apple and Microsoft, would accept a temporary 512-bit RSA_EXPORT key from the server even when they had not asked for an export suite, due to a state-machine bug. A man-in-the-middle rewrites the client's request to an export suite; if the server still supports one, it returns a 512-bit key, which the attacker factors, then completes the handshake and can read or modify the traffic. Many servers reused one export key for a long time, which made factoring it in advance worthwhile.
Why it matters
FREAK showed that legacy cipher suites left enabled "just in case" stay dangerous decades later, and that client bugs can turn a server's leftover weakness into a practical attack. Fixing it needed both sides: client libraries were patched, and servers had to drop all EXPORT cipher suites. TLS 1.3 removed export cryptography and RSA key exchange entirely. Logjam applied the same idea to Diffie-Hellman a few months later.
Example
nmap --script ssl-enum-ciphers -p 443 example.com | grep -i export
No output means the server offers no export suites. Current OpenSSL releases no longer contain export suites at all.
Common misconceptions
- Only servers were at fault. The root cause was client libraries accepting keys they never asked for; the server only had to keep export suites enabled.
- 512-bit RSA is still hard to factor. A 512-bit RSA modulus was publicly factored in 1999, and doing so today is cheap.
- FREAK is about the certificate's key size. The certificate's RSA key can be 2048 bits; FREAK abuses a separate temporary export key.