# What Is FREAK (Factoring RSA Export Keys)? Definition and Examples

> FREAK is a 2015 attack in which a man-in-the-middle tricks vulnerable TLS clients into accepting a 512-bit export-grade RSA key that can be factored.

Source: https://ssl.sh/glossary/freak/
Last updated: 2026-11-10

FREAK was disclosed in March 2015. In the 1990s, US export rules limited the strength of exported cryptography, so SSL and TLS gained "export" cipher suites with 512-bit [RSA](https://ssl.sh/glossary/rsa/) keys. Vulnerable clients, including OpenSSL (CVE-2015-0204) and the TLS stacks of Apple and Microsoft, would accept a temporary 512-bit RSA_EXPORT key from the server even when they had not asked for an export suite, due to a state-machine bug. A man-in-the-middle rewrites the client's request to an export suite; if the server still supports one, it returns a 512-bit key, which the attacker factors, then completes the handshake and can read or modify the traffic. Many servers reused one export key for a long time, which made factoring it in advance worthwhile.

## Why it matters
FREAK showed that legacy cipher suites left enabled "just in case" stay dangerous decades later, and that client bugs can turn a server's leftover weakness into a practical attack. Fixing it needed both sides: client libraries were patched, and servers had to drop all EXPORT cipher suites. TLS 1.3 removed export cryptography and RSA key exchange entirely. [Logjam](https://ssl.sh/glossary/logjam/) applied the same idea to [Diffie-Hellman](https://ssl.sh/glossary/diffie-hellman/) a few months later.

## Example
```bash
nmap --script ssl-enum-ciphers -p 443 example.com | grep -i export
```

No output means the server offers no export suites. Current OpenSSL releases no longer contain export suites at all.

## Common misconceptions
- **Only servers were at fault.** The root cause was client libraries accepting keys they never asked for; the server only had to keep export suites enabled.
- **512-bit RSA is still hard to factor.** A 512-bit RSA modulus was publicly factored in 1999, and doing so today is cheap.
- **FREAK is about the certificate's key size.** The certificate's RSA key can be 2048 bits; FREAK abuses a separate temporary export key.

## Related terms

- [RSA](https://ssl.sh/zh/glossary/rsa/): RSA 是 1977 年提出的公钥算法，TLS 用它对证书和握手进行签名，在 TLS 1.3 之前还用它传输会话密钥。
- [Logjam](https://ssl.sh/zh/glossary/logjam/): Logjam 是 2015 年公布的攻击（CVE-2015-4000），可把 TLS 降级到 512 位出口级 Diffie-Hellman，并威胁使用过小或被大量共用 DH 参数的服务器。
- [Diffie-Hellman](https://ssl.sh/zh/glossary/diffie-hellman/): Diffie-Hellman 是 1976 年提出的密钥协商方法，让通信双方在公开信道上各自算出相同的共享秘密，而无需传输这个秘密本身。
- [降级攻击](https://ssl.sh/zh/glossary/downgrade-attack/): 降级攻击是指攻击者迫使客户端和服务器协商出比双方实际支持的更旧的协议版本或更弱的算法，从而利用其中的弱点。
- [密码套件](https://ssl.sh/zh/glossary/cipher-suite/): 密码套件是 TLS 客户端和服务器协商使用的一组命名的加密算法组合，例如 TLS_AES_128_GCM_SHA256，决定连接用什么算法保护数据。
- [密钥长度](https://ssl.sh/zh/glossary/key-size/): 密钥长度是密钥的位数，其安全含义取决于算法，例如 256 位的 ECDSA 密钥比 2048 位的 RSA 密钥更强。