Practical pitfalls: randomness, keys, passwords and post-quantum

On 13 May 2008 Debian published security advisory DSA-1571. A Debian-specific change to its OpenSSL package, shipped since September 2006, had left the random number generator with almost nothing random in it. Keys generated with that OpenSSL on Debian, Ubuntu and their derivatives during those twenty months came from a set small enough to search exhaustively: SSH host and user keys, OpenVPN keys, DNSSEC keys and certificate keys.

AES, RSA and the protocols were all fine. The keys were guessable. Most real cryptographic failures look like this: the mathematics holds and the engineering around it does not.