Searching for The Prime Suspect: How Heartbleed Leaked Private Keys

This post details the technical analysis of the Heartbleed vulnerability, specifically how it exposed private SSL keys by allowing attackers to extract prime numbers used in RSA encryption. It explains the underlying RSA and Montgomery Reduction algorithms, and through memory instrumentation, demonstrates how OpenSSL versions vulnerable to Heartbleed left copies of these prime numbers in memory. The post also contributes proposed patches to OpenSSL to address these memory management issues, enhancing the security of SSL/TLS implementations.