Death to RSA keys under 1024 bits

Tomorrow Microsoft will release update 2661254 to block keys that are less than 1024 bits.

Microsoft has mentioned this since June and I covered it in one of the podcasts.  Bit strength of less than 1024 is considered insecure because it is feasible to derive the private key quickly enough to be worthwhile.   Current best practice is 2048 bit strength.

After apply this update the following problems may occur. (Source: Windows PKI Blog)


Prior to deploying the update, you should perform the following

  1. Scan your webservers to see if they are running SSL with key strength below 1024.   Your vulnerability scanner should do this for you already.   Or see if you can find a nmap script example that will do this for you.
  2. If you have an internal CA verify that all templates are greater than 1024 bit.
  3. Enable logging to find usage in activeX or software signing.

See the Windows PKI blog for details on how to do these steps.  

You should probably hold off on deploying this patch until these steps are performed.   Not only that by waiting, you get to use everyone else as a guinea pig.