Here is my understanding of FREAK (let me know if I'm right please):

1) Client wants to use modern RSA in ClientHello

2) MITM forwards Export_RSA

3) Server says ok and sends an export RSA key, signed with long-term (modern) RSA key

4) because of a bug, client isn't confused by this behavior, and uses the export_RSA key (not the modern key anymore) to send a pms secret along

5) handshake concludes with encrypted finished messages (WHICH CONTAIN A HASH/SIGNATURE OF CIPHERSUITES)

If the above is correct, why doesn't 5) prevent the FREAK ATTACK? It still takes a very long time to factor an Export Key, so the MITM attacker does not have time to break it udring the handshake?

Is the answer because servers are lazy and only use one Export_RSA key, so we can factor it, then do the MITM attack and forge 5)? If so, then this is basically the Logjam attack (apart from 3), right?

2 Answers 2


The idea of the FREAK attack is that the attacker has already factored the RSA key -- because the server uses the same RSA key pair ever and ever (generating a new RSA key pair is somewhat expensive so the server won't do that for each connection). Since the attacker, at that point, knows the RSA private key, he can hijack the connection and "fix" the Finished messages.


As per this Blog by default, web servers including Apache will generate a single export-grade RSA key when the server starts up, and will simply re-use that key for the lifetime of that server.

What this means is that you can obtain that RSA key once, factor it, and break every session you can get your 'man in the middle' mitts on until the server goes down.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .