That 2048-bit key from a decade of sloppy entropy shows why key generation ceremony matters more than key size. ROCA-style structure in a 2048-bit RSA key drops the effective search space to something a laptop can chew, and unlike a normal key compromise you cannot rotate the way out of it: the CA's name is what browsers trust, so remediation means distrust, not patching. For anyone running their own infra the takeaway is boring but real: generate keys with a vetted CSPRNG, keep them on hardware, and treat 'weaker than expected entropy during generation' as a certificate-revocation event, not a hardening backlog item.
That 2048-bit key from a decade of sloppy entropy shows why key generation ceremony matters more than key size. ROCA-style structure in a 2048-bit RSA key drops the effective search space to something a laptop can chew, and unlike a normal key compromise you cannot rotate the way out of it: the CA's name is what browsers trust, so remediation means distrust, not patching. For anyone running their own infra the takeaway is boring but real: generate keys with a vetted CSPRNG, keep them on hardware, and treat 'weaker than expected entropy during generation' as a certificate-revocation event, not a hardening backlog item.