Andy Swift

Have seen some posts on this that contain an (understandable) misunderstanding of probability. If you use an RNG (true or pseudo), the chance of generating any number is the same as the chance of generating any other. If you ask for 2 6-digit random numbers and you get 123456 and 000000, your RNG isn't necessarily broken. As humans, we see patterns in everything. But patterns can occur by chance. The chances of generating 123123 and 111111 and 428946 are exactly the same. In fact, if an RNG never generated "pattern" numbers, it would actually be less secure than one that did. Even the quoted post is wrong when it says "Each key should be a 116-digit number, but one was just 4." Technically, the key that was "just 4" was a 384 bit number with 381 preceding zeroes. Many keys, when randomly generated, will have preceding zeroes. Many will have preceding ones. The "value" of the key is 4. The length of the key is still 384 bits. The value isn't what gives the key its strength. The key of value 2^384 - 1 isn't the strongest key, for example. However, that doesn't mean a key of value 4 isn't insecure, but it's for a very human reason. When we brute force keys, we need a starting point. While we could theoretically choose any number, we tend to just go with what is easier: starting from 0. So yes, you'd brute force one of these keys on the 5th attempt, and the others would fall soon after. But if you started from the other end of the key space, from 2^384 - 1 and decremented instead of incremented, you might also find a key on the 5th attempt. That would still be bad. You could choose an arbitrary starting point, and get lucky. That would also be bad. All said, that doesn't mean the key generation process they used was good. The fact it produced a bunch of easily brute-forceable keys is very, very, bad.