This is the well-known CRT fault attack, nothing new. SSL implementations that don&#x27;t verify their signatures leak the private key if their signature routine has a bug - this is essentially a hardware problem. Verifying your signatures is fast, though, so doing it is worthwhile hardening (NSA can potentially use cosmic rays for this attack, probably nobody else).<p>The findings are very similar to the classic &quot;Ron was wrong, Whit is right&quot; paper - if you scan the entire Internet, you <i>will</i> find broken hardware. You will also find SSH servers with their root password being `12345678`.