I’ve Factored The RSA Keys Of A Certificate Authority From The 90S

A security researcher has announced that they have successfully factored the RSA encryption keys used by a Certificate Authority from the 1990s, a discovery that could have significant implications for legacy cryptographic systems. The claim, which is currently unverified by independent experts, has sparked widespread interest among cybersecurity professionals and cryptography researchers, highlighting potential vulnerabilities in outdated encryption standards.

The researcher, whose identity has not been publicly disclosed, states that they managed to factor the RSA modulus of a CA certificate issued in the 1990s. This process involved advanced computational techniques and significant processing power, suggesting that the RSA key in question was weaker than modern standards due to its age and the computational limits of the time.

While the specific Certificate Authority has not been officially named, the claim has prompted speculation that it may be a well-known entity from the early days of internet security. Experts emphasize that RSA keys from that era often used smaller key sizes, such as 1024 bits, which are now considered insecure against modern factoring algorithms. The researcher has not yet released technical details or proof of the factorization, and independent verification is pending.

This event marks a notable moment in cryptography, as it suggests that some legacy CA certificates may be vulnerable to cryptanalytic attacks, potentially compromising the security of systems that relied on these old keys for decades. However, it remains unclear whether the researcher’s claim is fully verified or if it applies to a specific certificate or a broader class of keys from that era.

Implications for Legacy Cryptography Security

This development underscores the importance of updating cryptographic infrastructure and replacing outdated keys. If verified, it could mean that some systems still relying on 1024-bit RSA keys from the 1990s are at risk of being compromised. Although most modern systems have transitioned to larger key sizes and more secure algorithms, legacy systems may still be vulnerable, especially if they have not been upgraded.

The potential exposure of old CA keys raises questions about the long-term security of digital certificates issued decades ago. It also emphasizes the need for continuous cryptographic audits and the importance of deprecating weak encryption standards as computational power increases.

Historical Use of RSA in 1990s Certificate Authorities

During the 1990s, RSA encryption was the dominant standard for securing digital communications and establishing trust via digital certificates. Many Certificate Authorities issued SSL/TLS certificates with RSA keys typically ranging from 512 to 1024 bits, with 1024-bit keys becoming more common toward the late 1990s. At that time, computational limitations made larger keys impractical, and the security community believed these sizes were sufficient.

Over time, advancements in factoring algorithms and increased processing capabilities have rendered these smaller keys insecure. The industry has since moved toward 2048-bit and larger RSA keys, with some organizations phasing out support for older, weaker keys. Nevertheless, a significant number of legacy systems still rely on certificates issued with 1024-bit RSA keys, some of which may be vulnerable if their private keys can be factored.

The recent claim of factoring a 1990s RSA key revives concerns about the longevity and robustness of cryptographic standards used in early internet infrastructure, and whether older certificates remain a threat.

Verification and Scope of the Factorization Claim

It is not yet clear whether the researcher has provided technical proof of the factorization or if the claim applies to a specific certificate or a broader set of keys. Independent experts have not yet verified the claim, and details about the specific CA or key size remain undisclosed. The extent to which this affects current systems is still uncertain, as many legacy certificates have been replaced or are no longer in active use.

Verification, Technical Details, and Industry Response

Cryptography researchers and security organizations will likely scrutinize the claim and attempt independent verification. If confirmed, this could prompt a review of legacy certificates, especially those still in use in older systems or embedded devices. Industry standards bodies may reinforce the need to retire weak keys and enhance cryptographic protocols. Additionally, the researcher may release technical details or tools to validate the claim publicly, which could influence security practices worldwide.

Key Questions

What does factoring RSA keys mean for security?

Factoring RSA keys involves breaking down the public modulus into its prime factors, which can enable an attacker to derive the private key and compromise encrypted communications. Smaller or weaker keys are more susceptible to this process.

How old are the RSA keys involved in this claim?

The keys are reportedly from a Certificate Authority issued in the 1990s, making them approximately 30 years old or more, with typical sizes around 1024 bits or less.

Could this affect current internet security?

If the key was widely used and the claim is verified, it could mean that some legacy certificates are vulnerable. However, most modern systems now use larger, more secure keys, and many old certificates have been replaced.

Has this happened before?

Yes, there have been instances where weak RSA keys from the early internet era have been factored or compromised. This event draws renewed attention to the importance of key size and cryptographic agility.

What steps should organizations take after this claim?

Organizations should review their cryptographic assets, replace any legacy certificates with stronger keys, and ensure their systems follow current security standards to mitigate potential risks.

Source: hn