TECH Signal 486
Matthew McPherrin factors 512-bit RSA keys of 1990s E-Certify Certificate Authority
↗
Illustration only Photo by Georg Bommeli on Unsplash
The author used a desktop CPU to factor two 512-bit RSA root certificates from the defunct E-Certify CA, exposing their private keys after 32- and 29-hour computations.
It shows that RSA keys as small as 512 bits can still be broken on commodity hardware, confirming that early web PKI roots are insecure. While modern browsers no longer trust such roots, an attacker could theoretically forge certificates for legacy software that still accepts them, illustrating the importance of key-size policies and deprecation of old roots.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Two 512-bit RSA root certificates from the 1999 E-Certify CA were factored on a Ryzen 9 5950X in 32 hours and 29 hours respectively.
The resulting private keys allow creation of certificates that would be accepted by Netscape 4.51, which still trusts those roots.
Modern TLS stacks no longer support these keys, so the exploit is limited to obsolete browsers, but it demonstrates the risk of small RSA keys.
THE READ
What the cluster adds up to.
The author located archived root certificates from Netscape 4.51 and identified two 512-bit RSA keys belonging to the now-defunct Canadian CA E-Certify. Using the CADO-NFS factoring program on a Ryzen 9 5950X desktop, the RSA-155 key for the SSL root was broken in 32 hours and the S/MIME root in 29 hours. The private keys were then reconstructed and published, proving that the keys can be recovered with modest resources.
The computational cost was limited to a single high-end consumer CPU and roughly a day and a half of runtime, with no need for a large cluster or specialized hardware. The author also relied on publicly available archives from archive.org and a Claude-generated list of old roots, showing that the required data is easily obtainable. The software stack consisted of open-source CADO-NFS and a custom Go TLS server to test the forged certificates.
With the recovered private keys, the author could issue certificates that Netscape 4.51 would accept, provided the browser’s clock is set before the roots expired in October 2003. However, no modern browser or TLS library supports these 512-bit roots, so the attack surface is confined to legacy systems that still run Netscape or similar old software. The author notes that no real users were affected, and the demonstration required a deliberately configured virtual machine.
The work reinforces the long-standing consensus that 512-bit RSA is insecure, echoing the earlier deprecation of 1024-bit keys and the ongoing move away from RSA in favor of post-quantum algorithms. It also highlights that remnants of obsolete PKI can persist in archived software, posing a theoretical risk if such software is ever revived. The author frames the result as a curiosity rather than a widespread vulnerability, emphasizing that the practical impact is minimal today.
The original feed headline simply announced the factoring, while the article provides context about the historical lack of standards, export restrictions, and the eventual removal of the weak roots in 2002. This contrast shows that the event is more a proof-of-concept about legacy cryptography than an active security breach. For engineers, the takeaway is to ensure that any retained legacy components are audited for weak keys and removed from production environments.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER