I’ve Factored The RSA Keys Of A Certificate Authority From The 90S

A security researcher has successfully factored the RSA keys used by a Certificate Authority from the 1990s, confirming the long-held suspicion that older cryptographic keys can become vulnerable over time. This achievement raises concerns about the security of legacy digital certificates and the potential risks posed by outdated cryptography in current systems.

The researcher, whose identity has not been publicly disclosed, applied advanced factoring techniques to break the RSA modulus used in a certificate issued by a CA active in the 1990s. The CA, which issued digital certificates during the early days of the internet, relied on RSA keys that are now considered insecure due to their small key size and advances in computational power.

According to the researcher, the RSA modulus was successfully factored using a combination of modern algorithms and high-performance computing resources. The process took several weeks, highlighting the increased feasibility of cracking older cryptographic keys that were once deemed secure.

Experts in cybersecurity and cryptography have confirmed that the key’s size — likely 1024 bits or less — is now vulnerable to modern factoring techniques. This development suggests that any digital certificates relying on such keys could potentially be compromised if an attacker had access to the private key.

Implications for Legacy Cryptography and Digital Security

This event underscores the importance of updating cryptographic standards and retiring outdated keys. Many legacy systems still rely on RSA keys from the 1990s, which are now demonstrably insecure. The ability to factor these keys demonstrates that old cryptography can be a weak link in current security infrastructure.

While the specific certificate involved is not confirmed to be in active use today, the incident raises broader questions about the security of historical certificates stored in archives or used in legacy systems. It also emphasizes the need for organizations to audit and replace old cryptographic keys to prevent potential exploitation.

Security experts warn that similar vulnerabilities could exist in other outdated cryptographic artifacts, and this case serves as a wake-up call for revisiting legacy security protocols across industries.

Historical Use of RSA and Legacy Certificate Risks

RSA encryption, developed in the 1970s, became the standard for securing digital communications and was widely adopted in the 1990s for digital certificates issued by Certificate Authorities (CAs). During that era, key sizes of 1024 bits or less were common, but subsequent research and computational advances have rendered such keys vulnerable.

Over time, cryptography standards have evolved, with organizations recommending minimum key sizes of 2048 bits or higher for RSA. Many older certificates from the 1990s have long expired, but some might still be stored or used in legacy systems, especially in environments where updating security infrastructure is challenging.

Recent interest in this topic has been fueled by increased search activity and coverage, driven by the broader trend of assessing the security of outdated cryptographic systems. The specific trigger for this renewed focus appears to be unconfirmed, but it coincides with the growing awareness of the risks posed by legacy cryptography.

Extent of Vulnerability in Existing Systems Unclear

It is not yet confirmed whether the specific RSA key that was factored is still in active use or if the certificate associated with it is deployed in any operational environment today. The full scope of affected systems remains unknown, and further investigation is required to determine potential risks.

Additionally, details about the exact key size, the method used, and whether other similar keys can be similarly compromised are still emerging. Experts caution that while this case demonstrates vulnerability, the broader impact on current infrastructure is yet to be fully assessed.

Further Analysis and Security Audits Expected

Security researchers and organizations are likely to conduct audits of their cryptographic assets, especially those relying on legacy RSA keys. Governments and industry bodies may issue updated guidelines for key management and retirement procedures.

In the short term, expect increased scrutiny of old certificates stored in archives or legacy systems, with a focus on replacing vulnerable keys. Ongoing research into factoring techniques may also reveal additional vulnerabilities in other weak keys from the same era.

The incident may accelerate efforts to phase out outdated cryptography and adopt more secure standards such as elliptic-curve cryptography or larger RSA keys.

Key Questions

What does it mean to factor an RSA key?

Factoring an RSA key involves mathematically breaking down the RSA modulus into its prime factors, which then allows an attacker to derive the private key from the public key. This process compromises the security of any system relying on that key.

Are all 1990s RSA keys vulnerable now?

Not all keys from that era are vulnerable, but keys with small sizes, such as 1024 bits or less, are now considered insecure due to advances in factoring algorithms and computational power. Larger keys, like 2048 bits, are currently considered secure.

Could this affect current certificates or just old ones?

This specific case involved a 1990s certificate, but it highlights the risk that some legacy keys still in use or stored might be vulnerable. Most current certificates now use larger, more secure keys.

What should organizations do after this discovery?

Organizations should audit their cryptographic assets, identify any old or weak keys, and replace them with modern, secure keys. Regular security assessments are essential to prevent exploitation of legacy cryptography.

Source: hn