I've factored the RSA keys of a Certificate Authority from the 90s
summary
Early web security standards were often lax, allowing the use of 512-bit RSA keys that are now trivial to factor on modern consumer hardware. By extracting root certificates from archived legacy browsers, it is possible to recover private keys for defunct Certificate Authorities. This demonstrates how cryptographic strength evolves and why outdated standards must be deprecated to prevent unauthorized certificate issuance.
key points
- The author used CADO-NFS on a modern desktop to factor 512-bit RSA keys from the E-Certify CA in roughly 30 hours per key.
- Recovering these private keys allows for the creation of certificates that legacy browsers like Netscape 4.51 still trust, provided the system clock is set to the past.
- The process involved using LLMs to extract certificates from archived installers and building a custom Go-based TLS server to handle outdated protocol versions.
who should read it
Security enthusiasts, cryptography students, and historians of the web who are interested in the practical application of RSA factoring and legacy system vulnerabilities.
discussion positive
consensus
Commenters generally agree that early web security was fundamentally flawed, specifically regarding government-mandated export-grade encryption which was intentionally weakened for NSA surveillance. There is a shared nostalgia for the Netscape era, coupled with a technical acknowledgment that modern libraries have correctly dropped support for these ancient, insecure protocols. Discussions also reflect a broader skepticism toward the Certificate Authority (CA) system, with some arguing it is an inefficient 'grift' compared to DNS-based alternatives.
top insight
A former Netscape product manager reveals that the company was under severe financial pressure to monetize root certificate slots during the 4.5x release, while simultaneously resisting Verisign's attempts to restrict the root list to a small group of 'responsible' companies. This adds a critical business context to the technical history of root certificates and the competitive dynamics of the early web.
Generated by an LLM from the article and thread. Check the sources before relying on it.