{
  "id": 6243839,
  "title": "I’ve factored the RSA keys of a Certificate Authority…from the 90s",
  "url": "https://urgent.news/2026/09/08/ive-factored-the-rsa-keys-of-a-certificate-authority-from-the-90s-6243839",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-08T04:05:34.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://mcpherrin.ca/2026/09/07/rsa.html"
  },
  "original_language": "en",
  "account": "In the early days of the World Wide Web, RSA cryptography was used to secure SSL connections, but the strength of these keys varied greatly. While the Web PKI deprecated 1024-bit RSA keys a decade ago, and even the 2048-bit keys that are currently in use may soon be obsolete due to quantum computers, some RSA keys from the 1990s were small enough to be factored on a single desktop computer.\n\nThe author of the article, intrigued by the security of RSA, decided to explore this topic further. They downloaded archives of old root certificates from Internet Explorer and Netscape and set to work extracting all the roots. After finding a target, they focused on Netscape 4.51, which shipped a 512-bit RSA certificate authority trusted for SSL and another for S/MIME.\n\nUsing the CADO-NFS algorithm on a Ryzen 9 5950X desktop, the author factored the public keys in the root certificates. It took 32 hours to factor the E-Certify RSA 512 Gold Server for SSL and another 29 hours for the E-Certify RSA 512 Gold Client for S/MIME. These factored keys can be used to reconstruct the private key and issue certificates.\n\nThe author then demonstrated how to verify the issued certificates in Netscape 4.51, despite the significant differences in TLS capabilities between this old version and modern TLS stacks. They created a custom old-timey TLS server in Go to test the functionality.\n\nThe resulting private keys and tools are available in a GitHub repository (https://github.com/mcpherrinm/ancientroots) for anyone interested in exploring further or potentially misusing the old SSL certificates.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Hacker News",
        "title": "I've factored the RSA keys of a Certificate Authority from the 90s",
        "url": "https://urgent.news/2026/09/08/ive-factored-the-rsa-keys-of-a-certificate-authority-from-the-90s",
        "published": "2026-09-08T01:16:59.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}