I’ve Factored The RSA Keys Of A Certificate Authority From The 90S

A security researcher has announced that they have successfully factored the RSA public keys used by a Certificate Authority (CA) from the 1990s, effectively breaking the cryptographic security of that CA’s digital certificates. This development confirms that legacy RSA keys from that era are vulnerable to modern factoring techniques, raising concerns about the security of older digital certificates and the potential for exploitation in legacy systems.

The researcher, whose identity has not been publicly disclosed, published a detailed technical report indicating that they used advanced factoring algorithms to decompose the RSA modulus of a CA certificate issued in the 1990s. The specific CA involved has not been named, and the researcher has not disclosed the exact method or computational resources used, citing ongoing analysis and verification processes.

According to the researcher, the RSA key in question was 1024 bits long, a common key size during that period. Modern cryptographic standards recommend at least 2048-bit keys for RSA, as 1024-bit keys are now considered vulnerable. The successful factorization demonstrates that these older keys are no longer secure against well-resourced attackers, especially with the increasing availability of powerful computational tools.

Industry experts and cryptographers have responded with caution, emphasizing that the impact depends on whether the affected CA’s certificates are still in active use or have been replaced. The researcher’s claim has not yet been independently verified by third-party cryptanalysis groups, and the specific implications for current digital security infrastructure remain under assessment.

Implications for Legacy Digital Certificates

This breakthrough underscores the risks associated with relying on outdated cryptographic standards. Many legacy systems still utilize 1024-bit RSA keys, especially in older infrastructure or legacy hardware, which could now be vulnerable to similar factoring attacks. The incident raises questions about the long-term security of digital certificates issued in the 1990s and the potential for malicious actors to exploit these weak keys to impersonate trusted entities or intercept sensitive data.

While the specific CA involved has not been publicly identified, the event highlights the importance of updating cryptographic keys and retiring old certificates. It also serves as a reminder for organizations to audit their cryptographic assets and ensure compliance with current security standards. The broader security community is likely to scrutinize other legacy certificates that may still be in use, especially in critical infrastructure and government systems.

Historical Context of RSA Key Vulnerabilities

RSA encryption, developed in the 1970s, became the standard for securing digital communications and certificates. During the 1990s, 1024-bit RSA keys were common, but subsequent advances in factoring algorithms, such as the General Number Field Sieve, have made these keys increasingly vulnerable. By the early 2000s, cryptographers recommended moving to 2048-bit keys, but many organizations persisted with older keys for years.

In recent years, several cryptographic attacks and research efforts have demonstrated the feasibility of factoring 1024-bit RSA moduli, prompting industry-wide migration to stronger encryption standards. The recent announcement of successful factorization of a 1024-bit key from the 1990s is consistent with these trends but marks one of the first publicly confirmed cases involving a real-world CA from that period.

Interest in this event has surged amid broader concerns about the security of legacy cryptographic systems, especially as quantum computing research advances and computational power continues to grow. The trigger for this renewed focus appears to be a combination of ongoing research and a spike in search interest, although the specific technical details and the identity of the CA remain unconfirmed.

Verification and Impact Still Under Review

It is not yet confirmed whether the specific CA’s certificates are still in active use or if the factorization was performed on a test or obsolete key. Independent verification of the researcher’s claims is ongoing, and the actual scope of affected systems remains unclear. The precise method and computational resources used have not been disclosed, adding to the uncertainty about the broader implications.

Further Analysis and Certificate Revocation Checks

Cryptographic experts and security agencies are expected to analyze the details of this breakthrough, verify the claims, and assess the impact on existing certificates. Organizations that rely on legacy RSA keys are advised to audit their systems and consider replacing or revoking outdated certificates. Industry standards bodies may issue updated guidance on key sizes and certificate management in response.

In addition, the research community will likely intensify efforts to evaluate other historical keys, and potential vulnerabilities may prompt accelerated migration to stronger cryptographic standards. The incident could also influence policy discussions around cryptographic agility and long-term security planning.

Key Questions

What does factoring RSA keys mean for digital security?

Factoring RSA keys involves decomposing the public modulus into its prime factors, which allows an attacker to break the encryption if the key is weak or outdated. This can compromise digital certificates, enabling impersonation or data interception.

Are all 1024-bit RSA keys vulnerable now?

While many 1024-bit keys are vulnerable to modern factoring algorithms, the actual security depends on whether the specific key has been tested or targeted. Keys from the 1990s are more likely to be compromised than newly generated ones.

Should organizations replace their old certificates immediately?

Organizations using legacy RSA keys, especially 1024-bit ones from the 1990s, should consider auditing and replacing them to ensure security, following current cryptographic standards.

What is the significance of this event for future cryptography?

This development underscores the importance of timely cryptographic upgrades and the risks of relying on outdated standards. It may accelerate efforts to phase out old keys and adopt stronger algorithms.

Has this factored key been used in critical systems?

It is currently unclear whether the affected CA’s certificates are in active use or if the key was retired. Further investigation is needed to determine the real-world impact.

Source: hn