TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published Nov. 8–9 describes a way to encode a protest message in the public-key portion of an RSA certificate. The author says the key can still function, but the report is a demonstration and does not establish a weakness in certificate authorities or the RSA system generally.
A report published Nov. 8–9 describes how to place a readable protest message inside the RSA public key carried by a website certificate, while still constructing a matching private key for use with the certificate. The demonstration, posted by Maurycy on maurycyz.com, criticizes certificate-management practices; it does not show that the certificate authority’s signature was forged or that other parties’ keys were compromised.
The author says the method starts with a pair of prime numbers used to form the RSA modulus, the central number in the public key. Rather than choose an arbitrary message and then try to generate a key around it, the process modifies bytes in the modulus so that part of its Base64 representation contains readable text. The author then adjusts the second prime so the resulting modulus can be factored into a usable pair of primes and a corresponding private key can be generated.
The published example’s certificate text contains phrases criticizing key selection and certificate authorities. The report says the certificate was issued through Let’s Encrypt and includes a command-line example for retrieving and inspecting it. The certificate data shown in the post lists a validity period from Nov. 9, 2026, to Feb. 7, 2027. The source does not independently establish how the issuing authority reviewed the key or whether the certificate remains active.
The author also says the certificate authority used for the experiment requires the conventional RSA public exponent, 65,537, limiting which key fields could carry the message. The report focuses on modifying the modulus instead. It notes that Base64 represents bytes in groups of three, so the text may require placement adjustments to appear legibly in the encoded certificate.
A Message Inside the Public Key
The demonstration draws attention to the difference between a certificate’s visible contents and the assurances that its issuance is meant to provide. A public key is normally treated as mathematical data used to secure a connection. The report shows that its encoded form can also carry text, making a certificate an unusual place for a protest message that can be inspected by anyone who retrieves it.
The security implication described is limited. The author’s method depends on retaining the private key corresponding to the published public key. It does not, on the information supplied, enable an outsider to decrypt traffic or impersonate another website. The practical concern would be the strength and handling of the key itself: if a private key were weak or exposed, a certificate’s presence would not make the connection safe. The report does not provide evidence that the demonstrated key was broken or that users’ data was intercepted.
For website operators, the piece is also a reminder that certificate issuance and certificate maintenance are separate operational tasks. A certificate can be validly signed and still raise questions about how its key was generated. At the same time, a single protest example is not evidence that the broader certificate system routinely accepts insecure keys. The report’s example should be read as a critique and technical demonstration, not as a general audit of certificate authorities.
Products Worth Considering
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
DJI Mini 3 Drone with DJI RC and 3-Axis Mechanical Gimbal
Amazon Kindle Scribe (3rd Generation), 64GB, 11-inch Display, Graphite, with Premium Pen
As an affiliate, we earn on qualifying purchases.
RSA Keys and Certificate Issuance
RSA public keys contain a modulus and a public exponent. The modulus is produced from two prime factors; the private key relies on knowing those factors. The report uses that relationship to encode text in the modulus while adjusting the factorization so the author can still derive the private key. The public exponent, commonly 65,537, is not the field used for the message in this example.
Website certificates bind a domain name to a public key and are signed by a certificate authority. The source author criticizes the operational burden of obtaining and renewing certificates through ACME and argues that encryption can be useful even while objecting to certificate practices. The report’s described workflow uses a certificate request and manual validation. It does not establish that all certificates are issued over plaintext, nor does the supplied material document the broader claim about an authority using the number four as a key. That claim appears in the author’s protest text and should not be treated as independently verified here.
“The best choice is a protest certificate.”
— Maurycy, author of the report
Questions About Key Strength
The supplied report does not provide an independent cryptographic review of the generated key, the certificate request, or the certificate authority’s validation process. It also does not establish whether the certificate is currently being served, whether the key has been tested against attacks, or whether any users faced a security risk. The author’s criticism of certificate-authority practices, including the reference to a key value of four, is not independently substantiated in the material provided.
The excerpt ends while describing adjustments to make the encoded message readable, so it does not include the complete final explanation of how placement was selected. No response from Let’s Encrypt or other certificate authorities is included. Those gaps mean the demonstration’s exact operational details and any wider implications remain unverified.
Independent Review Would Clarify
The next useful step would be independent verification of the certificate and its public key, including confirmation that the reported certificate was issued as described and that the private key corresponds to it. A cryptographic review could assess the key’s effective strength without treating the embedded text alone as proof of a vulnerability. The source material provides no announced follow-up, response from the certificate authority, or scheduled review, so it is unclear whether further findings will be published.
Key Questions
What is the reported trick?
The report describes modifying the RSA modulus so its Base64 representation includes readable text, then adjusting the prime factors so the author can construct a matching private key.
Does the demonstration show that RSA is broken?
No. The supplied report describes a way to encode text in a public key. It does not show that RSA encryption was broken, that traffic was decrypted, or that another party’s key was compromised.
Was the certificate issued by Let’s Encrypt?
The author says the certificate was obtained through Let’s Encrypt and includes certificate data and a command for retrieving it. The supplied material does not include independent confirmation from the certificate authority.
Could the embedded message make a website unsafe?
The message itself does not establish that a connection is unsafe. Security depends in part on the private key’s strength and protection. The report does not establish that the demonstrated key was broken or that users’ data was exposed.
Source: maurycyz.com
