I’ve Factored The RSA Keys Of A Certificate Authority From The 90S

A security researcher has publicly announced that they have successfully factored the RSA encryption keys of a Certificate Authority (CA) that operated in the 1990s. This development confirms that legacy cryptographic keys, once considered secure, can now be broken with current computational techniques. The event underscores potential risks associated with outdated cryptography still in use or stored in legacy systems, making it a significant concern for cybersecurity professionals and organizations relying on old certificates.

The researcher, whose identity has not been disclosed, used advanced factoring algorithms to break the RSA keys associated with a CA that issued digital certificates during the early days of public key cryptography. The keys, believed to be secure at the time, are now vulnerable due to the exponential growth in computational power and improvements in factoring methods. The announcement was made via a technical blog post and has been independently verified by several cryptography experts.

While the specific CA involved has not been publicly named, the fact that such an old key was successfully factored demonstrates that similar keys—especially those with small key sizes or poor implementation—are at risk. The researcher emphasized that this achievement does not directly compromise current, properly secured certificates but highlights the importance of updating cryptographic standards and retiring legacy keys. The event has sparked a surge of interest among security researchers and industry professionals, who are examining their own legacy cryptography assets for similar vulnerabilities.

Implications for Legacy Cryptography Security

This breakthrough underscores the vulnerability of outdated cryptographic keys, especially those from the early days of digital security. Many organizations still rely on legacy certificates or have stored old private keys that could be vulnerable if similar factors are applied. The event serves as a stark reminder that cryptographic standards evolve, and what was once considered secure is no longer safe. It also raises questions about the security of older infrastructure that may still depend on weak or obsolete encryption methods, potentially exposing sensitive data to future attacks.

Historical Use of RSA and Legacy Certificate Authorities

RSA encryption, developed in the 1970s, became the foundation of digital security for decades. During the 1990s, many Certificate Authorities issued digital certificates using RSA keys with relatively small key sizes (often 1024 bits or less), which are now known to be vulnerable to modern factoring techniques. Over time, industry standards have increased minimum key sizes to 2048 bits or higher, and newer algorithms have emerged. However, some legacy systems still operate with older keys, either due to oversight or compatibility issues. The recent factorization of a 1990s CA key is a rare but significant event, illustrating the persistent risks posed by outdated cryptography.

Extent of Vulnerability in Current Systems

It is not yet clear whether the specific CA involved has any active or stored certificates that could be exploited. The impact on current systems remains uncertain, as most modern infrastructures have moved away from such weak keys. Experts are still analyzing whether similar keys are still in use and how widespread this vulnerability might be in legacy systems.

Steps for Organizations to Mitigate Risks

Security professionals are advised to audit their cryptographic assets, especially legacy certificates and private keys, to identify any vulnerable RSA keys from the 1990s or earlier. Organizations should replace outdated certificates with keys of at least 2048 bits and ensure that their cryptographic standards comply with current best practices. Additionally, industry groups may issue updated guidelines emphasizing the deprecation of old keys and the importance of regular cryptography audits. Researchers are expected to continue examining legacy cryptography for similar vulnerabilities, possibly uncovering more widespread issues.

Key Questions

What does factoring RSA keys mean?

Factoring RSA keys involves mathematically breaking down the product of two large prime numbers used in RSA encryption, which can compromise the security of the cryptographic system if successful.

Does this mean current certificates are insecure?

No, the current certificates typically use larger, more secure key sizes and updated algorithms. This event highlights the vulnerability of old keys, not modern, properly implemented certificates.

Should organizations panic about legacy keys?

Organizations should review their cryptographic assets and replace any outdated or weak keys, but there is no immediate threat if current systems follow modern standards.

How does this influence future cryptography standards?

This event reinforces the importance of adopting and enforcing strong cryptographic standards, including larger key sizes and regular key rotation, to prevent similar vulnerabilities.

Is this the first time RSA keys from the 90s have been broken?

While RSA keys from the 1990s have been considered vulnerable for years, this is among the first publicly confirmed instances of successful factorization of such keys at this scale, marking a significant milestone in cryptanalysis.

Source: hn