I've factored the RSA keys of a Certificate Authority from the 90s
512 points
• 6 days ago
• Article
Link
RSA 密码学的安全性建立在对大半素数（semiprime numbers）进行因式分解的数学难度之上。虽然现代网络在很大程度上已迁移到至少 2048-bit 的 RSA，但公钥基础设施（Public Key Infrastructure）早期缺乏严格标准。在 1990 年代中后期，由于当时普遍存在的加密出口限制（encryption export restrictions），像 Netscape Navigator 和 Internet Explorer 这样的浏览器内置的根证书使用了 512-bit 的密钥，这些密钥现在可以在现代消费级硬件上轻易被分解。
为了验证这一漏洞，可以恢复这些过时证书颁发机构（certificate authorities）的私钥。通过检索旧版浏览器安装程序的存档，可以提取出曾被默认信任的原始根证书。借助像 CADO-NFS 这样的工具，在普通台式机处理器上，这些 512-bit 密钥大约可以在一到两天内被分解。这个过程直观地显示了密码学标准进步的速度：当年作为网络安全基石的密钥如今在计算上已经不堪一击。
除了因式分解的理论演示外，实际测试这些密钥需要专门环境。现代 TLS 实现不再支持 90 年代后期使用的过时协议，因此要复活这些密钥，需要自定义服务器实现（server implementations），以便与像 Netscape 4.51 这样的旧软件通信。搭建这样的服务器可以签发在老浏览器看来有效的证书，从而揭示长期废弃的安全基础设施所带来的风险。
归根结底，这些发现提醒我们早期数字安全的脆弱性。虽然 E-Certify 和早期的 VeriSign 根证书早已从信任存储（trust stores）中移除，但这些密钥的存在及其易于因式分解的事实说明了行业为何转向更大密钥长度并主动弃用旧标准。尽管如今它们更多是一种有趣的技术好奇心，但它们凸显了在计算能力不断提升的情况下，保持安全标准更新的重要性。
The security of RSA cryptography is rooted in the mathematical difficulty of factoring large semiprime numbers. While the modern web has largely migrated to at least 2048-bit RSA, the early days of Public Key Infrastructure were characterized by a lack of rigorous standards. During the mid-to-late 1990s, when encryption export restrictions were prevalent, browsers like Netscape Navigator and Internet Explorer shipped with root certificates that utilized 512-bit keys, which are now easily factorable on modern consumer hardware.
To explore this vulnerability, it is possible to recover the private keys of these outdated certificate authorities. By utilizing archives of old browser installers, one can extract the original root certificates that were once trusted by default. Using tools like CADO-NFS on a standard desktop processor, these 512-bit keys can be factored in approximately one to two days. This process effectively demonstrates how rapidly cryptographic standards have evolved, as keys that were once foundational to early web security are now computationally trivial to compromise.
Beyond the theoretical exercise of factoring, testing these keys requires a specialized environment. Modern TLS stacks do not support the obsolete protocols used in the late 90s, so reviving these keys requires custom server implementations that can communicate with vintage software like Netscape 4.51. By constructing such a server, it is possible to issue certificates that appear valid to old browsers, illustrating the risks associated with long-deprecated security infrastructure.
Ultimately, these findings serve as a reminder of the fragility of early digital security. While the E-Certify and early VeriSign roots have long been removed from trust stores, the existence of these keys and their ease of factorization highlight why the industry has moved toward much larger key sizes and proactive deprecation. While they represent a fun technical curiosity today, they underscore the critical importance of keeping security standards current against the inevitable advance of computing power.
129 comments • Comments Link
- Modern Go 标准库刻意去除了对 SSLv3 和过时的出口级密码套件等老旧协议的支持，因此需要与 Netscape Communicator 4.51 等历史软件互通的项目不得不自行实现这些协议。
- 部署传统的加密服务器本身就存在很大风险，即便在隔离的虚拟环境中也是如此；而像 OpenSSL 这样的现代工具通常需要大量非标准的重编译才能支持这些过时的安全标准。
- 在数字"复古考古"工作中，常用自定义的极简 TLS 实现，让现代用户无需修改客户端就能与遗留系统（例如私有游戏服务器）互通。
- 依赖 LLMs 为技术项目生成可运行代码，往往会丧失对工程细节的把握；在处理复杂任务时，人类操作者更关注高层目标，而不是解释底层工程实现，这会留下隐患。
- 用现代消费级硬件因式分解 512-bit RSA 密钥几乎是微不足道的计算，但这也严肃提醒我们：缺乏临时密钥交换的历史通信存在被未来解密的风险。
- 由于存在 General Number Field Sieve 等次指数级因式分解算法，RSA 的安全性并不会随着位数线性增长，这类算法远比蛮力更高效。
- 破解 1024-bit RSA 的成本在资金充足的参与者可承受范围内，而 2048-bit 密钥在现实中仍被视为安全，破解它们需要更多时间与资源。
- 关于量子计算和 Shor's algorithm 的讨论常常忽视实现可扩展、稳定 qubit 的物理挑战；必须取得重大突破，才能对现行 RSA 标准构成可信威胁。
- 鼓励从 RSA 向 Ed25519 等现代椭圆曲线方案过渡，以避免传统非对称密钥尺寸带来的固有弱点与性能限制。
本次讨论集中在保护数字历史与支持过时安全协议之间的张力。尽管一些项目通过自定义 TLS 实现成功恢复了与 Netscape 的连通性，参与者仍对依赖 AI 生成关键安全代码而非人工工程所带来的松懈表示担忧。由此引发的更广泛讨论涵盖了 RSA 的有限安全性、政府级数据保存对未来解密的风险，以及向现代加密原语过渡以确保长期数字安全的必要性。 • Modern Go standard libraries intentionally omit support for legacy protocols like SSLv3 and archaic export-grade cipher suites, necessitating custom implementations for projects involving historical software like Netscape Communicator 4.51.
• Deploying legacy cryptographic servers is inherently dangerous, even in isolated virtual environments, and contemporary tools like OpenSSL often require significant, non-standard recompilation to support outdated security standards.
• Custom, minimalist TLS implementations are frequently employed in digital "retro-archeology" to allow modern users to interact with legacy systems, such as private gaming servers, without requiring client-side modifications.
• The reliance on LLMs to generate functional code for technical projects often results in a loss of granular authorial insight, as the model handles complex tasks while the human operator prioritizes high-level outcomes over explaining the underlying engineering.
• Factoring a 512-bit RSA key is a computationally trivial task with modern consumer hardware, yet it serves as a stark reminder of the security risks associated with historical traffic that lacked ephemeral key exchanges.
• The security of RSA does not scale linearly with bit length because of sub-exponential factoring algorithms like the General Number Field Sieve, which are far more efficient than brute force.
• Estimates for cracking 1024-bit RSA fall within the reach of well-funded actors, whereas 2048-bit keys remain practically secure, requiring vastly more time and resources to compromise.
• Discussions regarding quantum computing and Shor's algorithm often ignore the physical realities of stable qubit scaling, which must advance significantly to pose a credible threat to current RSA standards.
• The transition from RSA to modern elliptic curve alternatives like Ed25519 is encouraged to avoid the inherent vulnerabilities and performance limitations associated with legacy asymmetric key sizes.
The discussion centers on the tension between preserving digital history and the practical dangers of supporting obsolete security protocols. While the project at hand successfully revived legacy Netscape connectivity through a custom TLS implementation, participants expressed concern over the "slop" generated by relying on AI for critical security code rather than manual engineering. This technical challenge serves as a gateway to broader debates about the finite security of RSA, the risks of government-level data retention for future decryption, and the necessity of moving toward modern cryptographic primitives to ensure long-term digital safety.