A researcher cracked a 1990s CA's 512-bit RSA keys in 61 hours

Matthew McPherrin started from a simple question: how small does an RSA key have to be before it stops being out of reach for one person with one computer? Root certificate authorities used to ship inside browser installers, and archive.org keeps collections of Internet Explorer and Netscape installers, so the raw material was just sitting there. He downloaded both collections, extracted the roots, published the list on a web page — noting himself that he hasn’t fully checked that LLM-produced result — then filtered for the smallest keys marked as trusted for SSL.

Two Canadian roots nobody has missed since 2002

The target turned up quickly: Netscape 4.51, shipped in March 1999, carried two 512-bit RSA roots belonging to E-Certify, a Canadian certificate authority that disappeared long ago. One was trusted for SSL, the other for S/MIME. Internet Explorer, by contrast, never seems to have shipped a single 512-bit root for SSL, which narrows the whole exercise to one small Netscape-shaped window.

Netscape pulled those roots in 2002, and they expired on 16 October 2003. So for a certificate signed with them to be accepted, you have to run Netscape 4.51 with the clock wound back past that date — a user profile the author puts at zero people on the planet, his own test VM excepted.

Thirty-two hours, then twenty-nine

The hardware fits on one line. His detailed write-up says he pointed CADO-NFS at a Ryzen 9 5950X, a desktop chip: 32 hours to factor the SSL server root’s key, 29 hours for the S/MIME client root. Two factorisations, two pairs of primes, therefore two reconstructed private keys — published in the post and in the github.com/mcpherrinm/ancientroots repository.

What’s striking isn’t the feat. It’s how little of a feat it is. No compute farm, no budget, no clever new mathematics: free software and two and a half days of fan noise.

It was already too weak in 1999

The instructive part is that the weakness didn’t need to wait until 2026 to be demonstrated. RSA-155, also a 512-bit key, was factored during 1999 — a few months after Netscape 4.51 went out the door. A root that size probably had no business shipping in a consumer browser, even by the standards of its own decade. In its defence: those were the years of crypto export restrictions, Netscape had shipped SSL in 1994 and Internet Explorer soon after, and there was no standard and no minimum bar for getting into a trust store.

Today’s reference points sit on the same slope, one notch further along. The Web PKI deprecated RSA 1024 more than ten years ago; McPherrin knows of no public factorisation at that size, but considers it within reach of a state or any organisation with a big fleet of machines. A few days ago, the 862-bit key RSA-260 was factored, the largest he’s aware of. The current standard is 2048 bits minimum — and that one is already promised to the same fate, on account of quantum risk.

He had to rewrite a period TLS server

One last detail says everything about the distance travelled: checking that the forged certificates actually worked turned into a project of its own, because Netscape 4.51’s TLS capabilities and a modern stack overlap in precisely nothing. Hence a bespoke TLS server written in Go, publicly hosted at e-certify.fly.dev, which no browser you own will open.

A trusted root doesn’t become dangerous on the day its key falls. It already was, you just hadn’t been told. What still protects these two published keys isn’t their cryptography — it’s an expiry date in 2003, and the fact that your clock is set correctly.