I’ve factored the RSA keys of a Certificate Authority from the 90s

我破解了 90 年代某证书颁发机构的 RSA 密钥

I’ve been thinking about the security of RSA lately. RSA’s cryptography relies on the difficulty of factoring a large semiprime number, but what “large” means is an interesting question. The Web PKI deprecated 1024-bit RSA over a decade ago, and while I don’t know of anyone factoring a key of that size, it’s within the realm of possibility for a government or other organization with a large number of computers. Just a few days ago, someone factored the 862-bit RSA-260 key from the RSA factoring challenge. That’s the largest factorization I’m aware of.

最近我一直在思考 RSA 的安全性。RSA 加密技术依赖于对大半素数进行因数分解的难度，但“大”究竟意味着什么，是一个有趣的问题。Web PKI（公钥基础设施）在十多年前就已经弃用了 1024 位的 RSA，虽然我不知道目前有谁能破解该长度的密钥，但这对于政府或其他拥有大量计算资源的组织来说，并非完全不可能。就在几天前，有人破解了 RSA 因数分解挑战赛中的 862 位 RSA-260 密钥。这是我所知的最大规模的因数分解。

Today, the world uses RSA of at least 2048 bits, but even that will be deprecated soon with the risk of quantum computers in the future. This led me to wonder: small RSA keys can be factored on even a modest desktop computer. And in the early days of the Web PKI, there were no standards, and no minimum requirements. Netscape shipped SSL support in 1994, and IE shortly afterwards. This was still the era of export restrictions on cryptography. Are there any keys small enough that I can factor? I don’t have any good reason to do that, but it seems like fun.

如今，全球至少使用 2048 位的 RSA，但随着未来量子计算机带来的风险，即使是这个长度也很快会被弃用。这让我产生了一个疑问：小型的 RSA 密钥甚至可以在普通的台式机上被破解。在 Web PKI 的早期，没有任何标准，也没有最低要求。Netscape 在 1994 年推出了 SSL 支持，IE 紧随其后。那还是加密技术出口受限的时代。有没有足够小的密钥可以让我破解呢？我并没有什么正当理由去做这件事，但这看起来很有趣。

The spoiler is of course, yes, but first we need to find a key to crack. Fortunately, root certificates were shipped with browser installers, and there are archives of both Internet Explorer and Netscape on archive.org. The archives aren’t comprehensive, but they should provide good coverage of old root CAs. I downloaded both collections and set Claude Code on extracting all the roots. I’ve hosted a Claude-generated webpage with all those old-timey, ancient roots. While I haven’t verified this LLM output is entirely trustworthy, it looks pretty plausible.

剧透一下，答案当然是肯定的，但首先我们需要找到一个可以破解的密钥。幸运的是，根证书是随浏览器安装程序一起发布的，archive.org 上有 Internet Explorer 和 Netscape 的存档。这些存档虽然不全面，但应该涵盖了大部分旧的根证书颁发机构（CA）。我下载了这两个合集，并让 Claude Code 提取了所有的根证书。我托管了一个由 Claude 生成的网页，上面列出了所有那些古老的根证书。虽然我没有验证这个大模型输出的内容是否完全可信，但看起来相当靠谱。

Using the filters on that site, we can find what small keys are trusted for SSL. Aha! We have a target. Back in March 1999, Netscape 4.51 shipped a 512-bit RSA certificate authority trusted for SSL, and another for S/MIME. These two roots were both from the long-defunct Canadian certificate authority called E-Certify. Later that year, the 512-bit RSA-155 was factored, so even in its era this was too weak and probably shouldn’t have shipped in the first place. The E-Certify 512-bit roots were removed by Netscape in 2002.

通过该网站的过滤器，我们可以找到哪些小密钥被 SSL 所信任。哈！我们找到了目标。早在 1999 年 3 月，Netscape 4.51 发布了一个用于 SSL 的 512 位 RSA 证书颁发机构，以及另一个用于 S/MIME 的证书。这两个根证书都来自一家早已倒闭的加拿大证书颁发机构 E-Certify。同年晚些时候，512 位的 RSA-155 被破解，所以即使在那个时代，这种强度也太弱了，当初可能就不应该发布。E-Certify 的 512 位根证书在 2002 年被 Netscape 移除。

Unfortunately, Internet Explorer seems to have never shipped any 512-bit roots for SSL, so our fun will be limited to Netscape from a relatively small time frame. Factoring the public keys in the root certificates will give me the two primes that I need to reconstruct the private key. I ran CADO-NFS on my Ryzen 9 5950X desktop; it took 32 hours to factor E-Certify RSA 512 Gold Server for SSL, and another 29 hours for E-Certify RSA 512 Gold Client for S/MIME. You can get the resulting private keys below.

遗憾的是，Internet Explorer 似乎从未发布过任何用于 SSL 的 512 位根证书，所以我们的乐趣仅限于特定时间段内的 Netscape。对根证书中的公钥进行因数分解，就能得到我重建私钥所需的两个素数。我在我的 Ryzen 9 5950X 台式机上运行了 CADO-NFS；破解用于 SSL 的 E-Certify RSA 512 Gold Server 花了 32 小时，破解用于 S/MIME 的 E-Certify RSA 512 Gold Client 又花了 29 小时。你可以在下方获取破解出的私钥。

Once you’ve installed CADO-NFS following its instructions, running it is easy. You need to get the modulus to factor from the cert, which can be done with a bit of python… [Code omitted for brevity] … Assuming you’re somehow running Netscape 4.51 with a clock set before E-Certify roots expired on 2003-10-16, you can use these private keys to issue certificates. This describes zero people on the planet… except for this VM I set up.

一旦你按照说明安装了 CADO-NFS，运行它就很简单了。你需要从证书中获取要分解的模数，这可以通过一点 Python 代码完成……（代码略）……假设你以某种方式运行了 Netscape 4.51，并将系统时间设置在 E-Certify 根证书于 2003 年 10 月 16 日过期之前，你就可以使用这些私钥来签发证书。地球上没有任何人会这么做……除了我设置的这台虚拟机。

Verifying that the issued certificates would work in Netscape 4.51 was an adventure in itself, as there is zero overlap in TLS capability between Netscape 4.51 and any modern TLS stack. So it was back to Claude Code to make a custom old-timey TLS server in Go. This site is publicly hosted at e-certify.fly.dev, which you are welcome to try out with your own copy of Netscape, but it won’t load in any modern browser. Or, if you’d like to host your own website using these old-timey keys, the keys and tools are all in the repo at https://github.com/mcpherrinm/ancientroots.

验证签发的证书是否能在 Netscape 4.51 中工作本身就是一场冒险，因为 Netscape 4.51 和任何现代 TLS 栈之间在 TLS 能力上完全没有交集。所以我又回到了 Claude Code，用 Go 语言编写了一个自定义的复古 TLS 服务器。该网站已公开托管在 e-certify.fly.dev，欢迎你用自己的 Netscape 副本进行尝试，但它无法在任何现代浏览器中加载。或者，如果你想使用这些古老的密钥托管自己的网站，密钥和工具都在仓库 https://github.com/mcpherrinm/ancientroots 中。