news.volyx.in

I've factored the RSA keys of a Certificate Authority from the 90s (mcpherrin.ca)

512 points by ahlCVA · 34 days ago · 129 comments on HN

Article summary

The author factored the RSA keys of a Certificate Authority from the 1990s, specifically 512-bit keys from the now-defunct Canadian certificate authority E-Certify. This was done using a desktop computer and the CADO-NFS software. The factored keys can be used to issue certificates that would be trusted by older browsers, such as Netscape 4.51. The author notes that this highlights the vulnerability of older RSA keys and the importance of using larger, more secure keys.

Main themes

  • RSA key factoring
  • Cryptographic key security
  • TLS and encryption
  • Post-quantum cryptography
  • Computational resources and factoring
  • Key size and security margin
  • Pre-shared keys and additional security layers
  • Recorded communications and decryption risks

What commenters say

  • Factoring 1024-bit RSA keys may be feasible with significant computational resources, potentially taking around 2000 GPU-years.
  • The security margin of 2048-bit RSA keys is relatively small compared to other cryptographic algorithms, and may be vulnerable to future attacks.
  • The use of pre-shared keys as an additional layer of defense could enhance the security of TLS connections against adversaries who can break asymmetric encryption.
  • The factoring of older RSA keys has implications for the security of recorded communications, potentially allowing governments or other actors to decrypt and access sensitive information.
  • The speed of RSA encryption is a compromise between security and performance, with larger keys providing greater security but also increasing computational overhead.
  • The use of GPUs can significantly speed up the factoring of RSA keys, but even with CPUs, factoring smaller keys is feasible.
  • The vulnerability of older RSA keys to factoring attacks highlights the importance of regularly updating and rotating cryptographic keys to maintain security.
  • The potential for governments or other actors to record and store encrypted communications for later decryption is a concern, particularly for anonymous political speech or other sensitive information.