A write-up circulating on technical forums describes factoring the RSA keys of a certificate authority that operated in the 1990s. The specifics are unverified, but the underlying principle is not: key sizes considered safe then are breakable now.
Key takeaways
- Factoring an RSA key means recovering the secret prime numbers from the public modulus, which allows the private key to be reconstructed without any intrusion into a system.
- Certificate authority keys issued in the 1990s were often far shorter than modern minimums, partly because of export restrictions and partly because of the computing costs of the era.
- A key that was economically unbreakable when it was generated can become breakable decades later without anything about the key itself changing.
- Most root certificates from that period have long since expired or been removed from browser and operating system trust stores, which limits the practical damage.
- The durable lesson concerns cryptographic agility: systems that cannot rotate keys or retire algorithms accumulate risk that only grows with time.
What is actually being claimed here
The claim, as it appears in the discussion, is that the RSA key material of a certificate authority active in the 1990s has been factored. Factoring is the direct attack on RSA: the public key contains a large number known as the modulus, which is the product of two secret primes. Anyone who can split that number back into its prime factors can derive the corresponding private key using only public information. No server is compromised, no password is stolen and no backup tape is recovered; the mathematics simply gives way.
Several details cannot be confirmed from the material circulating publicly. It is not clear from the discussion alone which authority is involved, what method or hardware was used, how long the computation took, or whether the result has been independently reproduced. Claims of this kind are usually checkable in principle, because a factorisation can be verified in seconds by multiplying the claimed primes back together, but that verification requires the numbers to be published. Until that happens, the correct posture is to treat the specific claim as unconfirmed while recognising that the general result is entirely plausible.
Why an old certificate is drawing attention now
Nothing about a 1990s key changes over time. What changes is everything around it. The cost of computation falls steadily, factoring algorithms have improved over decades of academic work, and specialised or rented hardware is now available to individuals rather than only to institutions. A computation that would once have required a national laboratory can now be a personal project.
The result is a slow-motion category of security failure: an artefact that was genuinely secure when it was created becomes insecure without anyone touching it. Historical key material is also unusually exposed, because certificates are public by design. A certificate published in 1996 is still a certificate today, and anyone who archived it holds a complete copy of the public key. There is no way to un-publish it and no way to strengthen it retroactively.
Interest also reflects a broader current concern. Discussion of quantum computing has made the idea of “harvest now, decrypt later” familiar, and a demonstration that classical factoring has already caught up with old parameters makes that abstract worry concrete.
The background a newcomer needs
A certificate authority is an organisation that vouches for the identity behind a website or service. It does so by signing certificates with its own private key. Browsers and operating systems ship with a list of trusted authority certificates, and any certificate that traces back to one of those roots through a valid chain of signatures is accepted.
The security of that arrangement rests entirely on the authority’s private key remaining secret. Anyone holding it can sign a certificate for any name they choose, and software will accept it as genuine.
In the 1990s, key sizes were shaped by two pressures. Public key operations were expensive on the hardware of the day, and United States export rules restricted the strength of cryptography that could be shipped abroad, which pushed many products towards deliberately weakened parameters. Keys of around 512 bits were common in that environment. Modern industry rules require RSA keys of at least 2048 bits for publicly trusted certificates, and the gap between those two figures is not incremental. Each additional bit roughly doubles the search space, so the difficulty separating them is enormous.
Who is affected and how
For ordinary users of the modern web, the direct effect is close to nil. Root certificates from the 1990s have overwhelmingly expired, and trust stores have been pruned repeatedly since. Browsers now reject weak keys and obsolete signature algorithms outright, so a certificate signed with a recovered 1990s key would not be accepted by current software even if someone produced one.
The exposure lies elsewhere. Long-lived embedded and industrial equipment often carries trust stores that were fixed at manufacture and never updated. Air-gapped systems, medical and laboratory instruments, point-of-sale terminals and building control equipment can all outlive the cryptography they were shipped with. Legacy enterprise systems sometimes pin old roots deliberately to keep internal tooling working.
There is also a category that is easy to overlook: archived data and archived signatures. Documents, software packages and email signed under old keys can no longer be treated as evidence of anything, because a forged signature from a recovered key is mathematically indistinguishable from a genuine one.
Where informed people disagree
One disagreement concerns severity. One view holds that factoring an expired key from a defunct authority is a historical exercise with no live victims, and that presenting it as a security event overstates the case. The opposing view is that such demonstrations are among the few things that reliably prompt organisations to audit what their systems still trust, and that the absence of a current victim is precisely what makes the demonstration safe to publish.
A second disagreement concerns disclosure. Publishing recovered private key material for a long-dead authority is usually considered harmless and useful for verification. Others argue that any recovered key should be treated cautiously, because it is difficult to prove that no system anywhere still trusts it.
A third runs deeper, over how long any parameter choice should be trusted. Some argue for aggressive margins now, on the grounds that migration always takes longer than planned. Others argue that oversized parameters impose real costs and that the answer is not larger keys but shorter certificate lifetimes and mechanised rotation.
What this means in practice
The practical response is not about RSA specifically. It is about knowing what your systems trust and being able to change it.
That starts with an inventory. Many organisations cannot readily answer which certificates their devices trust, what key sizes are in use, or which of them are effectively unchangeable. Building that picture is unglamorous and is usually the largest part of the work.
It continues with rotation as a routine operation rather than an emergency. Where key replacement requires physical access, a firmware release or a vendor who no longer exists, that dependency is a structural problem, not a cryptographic one.
It also means treating cryptographic settings as having expiry dates. A parameter chosen because it is comfortable today should be recorded with a date and a reason, so that the choice can be revisited rather than inherited silently for twenty years.
Finally, old signatures should be re-anchored. Where archives depend on signatures made with obsolete keys, their integrity should be re-established using current algorithms rather than assumed.
What to watch next
The first thing to watch is whether the specific claim is substantiated with published numbers and independently reproduced. That is the difference between an interesting assertion and a documented result.
Beyond this instance, watch for further demonstrations against historical key material, since the same reasoning applies to a great deal of what was generated before the mid-2000s. Watch trust store maintenance in embedded and industrial products, which is where the real residual exposure sits. And watch the post-quantum migration now under way in standards bodies and major software vendors, because it is the largest test yet of whether the industry can retire a cryptographic algorithm at scale. The 1990s keys are, in that sense, a rehearsal for a much bigger problem.
Frequently asked questions
What does it mean to factor an RSA key?
An RSA public key contains a large number called the modulus, formed by multiplying two secret prime numbers. Factoring means finding those primes again. Because the private key is derived from them, anyone who succeeds can reconstruct the private key using nothing but the public certificate. The security of RSA rests entirely on that factorisation being computationally impractical for keys of sufficient size.
Are my bank and email accounts at risk from this?
Almost certainly not. Certificates from the 1990s have long since expired and have been removed from the trust stores used by current browsers and operating systems. Modern software also rejects short keys and obsolete signature algorithms regardless of who signed them. The realistic exposure is confined to old embedded equipment and legacy internal systems that still trust historical roots and cannot easily be updated.
Why were 1990s cryptographic keys so short?
Two reasons combined. Hardware of the era made public key operations slow and expensive, so smaller keys were a practical necessity. Separately, United States export controls restricted the strength of cryptography that could be shipped internationally, which pushed vendors towards deliberately limited parameters in products intended for global markets. Those constraints have long since been lifted, but the artefacts generated under them persist.
Does this mean RSA is broken?
No. RSA at current key sizes has no known practical break using classical computers. What has been demonstrated is that key sizes chosen decades ago no longer provide meaningful protection, which is expected behaviour rather than a flaw in the algorithm. The relevant question is not whether RSA works but whether the parameters chosen for a particular key are still adequate today.
How is this different from the quantum computing threat?
This is classical factoring catching up with obsolete parameters through steady improvements in hardware and algorithms. The quantum concern is different in kind: a sufficiently large quantum computer would break RSA at any practical key size, which is why replacement algorithms are being standardised rather than larger keys chosen. The two share one feature, however, in that both reward organisations that can change cryptography quickly.
What should an organisation actually do about old certificates?
Begin by inventorying what your systems trust, including embedded devices and internal tooling that may have shipped with fixed trust stores. Identify anything using short keys or obsolete algorithms, and record which of it cannot be updated, since that is where the real risk sits. Make key rotation a routine, automated operation, and re-sign archived material that depends on outdated signatures.
Sources and further reading
- Public discussion threads on technical news aggregators, where the original claim and community scrutiny of it appeared.
- Published academic literature on integer factorisation and the number field sieve, which documents how factoring records have advanced over time.
- Industry baseline requirements for publicly trusted certificates, which set current minimum key sizes and algorithm rules for certificate authorities.
- National standards body guidance on cryptographic key lengths and algorithm transition timelines, including post-quantum migration planning.
Surfaced from the hackernews signal “historical cryptographic key broken”. AI-assisted draft, editorially reviewed.
