GoKawiilResearcher factors 512-bit RSA keys from 1990s Netscape root certificate authority
A security researcher extracted decades-old root certificates bundled with early Netscape and Internet Explorer browser installers from archive.org, using an LLM to catalog them. Among the finds was a 512-bit RSA certificate authority key shipped in Netscape 4.51 in 1999, trusted for both SSL and S/MIME, which the researcher then successfully factored using modern computing power.
GoKawiil's interpretation of the reporting above, not reported fact.
The exercise is a vivid demonstration of how cryptographic key sizes considered secure decades ago are now trivially breakable, reinforcing why standards bodies continually raise minimum key lengths as computing power grows. It also highlights the historically loose governance of early Web PKI, when browsers shipped root certificates with no consistent minimum security requirements, a gap that modern CA/Browser Forum rules were created to close.
- A 512-bit RSA root CA key from 1999, once trusted by Netscape for SSL and S/MIME, has now been factored.
- Early Web PKI lacked standardized minimum key-size requirements, unlike today's regulated Certificate Authority ecosystem.
- The findings underscore why even 1024-bit RSA is now deprecated and why the industry is preparing for quantum-resistant cryptography.
YubiKey 5 NFC Security Key — If reading about ancient RSA keys getting factored makes you side-eye your own credentials, a YubiKey 5 NFC is a great upgrade: it keeps modern private keys locked in tamper-resistant hardware instead of on disk. It supports FIDO2/WebAuthn, PIV smart card and OpenPGP, so you can use it for logins, SSH and code signing with a tap.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: mcpherrin.ca — Matthew Mcpherrin, 2026-09-08
Published there as: “I've factored the RSA keys of a Certificate Authority from the 90s”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.