Researcher Factors 512-bit RSA Keys From a 1999 Root CA

A security researcher spent the better part of a week feeding 27-year-old certificates into a factoring tool and came away holding the private keys to a defunct Canadian certificate authority. Matthew McPherrin published the results on his blog this morning: three 512-bit RSA keys, cracked in under 32 hours apiece on an off-the-shelf gaming desktop, all pulled from root certificates that shipped inside Netscape Navigator 4.51 back in March 1999.

None of the certificates are still trusted by anything a normal person uses today. That's not really the point. The point is what it took to break them, and how far that number has fallen since the keys were issued.

RelatedAI Agents Ran a Four-Day Breach of Taiwan's Nuclear Agency

What did McPherrin actually find?

Digging through old browser installers on the Internet Archive, McPherrin pulled the root certificate bundle out of Netscape 4.51 and wrote a small tool, with help from an LLM, to flag every root shipping a suspiciously short public key. Three roots stood out, all issued by E-Certify, a Canadian certificate authority that has not existed in any meaningful sense for two decades:

The certificates had already expired: they were valid from October 1998 to October 2003, and E-Certify itself is long gone. Internet Explorer never shipped 512-bit SSL roots at all, so the practical exposure window closed a long time before McPherrin ever opened his laptop. He used CADO-NFS, the standard open-source number field sieve implementation, running on a Ryzen 9 5950X, a chip you can still buy new.

Why was a browser ever trusting a 512-bit key?

Because for most of the 1990s, US export law required it. Software leaving the country with strong cryptography counted as a munitions export, and the rules capped exportable RSA keys at 512 bits and symmetric ciphers at 40 bits, regardless of what the domestic version of the same product used. Netscape, like every other American software vendor selling internationally, shipped a deliberately weakened "export grade" build, and root stores like the one in Navigator 4.51 inherited that ceiling. E-Certify wasn't cutting corners; it was operating inside a legal box that Washington drew.

The box was already known to be too small by the time these certificates were minted. In 1999, the same year E-Certify issued its Gold Server root, a coordinated international team spent seven months and roughly 35.7 CPU-years across 300 machines to factor RSA-155, a challenge number of the same 512-bit size, for the RSA Factoring Challenge. Bruce Schneier and other cryptographers were already telling anyone who'd listen that 512 bits belonged in the past.

How much has the bar dropped since 1999?

This is the number that should actually worry people who still think of 512-bit RSA as "old and weak, but not trivial." It's now well past trivial. The 1999 RSA-155 effort needed a coordinated international team. By 2015, during the FREAK disclosure that showed export-grade cipher suites were still being negotiated on the modern web, researchers were factoring 512-bit moduli on rented Amazon EC2 clusters in a few hours for under $100. McPherrin's result closes the loop: one person, one desktop CPU anyone can buy at a retail store, under a day and a half per key, no cloud bill at all.

1. Early-to-mid 1990sUS export law caps exportable RSA at 512 bits Netscape and other vendors ship weakened "export grade" crypto builds internationally.
2. Oct 1998E-Certify issues its 512-bit Gold roots Valid through October 2003; bundled into Netscape Navigator 4.51 the following March.
3. 1999RSA-155 factored via the RSA Factoring Challenge Same 512-bit size; took 7 months and about 35.7 CPU-years spread across 300 machines.
4. 2015FREAK disclosure shows export-grade RSA still in the wild Researchers factor 512-bit keys on rented cloud clusters in hours, for well under $100.
5. Sept 2026McPherrin factors three E-Certify/VeriSign test roots Under 32 hours per key on a single Ryzen 9 5950X, no cluster or cloud budget needed.

So does this actually put anyone at risk today?

Directly, almost no one. These three roots are expired, tied to a CA that stopped operating years ago, and were never trusted by Internet Explorer's SSL stack in the first place. Nobody's bank, inbox, or software updater is validating anything against E-Certify in 2026. McPherrin's own framing is closer to digital archaeology than incident response.

RelatedA Self-Spreading Worm Is Eating the Open-Source Supply Chain. Its Name Is Shai-Hulud.

The indirect risk is the more interesting one. Root stores are notoriously sticky. Old embedded devices, industrial control systems, medical hardware, and abandoned enterprise software have a long history of shipping with trust stores nobody has audited since the device left the factory. Any of those could, in principle, still be carrying a 512-bit root from the same export-grade era, and this technique, an LLM-assisted hunt through archived installers plus a weekend of CADO-NFS, is now something a single hobbyist can run end to end. Nobody has published a full census of which forgotten devices still trust which forgotten CAs, and that's arguably the actual gap this research points at.

Our take

The interesting part of this story was never really the danger. It's the arithmetic. A key size that needed a small international coalition and the better part of a year to break in 1999 now falls to one person's desktop before a weekend is over, with an LLM doing the tedious part of hunting for the target. Cryptographic strength is not a fixed property of a number, it's a moving target that erodes on a schedule set by hardware, not by policy, and export-grade RSA is the clearest case study available because the weakening was deliberate and the timeline is fully documented.

The practical lesson isn't "update your certificates," since these expired in 2003. It's that root stores and vendor cert bundles are graveyards nobody walks through anymore, and every few years someone with a fast enough CPU and enough curiosity proves that a few of the graves are shallower than anyone assumed.

Original analysis by GenZTech. Sources: Matthew McPherrin, IACR, CADO-NFS project.