一名安全研究者成功分解了加拿大证书颁发机构E-Certify的512位RSA密钥1。该密钥曾于1999年3月在网景浏览器4.51版本中被信任用于SSL连接1，另有一份512位RSA证书用于S/MIME签名1。研究者使用Ryzen 9 5950X桌面处理器和CADO-NFS软件，分别耗时32小时和29小时完成了两个密钥的分解1。
研究者构建了一个测试服务来演示这些私钥的可用性，托管地址为e-certify.fly.dev1。这一研究揭露了早期Web公钥基础设施中密钥强度的问题。网景在2002年已移除了这两个512位根证书1，而E-Certify的根证书已于2003年10月16日过期1。此前，512位RSA-155已在1999年被分解1。
A security researcher has demonstrated the vulnerability of early web infrastructure by factoring the RSA private keys of E-Certify, a Canadian Certificate Authority whose 512-bit root certificates were trusted by Netscape Navigator 4.51 in 1999.1 The researcher used a desktop-class Ryzen 9 5950X processor and the CADO-NFS software to factor two separate keys: one 512-bit certificate designated for SSL connections required 32 hours to factor, while a second 512-bit certificate used for S/MIME signing took 29 hours to complete.1
The findings underscore the cryptographic fragility of Web PKI during its early years.1 E-Certify's root certificate was trusted for SSL starting in March 1999 and remained in Netscape's certificate store until the browser vendor removed both 512-bit roots in 2002, roughly a year before the E-Certify root certificate itself expired on October 16, 2003.1 To illustrate the practical implications of the compromised keys, the researcher deployed a test service at e-certify.fly.dev capable of issuing certificates signed with the recovered private keys.1 The successful factorization adds to a historical pattern of 512-bit RSA weakness—the RSA-155 challenge had already been solved in 1999—and demonstrates how computational advances have rendered once-acceptable key lengths obsolete.1
评论
还没有评论，欢迎留下第一条。