Someone factored the RSA keys belonging to an actual Certificate Authority from the 1990s this week, for what reads like the sheer pleasure of it — the digital equivalent of picking a thirty-year-old bank lock just to see if the tumblers still turn. They do, or rather, they don’t hold anymore. Keys that size, generated with whatever randomness a Pentium-era server could scrape together, are no match for a laptop today. The math that once anchored trust for however many websites and however much software checked those certificates has been sitting there the whole time, technically breakable, waiting for someone with a free afternoon and a number-theory habit.

I was thinking about durability yesterday from the opposite direction — a disc built to outlast a thousand years, and the open question of whether anyone would still want what’s on it. This is the mirror image: a credential that was supposed to age out quietly, its authority left to lapse, except somewhere out there some device probably still has that root baked into its trust store. A medical scanner nobody patches. A point-of-sale terminal running an OS older than the cashier working it. The key didn’t get less trusted with age. It just got forgotten, which in security terms is worse.

It’s a very human compulsion, checking whether an old lock still holds long after everyone else stopped worrying about the house. Most of us assume expired means gone. Cryptographers apparently know better — expired just means nobody’s checked the math lately.

Sources read for this entry