Suppose you have an Internet banking site based on a secure web server running the HTTPS protocol via port 443.

The server authenticates itself to clients through an X.509 certificate signed by a CA. The signature is constructed by using RSA encryption of the MD5 hash of the certificate content. The key used for the encryption is a 512-bit private key of the CA.

What is the most obvious weaknesses in such a "setup"? I thought the use of MD5 for integrity would be a weak point as MD5 has been broken. But since it's encrypted with RSA using a 512-bit private key, I guess the MD5 can't really be manipulated?


2 Answers 2


There are two big weaknesses in what you describe -- and one source of confusion.

The source of confusion is that you are talking about "encryption with the private key" which is a flawed analogy. Really, this is a digital signature. Historically, digital signatures with RSA were first explained as "encryption with the private key", but this proves only confusing because such an explanation conjures images of confidential data, which do not apply to this case. Moreover, it is wrong: standard-compliant RSA signatures (as per PKCS#1) are not "encryption with the private key".

In the situation you describe, the weakness that the examiner expects (I assume this is homework) is that MD5 is weak against collisions; this would allow an attacker to craft a pair of certificate contents, one with his name, the other with the name of the bank site, such that they both hash to the same value. He would then get a certificate for the first case (legitimately) and then use the resulting signature on the second certificate. See this page for a demonstration and a lot of explanations (read it !). The important conceptual point here is that the MD5 hash value can be predicted by the attacker since everything which enters MD5 is known -- thus, thinking about it in terms of "MD5 value was encrypted" triggers exactly the wrong ideas.

The other glaring weakness is that 512-bit RSA is weak. A 512-bit RSA key was broken back in 1999. Several other similarly-sized keys have been broken since; in one case (in 2012), this was done with open-source software and 75$ worth of rented cloud-based CPU.

  • Not homework but a question on a past exam paper :) Nevertheless, interesting that they would write "encryption with the private key" on an exam paper. It did confuse me when I read it. What's the minimum size key that would be acceptable ? 1024 or would you need to use 2048/4096 today?
    – Force444
    Commented May 26, 2014 at 18:05
  • 1
    1024 bits are not broken yet, but are within reach of current technology (not current computers, though -- you would need a specially-built machine, for which tentative blueprints exist, but no actual hardware ; it would cost a lot). Thus, many people recommend more ; for aesthetic reasons, we like powers of 2, hence we go straight to 2048 bits (which are way beyond what can be broken with Earth's resources and known factorization algorithms). Commented May 26, 2014 at 18:14
  • Why would someone opt for 1024, when 2048 and even 4096 are, as you describe, way more secure and far from being broken? What practical issues lies with using a larger key? If that question even makes sense.
    – Force444
    Commented May 26, 2014 at 18:16
  • Larger keys are more expensive (2048-bit RSA costs about 8 times more than 1024-bit RSA), and may break compatibility with deployed systems (in particular, some embedded systems may be limited to 1024 bits). For Web servers and browsers, 2048 bits should work "everywhere" (browsers which don't support 2048-bit RSA have not been updated for a decade or so, and thus are full of much more worrisome known security holes). Commented May 26, 2014 at 18:19
  • 1
    Yes, CPU usage. Though signature size may also be an important matter in some cases (RSA-2048 signatures are twice longer than RSA-1024 signatures). Commented May 26, 2014 at 18:30

The 512 bit RSA key is by far the easiest weakness to exploit in this setup.

Yes MD5 is broken in the sense that it doesn't provide collision resistance but actually turning that into a practical attack is not trivial. Doing so requires calculating distinct chosen prefix collisions and finding a CA that doesn't sufficiently randomise certificate serial numbers. This attack was demonstrated in practice but as soon as it was published the target CA changed their practices so to repeat the exploit would mean finding another CA with similarly bad practices.

OTOH 512 bit RSA is can be factored with hobbyist-level resources and this process doesn't require any interactions with a CA.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .