Application to Factor
ISRG Root X1
Let's Encrypt's root certificate is protected by one 4096-bit number, n, made by multiplying two secret primes. Find either prime and you can forge certificates for most of the web. Each press below makes one attempt, using your own computer.
Demo mode: same code, but n = 13 × 17 = 221 instead of the real key, so roughly one attempt in eight should hit. Back to the real one.
You factored it.
The number below divides n exactly. Your browser has checked that p × q = n: . This result never left your computer, and a copy is saved in this browser in case the page reloads.
What to do now
- Copy both numbers and save them somewhere offline.
- Do not post them anywhere. Anyone holding them can derive the root's private key.
- Email security@letsencrypt.org and tell them you have the factors of ISRG Root X1. They will want to replace it.
- Then go and buy a lottery ticket. You are on a roll.
The target
| Subject | … |
|---|---|
| Key | … |
| Valid | … |
| Serial | … |
| SHA-256 | … |
Every value above is read by your browser from the certificate file, the one Let's Encrypt publishes. Look up this exact fingerprint on crt.sh to check it yourself.
The method
Your browser draws 512 random bytes from crypto.getRandomValues, treats them as a number r,
and computes the greatest common divisor of r and n.
If the answer is anything other than 1, it is one of the secret primes.
It is a real attempt, just a hopeless one. You'd need about 10616 presses on average. There are roughly 1080 atoms in the observable universe.