A researcher has demonstrated that it is possible to hide vanity messages—such as jokes or text—directly within the public key of a trusted SSL certificate. By manipulating the RSA modulus (n) to include specific base64-encoded characters, a website owner can generate a certificate that remains mathematically functional enough to be signed by a Certificate Authority (CA) while displaying a hidden message to anyone inspecting the certificate's raw data.
This screenshot illustrates the technical implementation of public key tricks discussed in the research.
The Mechanism of Vanity Moduli
In the RSA cryptosystem, a public key is composed of a modulus (n) and a public exponent (e). The modulus is the product of two large prime numbers, p and q. Because the modulus is user-controlled, it can be treated as a storage space for data.
To embed a message, the researcher's method starts by picking a random prime (p) and calculating a target modulus (n) that contains the desired message in its base64 encoding. Since the resulting value is not a perfect product of p and q, the researcher calculates a new q by dividing the target n by p and rounding to the nearest prime.
This visual provides a concrete example of the code used to generate the vanity modulus.
Because p and q are similar in size, a small change to q only affects the least-significant half of the product. This ensures that if the message is embedded in the upper half of the modulus, it remains undamaged and readable.
“The resulting q value is very unlikely to be a prime (or integer), so I round it and find the next prime after the ideal q: which usually only requires changing the value of q by a few hundred.”
— Horible public key tricks:
Obtaining a Trusted Certificate
Once the vanity modulus is established, the researcher uses the resulting p and q to construct a functional RSA private key. This key can then be submitted to a Certificate Authority via a Certificate Signing Request (CSR).
This image complements the technical explanation of how the modulus is modified while maintaining functionality.
The researcher demonstrated that standard tools like OpenSSL and ACME clients (such as Certbot) can be used to obtain a valid certificate for these keys. Because the layout of a certificate is static, the message's placement can be adjusted until it is correctly aligned for base64 readability.
The result is a certificate that appears perfectly normal to a web browser but contains a hidden string of text when viewed in a certificate viewer or via a command-line tool like `openssl s_client`.
Security Trade-offs and Limitations
This technique intentionally reduces the entropy of the private key. The researcher notes that while this is a form of compression, it could theoretically make the key easier to factor if the primes p and q are too close together or if the private exponent (d) becomes too small.
However, for public websites, the risk is mitigated by modern TLS protocols. Because modern TLS provides forward secrecy, a compromise of the long-term RSA private key does not allow an attacker to decrypt past sessions; it would only facilitate a man-in-the-middle attack.
The researcher acknowledges that their generation script does not currently check for these specific insecure values, but maintains that the 'protest certificate' remains a viable way to encrypt traffic while making a statement about the complexity of the standard certificate system.