New RSA Signature Forgery Attack Cuts 1024-Bit Security to 2^65

RSA signature forgery attack is no longer a theoretical worry confined to quantum computing timelines. Researchers have demonstrated a classical computing method that forges RSA signatures without factoring the underlying key, and it cuts the effective security of widely deployed key sizes to levels that make cryptographers uncomfortable.

What the Attack Actually Does

The breakthrough centers on a technique that bypasses the long-held assumption that breaking RSA requires factoring large integers. For decades, the security of the cryptosystem rested on that equivalence. To forge a signature, an attacker supposedly had to first derive the private key by factoring the public modulus, then use that key to sign arbitrary messages.

Nadia Heninger is a professor at the University of California at San Diego and a co-author of the work. She explained the shift plainly. Cryptographers believed the only path to a valid signature ran through factoring. And that belief shaped everything. For 1024-bit keys, that was thought to cost tens of millions of dollars in computation time for a single key, a figure that, at the time, seemed to put any practical attack far beyond the reach of anyone but the most determined and best-funded adversaries. For 2048-bit keys, it was considered entirely out of reach. They're not wrong to have thought so. It's still out of reach.

The new method discards that path. Instead of factoring, it exploits a variant of the number field sieve algorithm invented in 2007, combined with an oracle property present in certain cryptographic protocols. By querying that oracle repeatedly, an attacker gathers enough information to decipher the ciphertext and produce a forged signature.

"RSA is as difficult to break as it is to factor large integers, at least so we thought. The researcher suggests that you can practically break RSA without cracking its key."

That assessment comes from Karsten Nohl. He's a cryptography expert and head of innovation at Allurity. He called the result a conceptual breakthrough, though it's conditional on peer review, and that condition matters because the claim still has to survive that scrutiny before anyone treats it as settled.

The Numbers That Matter

The security levels drop fast. The National Security Agency, National Institute of Standards and Technology, and European Union Agency for Network and Information Security all require cryptosystems to provide at least 128 bits of security, meaning operations must exceed 2^128. This RSA signature forgery attack pulls those levels down to 2^65 for 1024-bit keys, 2^90 for 2048-bit keys, and 2^119 for 4096-bit keys.

Those figures could fall further. Heninger's team wrote all the code by hand and used no AI or GPUs. She said those tools will almost surely push the security levels lower still.

The practical demonstration is stark. Factoring a 1024-bit key would demand an estimated 2^80 operations and between 500,000 and 1 million CPU core-years. Forging a signature through the sieve took 2^65 operations and 1,380 core-years. On an academic CPU cluster, the attack ran for a handful of months.

Who Is Actually at Risk

Not everyone running RSA needs to panic. The attack works only against blind-signature implementations, sometimes called textbook RSA. The overwhelming majority of RSA deployments use PKCS or PSS padding, which adds data to the plaintext before encryption, prevents deterministic ciphertext, and blunts side-channel attacks. Those implementations appear safe from this technique because they present a different type of oracle.

Some real-world systems still rely on blind signatures, and one stands out.

Privacy Pass is a protocol. It lets users authenticate without revealing who they are. Apple and Cloudflare use it, among many others. Heninger called it the best-known example of blind-signature RSA in production, a protocol that hides identity while still proving you're allowed in, and it's the one everyone points to when they talk about this kind of cryptography actually running at scale. Attacking it wouldn't be simple. You'd need to request 2^43 tokens. That's from Cloudflare, Apple, or another organization. And they don't hand those out for free.

That sounds like a lot. Heninger acknowledged that, but she noted it sits on the same order of magnitude as the network traffic Cloudflare has said publicly it handles in about a day, which is a comparison that puts the figure in a context people can actually weigh. Most Privacy Pass implementations rotate keys regularly. So the odds of success drop greatly. They don't vanish, though.

Why Cryptographers Are Paying Attention

The real-world threat today is limited. The paper's authors and outside researchers say as much. But the result drastically lowers the estimated security of RSA in a manner nobody had previously identified, and that matters for planning and procurement decisions across the industry.

• 1024-bit RSA is now fully practical to forge, not merely theoretically vulnerable.
• 2048-bit and 4096-bit keys see security reduced to unacceptable levels under the 128-bit threshold.
• The attack requires no quantum computer, only classical hardware and a vulnerable protocol implementation.

Cryptographers have spent years racing to build alternative cryptosystems immune to quantum attacks, and they've done it because RSA, the workhorse of modern encryption, can't survive a quantum computer powerful enough to run Shor's algorithm. This finding adds urgency to that migration. The timeline just got shorter. And the reason has nothing to do with qubits.

The Takeaway

If an organization still runs blind-signature RSA anywhere in its stack, that code deserves a hard look. But for everyone else on PKCS or PSS padding, the RSA signature forgery attack is a warning shot about assumptions rather than an immediate breach. It's not a breach. The assumption that breaking RSA requires factoring, an idea that shaped how countless teams have reasoned about their cryptographic defenses for years, is now officially dead. And we've got to sit with that.