New RSA Signature Forgery Attack Is Faster Than Anything Seen Before

RSA signature forgery attack has just taken a leap forward that cryptographers did not see coming. A new research paper from Nadia Heninger, a professor at the University of California at San Diego, and her team shows a way to break RSA digital signatures without ever factoring the key, and it does so with orders of magnitude less computing power than anyone thought possible. The finding does not threaten everyday encrypted traffic right now. But it rewrites a core assumption that has held for decades.

The Assumption That Just Cracked

For years, the security of RSA rested on a simple belief. To forge a valid digital signature, an attacker first had to factor the public key into its two prime numbers, then use the private key to sign. That factoring step is brutally expensive. Heninger laid out the old math plainly: breaking a 1024-bit RSA key by factoring was thought to cost tens of millions of dollars in computation time for a single key, a job only large tech companies or the NSA could realistically attempt. For 2048-bit keys, it was considered flatly out of reach.

The new RSA signature forgery attack sidesteps factoring entirely. If this result holds up under peer review, it would be a conceptual breakthrough," Karsten Nohl, a cryptography expert and head of innovation at Allurity, said in an interview. "RSA is as difficult to break as it is to factor large integers, at least so we thought. The researcher suggests that you can practically break RSA without cracking its key."

That last part is the shock. You can produce signatures that verify as genuine without ever holding the private key.

How the Numbers Fall

The National Security Agency, the National Institute of Standards and Technology, and the European Union Agency for Network and Information Security all require cryptosystems to provide at least 128 bits of security, meaning an attacker needs more than 2^128 operations to break them. The forgery method drags those numbers down hard.

• 1024-bit keys drop from a 2^80 factoring cost to 2^65 operations
• 2048-bit keys land at 2^90 operations
• 4096-bit keys land at 2^119 operations

Those figures come from a team that coded everything by hand. No AI. No GPUs. Heninger said those tools will, as he put it, push the security levels lower still, with near certainty. The gap is not a rounding error. Factoring a 1024-bit key takes an estimated 500,000 to 1 million CPU core-years.

"The researcher suggests that you can practically break RSA without cracking its key."

Who Is Actually at Risk

Almost nobody, in the near term. The overwhelming majority of RSA in use today relies on PKCS or PSS padding, a format that adds data before encryption, kills the deterministic output, and blocks the kind of side channel the attack needs. Widely deployed RSA implementations are safe.

The attack does work against blind-signature RSA, also called textbook RSA, and that flavor is still alive in real systems. The best-known example, Heninger said, is Privacy Pass, a protocol that lets users authenticate without revealing their identity. Apple and Cloudflare are among its users.

To crack Privacy Pass, an attacker would need to compromise a server belonging to Cloudflare, Apple, or another organization, then generate 2^43 signatures. Heninger called that requirement "a lot, but is on the same order of magnitude of the network traffic that Cloudflare has said publicly it handles in about a day." Most Privacy Pass deployments rotate keys regularly, which cuts the odds sharply but does not erase them.

The Sieve Behind the Break

The technique builds on a variant of the number field sieve algorithm invented in 2007. This "special" number field sieve targets an oracle, a weakness in RSA and some other cryptosystems that answers yes-or-no questions about specific queries. Run enough operations and the answers pile up into enough information to decipher ciphertext.

Padding schemes eliminate that oracle. That is why they hold the line. Where the oracle survives, the mathematics bends.

Why This Lands Now

Cryptographers have spent years racing to build replacements for RSA that can survive quantum computers, with estimates for practical quantum attacks ranging from 3 to 20 or more years out. Even on that timeline, the migration is slow, expensive, and incomplete. A classical-computing shortcut does not replace that urgency. It sharpens it.

The immediate threat is close to zero for standard RSA deployments. The strategic threat is different. An RSA signature forgery attack that skips factoring removes one of the pillars the whole system leaned on, and it does so with hardware a well-funded adversary can assemble today. That is the part that has researchers unsettled. Not that RSA fell. That a wall everyone trusted turned out to have a door.