New RSA Signature Forgery Attack Outpaces Factoring

RSA signature forgery attack has just been demonstrated at a scale that overturns a long-standing assumption about the cryptosystem's strength. For decades, the security of RSA rested on a single premise: to forge a signature, you first had to factor the key. That premise is now gone. A team of researchers has shown that valid RSA signatures can be produced without ever recovering the private key, and the computational effort required is orders of magnitude smaller than factoring the same modulus.

The Assumption That Just Cracked

Cryptographers have long treated RSA's difficulty as equivalent to the difficulty of factoring large integers. If you could not factor the key, you could not compute a valid signature. That equivalence anchored everything from TLS certificates to code signing. Nadia Heninger, a professor at the University of California at San Diego and a co-author of the work, explained the old thinking plainly: the only way to compute valid RSA digital signatures was to first compute the private key by factoring, then use that key to sign. For 1024-bit RSA, that was considered expensive but probably doable for large tech companies or the NSA, on the order of tens of millions of dollars of computation time for a single key. For 2048-bit RSA, it was thought to be totally out of reach.

Not anymore. The forgery attack Heninger and her colleagues devised is fully practical now for 1024-bit RSA. Even for 2048- and 4096-bit keys, the method reduces RSA's security to levels that standards bodies consider unacceptable.

How the Forgery Actually Works

The technique implements a variant of the number field sieve algorithm invented in 2007. But this "special" number field sieve is paired with an oracle, a property of certain cryptographic protocols that answers queries about inputs, and by performing a massive number of operations, an attacker gathers enough information to produce a valid signature without ever factoring the key. It's simple. They don't factor. We've got the facts. So the attacker can't produce a valid signature without that oracle, and it's the sheer number of operations, not any weakness in the key itself, that makes this work.

The results are stark. Factoring a 1024-bit key requires an estimated 2^80 operations and between 500,000 and 1 million CPU core-years. Using the sieve to forge a signature took just 2^65 operations and 1,380 core-years. That is not a marginal improvement. It is a different class of attack.

The security levels drop accordingly. The National Security Agency, the National Institute of Standards and Technology, and the European Union Agency for Network and Information Security require any cryptosystem to provide no less than 128 bits of security, meaning operations must exceed 2^128. The forgery attack drops these levels to 2^65, 2^90, and 2^119 for 1024-, 2048-, and 4096-bit keys respectively. Those numbers may fall further. Heninger's team did all the coding by hand and used no AI or GPUs. She said these tools will "very likely" lower the security levels even more.

If this result holds up under peer review, it would truly be a conceptual breakthrough. That's the claim. RSA is as difficult to break as it is to factor large integers, or at least that's what we've always thought, and it's a belief that has shaped cryptography for decades. But the researcher suggests something else. You can practically break RSA without cracking its key.

Karsten Nohl, head of innovation at Allurity

Where the Risk Actually Lands

Here is the part that keeps this from being a five-alarm emergency. The attack works only against blind-signature implementations of RSA. The overwhelming majority of RSA in use today provides PKCS or PSS padding, a format that adds data to the plaintext before encryption. That padding prevents ciphertext from being deterministic and makes it less vulnerable to side-channel and similar attacks. This technique does not appear to pose a practical threat against RSA with PKCS or PSS padding, because those schemes provide a different type of oracle.

Some real-world systems still use blind-signature RSA. It's also known as textbook RSA. And the best-known example, according to Heninger, is Privacy Pass, a protocol that lets users authenticate without revealing their identity, which is a pretty remarkable trick when you stop to think about what it's actually doing under the hood. Apple uses it. Cloudflare uses it too. So do many others.

An attack on Privacy Pass would require an attacker to request 2^43 tokens from Cloudflare, Apple, or another organization. That's a lot. Heninger said that requirement "sounds [like] a lot, but is on the same order of magnitude of the network traffic that Cloudflare has said publicly it handles in about a day." So it's not as impossible as it sounds. Most Privacy Pass implementations rotate keys regularly, a measure that greatly reduces, though does not automatically eliminate, the chances of attacker success, which means they're constantly changing the locks even if they can't guarantee a burglar never gets in.

Why Cryptographers Are Paying Attention

The practical threat today is limited. The conceptual threat is not. This attack introduces signature forgery as a new way to break RSA keys without factoring, and it does so while cutting the required computing resources by orders of magnitude. The research has taken cryptographers by surprise because it severs the link between breaking RSA and factoring integers, a link that underpinned decades of security analysis.

• Factoring a 1024-bit key: roughly 2^80 operations, 500,000 to 1 million CPU core-years.
• Forging a signature with the sieve: 2^65 operations, 1,380 core-years.
• Security level after the attack: 2^65 for 1024-bit, 2^90 for 2048-bit, 2^119 for 4096-bit.
• Standards bodies require at least 2^128.

Cryptographers have worked furiously in recent years. They're trying to devise alternative cryptosystems that don't fall to quantum computing attacks. Estimates for practical quantum computing range from 3 to 20 or more years. But this new RSA signature forgery attack adds pressure from a different direction entirely, one that doesn't require quantum hardware at all, and it will further increase the urgency of moving away from RSA completely. It's a real problem. We can't ignore it.

The threat isn't real. Not yet, anyway. The paper's authors and other researchers stress that the new attack poses little real-world threat, at least for now, though they're quick to note that this calm assessment comes with an expiration date nobody can currently read. But it does drastically lower the estimated security of RSA. And it does so in a way no one knew of previously, a fact that sits uncomfortably with everyone who's spent decades trusting those numbers. The lead author is Laura Shea, also with the University of California at San Diego.