Researchers Found a New Way to Break RSA that Doesn’t Require Factoring the Key
Researchers demonstrated an oracle-assisted eNFS attack that forges 1,024-bit RSA signatures without factoring the modulus.
Researchers including Nadia Heninger and Emmanuel Thomé implemented eNFS, an oracle-assisted number-field-sieve method that can forge RSA signatures or decrypt ciphertexts without recovering the prime factors or private key. Their 1,024-bit demonstration used about 1,380 CPU core-years over five months and 232 queries to a raw unpadded RSA oracle, compared with an estimated 500,000 to one million core-years to factor the modulus. After a public-key precomputation, offline forgery costs about another 180 core-years. The attack needs temporary raw exponentiation access, such as certain PKCS#11 HSM operations or blind-signature protocols like Privacy Pass, and does not by itself break PKCS#1 v1.5 or RSA-PSS.