Privacy Pass (Product): news timeline & CVEs

Researchers Found a New Way to Break RSA that Doesn’t Require Factoring the Key

Researchers demonstrated an oracle-assisted eNFS attack that forges 1,024-bit RSA signatures without factoring the modulus.

Researchers including Nadia Heninger and Emmanuel Thomé implemented eNFS, an oracle-assisted number-field-sieve method that can forge RSA signatures or decrypt ciphertexts without recovering the prime factors or private key. Their 1,024-bit demonstration used about 1,380 CPU core-years over five months and 232 queries to a raw unpadded RSA oracle, compared with an estimated 500,000 to one million core-years to factor the modulus. After a public-key precomputation, offline forgery costs about another 180 core-years. The attack needs temporary raw exponentiation access, such as certain PKCS#11 HSM operations or blind-signature protocols like Privacy Pass, and does not by itself break PKCS#1 v1.5 or RSA-PSS.

Cyber Security NewsSep 24, 17:48 UTC · 2d agoResearch 2 sources

There's a new way to break RSA that's faster than anything we've seen before

A new sieve-based forgery attack lowers textbook RSA security to 2^65 for 1024-bit keys.

Researchers including Nadia Heninger describe a special number-field-sieve forgery attack against blind-signature, or textbook, RSA. Estimated work drops to 2^65, 2^90, and 2^119 operations for 1024-, 2048-, and 4096-bit keys; a 1024-bit forgery took about 1,380 core-years versus an estimated 2^80 operations to factor such a key. PKCS and PSS padding remove the oracle, so most deployed RSA is unaffected. Privacy Pass, used by Apple and Cloudflare, still uses blind signatures, but an attack would need a compromised issuer and about 2^43 signatures, and keys are often rotated. The authors say the result poses little immediate real-world threat.

Ars Technica · Securityupdated Sep 24, 17:48 UTC · 2d agofirst Sep 24, 11:15 UTC · 2d agoResearch 2 sources

Privacy Pass

Timeline2 articles

Appears with

Researchers Found a New Way to Break RSA that Doesn’t Require Factoring the Key

There's a new way to break RSA that's faster than anything we've seen before