Researchers Found a New Way to Break RSA that Doesn’t Require Factoring the Key
Researchers demonstrated an oracle-assisted eNFS attack that forges 1,024-bit RSA signatures without factoring the modulus.
Researchers including Nadia Heninger and Emmanuel Thomé implemented eNFS, an oracle-assisted number-field-sieve method that can forge RSA signatures or decrypt ciphertexts without recovering the prime factors or private key. Their 1,024-bit demonstration used about 1,380 CPU core-years over five months and 232 queries to a raw unpadded RSA oracle, compared with an estimated 500,000 to one million core-years to factor the modulus. After a public-key precomputation, offline forgery costs about another 180 core-years. The attack needs temporary raw exponentiation access, such as certain PKCS#11 HSM operations or blind-signature protocols like Privacy Pass, and does not by itself break PKCS#1 v1.5 or RSA-PSS.
- eNFS forges signatures without recovering RSA factors or the private key.
- The 1,024-bit demonstration used 1,380 core-years and 232 oracle queries.
- It requires a raw unpadded RSA oracle, not standard signature padding.
- Authors estimate 2^90 work and 2^43 queries against 2,048-bit RSA.
- Products
- RSACADO-NFSPKCS#11Privacy Pass
From the original article
2 min read at cybersecuritynews.com
Security researchers have demonstrated a faster way to undermine certain RSA deployments without factoring the public modulus, challenging the assumption that RSA’s practical strength always tracks the cost of integer factorization. The attack converts temporary access to a raw, unpadded RSA signing or decryption service into a lasting capability to forge signatures or decrypt chosen […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.