There's a new way to break RSA that's faster than anything we've seen before
A new sieve-based forgery attack lowers textbook RSA security to 2^65 for 1024-bit keys.
Researchers including Nadia Heninger describe a special number-field-sieve forgery attack against blind-signature, or textbook, RSA. Estimated work drops to 2^65, 2^90, and 2^119 operations for 1024-, 2048-, and 4096-bit keys; a 1024-bit forgery took about 1,380 core-years versus an estimated 2^80 operations to factor such a key. PKCS and PSS padding remove the oracle, so most deployed RSA is unaffected. Privacy Pass, used by Apple and Cloudflare, still uses blind signatures, but an attack would need a compromised issuer and about 2^43 signatures, and keys are often rotated. The authors say the result poses little immediate real-world threat.
- Forgery work falls to 2^65, 2^90, and 2^119 for 1024-, 2048-, and 4096-bit keys.
- Attack applies only to blind-signature RSA, not PKCS or PSS padding.
- A 1024-bit signature forgery took about 1,380 core-years.
- Privacy Pass, used by Apple and Cloudflare, still needs a compromised issuer.
- Hand-coded work used no GPUs or AI, which could cut costs further.
- Products
- Privacy Pass
- Organizations
- AppleCloudflare
From the original article
2 min read at arstechnica.com
Until now, cryptographers thought factoring was the only way to break RSA. Not anymore.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.