New eNFS attack forges RSA signatures without factoring the key, researchers say

Researchers including Nadia Heninger and Emmanuel Thomé demonstrated an oracle-assisted number-field-sieve attack that forges raw/blind-signature RSA signatures without factoring the modulus, cutting estimated forgery work to 2^65 for 1024-bit keys…

Two outlets reported on 2026-09-24 on new research by a team including Nadia Heninger and Emmanuel Thomé implementing eNFS, an oracle-assisted number-field-sieve method that forges RSA signatures or decrypts ciphertexts without recovering the prime factors or the private key. Estimated forgery work drops to 2^65, 2^90, and 2^119 operations for 1024-, 2048-, and 4096-bit keys respectively. The team's 1024-bit demonstration consumed about 1,380 CPU core-years over five months and used 232 queries to a raw, unpadded RSA oracle; after a public-key precomputation, each offline forgery costs roughly another 180 core-years. Ars Technica compares this to an estimated 2^80 operations to factor a 1024-bit key, while Cyber Security News puts factoring the modulus at an estimated 500,000 to one million core-years. The attack requires temporary access to a raw exponentiation oracle — such as certain PKCS#11 HSM operations or blind-signature protocols like Privacy Pass — so it does not by itself break PKCS#1 v1.5 or RSA-PSS padding, leaving most deployed RSA unaffected. Privacy Pass, used by Apple and Cloudflare, still relies on blind signatures, but an attack would require a compromised issuer and about 2^43 signatures, and its keys are often rotated. The authors state the result poses little immediate real-world threat, noting their hand-coded implementation used no GPUs or AI, which could reduce costs further.

• Estimated forgery work falls to 2^65, 2^90, and 2^119 operations for 1024-, 2048-, and 4096-bit keys.
• The 1024-bit demonstration used about 1,380 CPU core-years over five months and 232 queries to a raw unpadded RSA oracle.
• After a public-key precomputation, each offline forgery costs roughly 180 additional core-years.
• Factoring a 1024-bit RSA modulus is estimated at 500,000 to one million core-years (Cyber Security News); Ars Technica cites an estimated 2^80 operations for the same comparison.
• The eNFS attack forges signatures or decrypts ciphertexts without recovering the RSA prime factors or private key.
• The attack requires temporary access to a raw RSA exponentiation oracle, such as certain PKCS#11 HSM operations or blind-signature protocols.
• PKCS#1 v1.5 and RSA-PSS padding are not broken by this attack; most deployed RSA is unaffected.
• Privacy Pass, used by Apple and Cloudflare, still uses blind signatures, but exploiting it would require a compromised issuer and about 2^43 signatures; keys are often rotated.