From Ars Technica · · 2m
New attack breaks RSA encryption faster than ever
Researchers discovered a signature forgery method that cracks RSA keys without factoring, reducing security by orders of magnitude.
In brief
Researchers discovered a signature forgery method that cracks RSA keys without factoring, reducing security by orders of magnitude. RSA encryption is weaker than cryptographers thought, but most real-world implementations remain safe because they use padding that blocks this specific attack. Originally reported by Ars…
RSA's hidden weakness discovered
Researchers found a new way to break RSA encryption using classical computing that doesn't require factoring the key. The method works through signature forgery, a technique cryptographers didn't know was possible.
1024-bit keys now practically breakable
Breaking a 1024-bit RSA key took just a few months on an academic computer cluster, far faster than the years previously estimated. This is still slower than current factoring methods, but dramatically more achievable.
Security levels drop dramatically
The attack reduces RSA security from 128 bits to 65 bits for 1024-bit keys, 90 bits for 2048-bit keys, and 119 bits for 4096-bit keys. These levels fall below standards set by the NSA, NIST, and European security agencies.
Most RSA implementations stay safe
The attack only works against blind-signature RSA, which lacks padding. Most widely used RSA systems add PKCS or PSS padding that prevents this forgery method from working.
Privacy Pass faces real risk
Privacy Pass, used by Apple and Cloudflare for anonymous authentication, relies on blind-signature RSA. An attack would require 2 to the 43rd power token requests, roughly equivalent to one day of Cloudflare's network traffic.
How the attack actually works
The technique uses a variant of the number field sieve algorithm from 2007, combined with an oracle that answers queries about encrypted data. Attackers gather enough information through massive computations to forge valid signatures.
Cryptographers surprised by breakthrough
Experts believed RSA's security was tied directly to factoring difficulty. This discovery shows RSA can be broken without factoring, reducing required computing resources by orders of magnitude.
“RSA is as difficult to break as it is to factor large integers, at least so we thought.”
Urgency to abandon RSA grows
The discovery accelerates the shift toward quantum-resistant cryptography. Cryptographers have already been working to replace RSA before quantum computers arrive, and this attack makes that transition even more critical.
The bottom line
RSA encryption is weaker than cryptographers thought, but most real-world implementations remain safe because they use padding that blocks this specific attack.
