Forging 1024-bit RSA signatures in nearly SNFS time [pdf]
Researchers implemented a 2007 algorithm to forge 1024-bit RSA signatures using an unpadded raw signing oracle without factoring the modulus, lowering practical RSA security estimates.
summary is enough The core finding and its heavy reliance on a raw, unpadded oracle fit neatly into a summary without requiring a deep read of the complex number field sieve mathematics.
summary
Researchers successfully implemented a 2007 cryptanalytic algorithm to forge 1024-bit RSA signatures without factoring the modulus, relying on temporary access to an unpadded raw signing oracle like a hardware security module. The attack required 1380 CPU core-years of precomputation and 2^32 queries, demonstrating that RSA security under oracle access is significantly lower than standard factoring estimates suggest. Extrapolating these results indicates that even 4096-bit RSA fails to meet a 128-bit security level in this model, reinforcing the need to migrate away from RSA.
key points
- The attack runs in nearly Special Number Field Sieve time by exploiting a malleability vulnerability rather than factoring the modulus.
- Executing the 1024-bit RSA attack took 1380 CPU core-years of precomputation, 2^32 oracle queries against an HSM, and 180 core-years per offline forgery.
- Extrapolations show that 2048-bit and 4096-bit RSA drop to roughly 90-bit and 119-bit security under this delayed-target oracle threat model.
who should read it
Cryptographers, security researchers, and engineers evaluating RSA parameter choices and HSM API exposures.
discussion mixed
consensus
Commenters emphasize that the attack is highly situational because it requires a raw, unpadded RSA oracle, meaning standard modern padding implementations are not vulnerable.
pushback
Some critics argue the paper overhypes the threat for non-cryptographers, as standard protocols never expose raw signing APIs in the manner required.
The most important thing to know about this work, which is awesome, is that it relies on access to a raw RSA oracle, where you have a public key and an API that allows you to directly do RSA operations with the corresponding key. The idea is that you then lose access to the oracle, and thus to the private key, but you've gained enough information from your session with the oracle to make forgeries in the future.
So it's not a straightforward general-purpose RSA-1024 signature break; it's pretty situational. The paper goes into detail (in section 5) about how those situations can emerge in …
It clearly explains the crucial constraint that the attack requires a raw, unpadded RSA API session rather than breaking standard RSA generally.
Generated by an LLM from the article and thread. Check the sources before relying on it.