Signature Forgery Attack Breaks RSA Without Factoring Its Keys

The technique, which the researchers call signature forgery, exploits what the paper describes as a gap in current RSA-type security assumptions. Heninger argues that gap "gives classical cryptanalytic evidence in favor of moving away from RSA entirely during the current post-quantum transition." The method reduces the computing resources an attacker would need by orders of magnitude and, in the authors' phrasing, brings the current RSA security level down to an unacceptably low threshold.

The practical consequences vary by key length. The National Security Agency, the National Institute of Standards and Technology and the European Union Agency for Network and Information Security require cryptosystems to provide at least 128 bits of security, meaning attacks should require more than 2**128 operations. The forgery attack drops the effective levels to 2**65 for 1024-bit keys, 2**90 for 2048-bit keys and 2**119 for 4096-bit keys.

Forging signatures on the deprecated 1024-bit keys took a handful of months on an academic CPU cluster, far less than current estimates for factoring a 1024-bit modulus, an effort that would demand resources available only to nations or to companies with massive computing power. The researchers expect the security levels to fall further: Heninger's team wrote all of its code by hand and used neither AI nor GPUs, and she said such tools will "almost certainly" reduce the levels again.

The attack applies only to blind-signature implementations of RSA, also known as textbook RSA. Widely used RSA implementations are unaffected, and some real-world systems still rely on the textbook variant.

Karsten Nohl, a cryptography expert and head of innovation at Allurity, said the finding marks a departure from long-held assumptions. "If this result holds up under peer review, it would indeed be a conceptual break-through," Nohl said in an interview. "RSA is as difficult to break as it is to factor large integers, at least so we thought." He noted that the researcher's approach suggests RSA can be broken in practice without cracking its key.

The paper's authors and other researchers stress that the new attack poses little real-world threat, and the result remains subject to peer review. It does, however, sharply lower the estimated security of textbook RSA in a way that was not previously known, and the authors say it adds urgency to efforts to move away from the cryptosystem entirely.