Researchers demonstrate novel classical-computer attack that forges RSA signatures without factoring

Cryptographers have long assumed that breaking RSA required factoring the modulus to obtain the private key. A team of researchers has now demonstrated a novel method to forge RSA digital signatures without factoring, using classical computing resources. The attack reduces the estimated security of RSA keys across key sizes: from 2^128 for 1024-bit keys down to 2^65, from 2^192 to 2^90 for 2048-bit keys, and from 2^256 to 2^119 for 4096-bit keys.

The researchers implemented the attack using a variant of the number field sieve algorithm combined with an "oracle"—a property of certain cryptographic protocols that reveals information about queried inputs. In practice, this allowed them to forge signatures with dramatically fewer resources than previously thought possible. For 1024-bit RSA, the team estimated the attack required 1,380 CPU core-years, far below prior estimates for factoring (about 500,000 to 1 million core-years).

The method only applies to blind-signature implementations of RSA, also known as textbook RSA, which lack modern padding schemes such as PKCS#1 v1.5 or PSS. These padding schemes are widely used in practice and prevent deterministic encryption and reduce vulnerability to side-channel attacks. However, some real-world systems continue to use blind signatures, including the Privacy Pass protocol, which is used by Apple and Cloudflare to enable privacy-preserving authentication.

To exploit the vulnerability in Privacy Pass, an attacker would need to request approximately 2^43 tokens from a participating service. While this may sound infeasible, the researchers note it is on the order of the daily traffic Cloudflare has publicly reported handling. Most Privacy Pass deployments rotate keys regularly, which reduces—but does not eliminate—the risk of a successful attack.

The research team emphasized that the attack poses little immediate real-world threat to widely used RSA implementations, which rely on secure padding schemes. However, the discovery has surprised cryptographers and underscores the urgency of migrating away from RSA before quantum computing becomes practical. Experts like Karsten Nohl and Nadia Heninger described the result as a conceptual breakthrough that challenges fundamental assumptions about RSA security.

The authors performed the attack without using AI accelerators or GPUs, suggesting that further optimizations could reduce the required resources even more. They have provided an explainer and plan to release additional technical details. The work has not yet undergone formal peer review.