Researchers demonstrate faster RSA signature forgery via subexponential-time attack

A previously known cryptographic attack against RSA has been reimplemented to forge digital signatures more efficiently than full factoring, according to a summary of the work posted on Schneier on Security. The attack is a forgery method rather than a private-key recovery technique, meaning it does not expose the private key directly.

The technique only works against pure RSA signatures—those without formatting or padding—conditions that are not typical in real-world deployments. Standard use of RSA relies on padding schemes such as PSS or PKCS#1 v1.5, which mitigate this class of attack.

The authors report that forging a signature on a 1024-bit RSA key required approximately 1,380 CPU core-years of computation, spread over about five real-world months. This is described as a subexponential-time algorithm that is somewhat faster than factoring for the same key size, but remains computationally intensive.

The foundational research dates to 2007, and the new element here is the implementation update rather than a fundamentally new cryptanalytic result. The authors maintain a webpage explaining the context and provide a link to the original paper.

Security practitioners commenting on the post emphasized that the practical risk today is limited because most systems do not use raw, unpadded RSA signatures. They nonetheless argue the result highlights the need for cryptographic agility and timely migration away from 1024-bit keys and outdated padding schemes.