New RSA attack forges signatures without factoring the key

Overview

Updated Sep 26

RSA's security rests on a simple bet: factoring a 1024-bit number takes 500,000 to 1 million CPU core-years. A research team just went around the bet, forging 1024-bit RSA signatures in 1,380 core-years without factoring the key at all.

The attack pairs a 2007 algorithm from Joux, Naccache, and Thomé with a temporary signing oracle—the raw RSA signing interface that exists in hardware security modules (HSMs) and blind-signature protocols like Privacy Pass. It doesn't touch standard padded RSA used in TLS and most digital signatures, but it cuts the effective security of RSA in those limited scenarios by 15 to 30 bits across common key sizes. Even 4096-bit RSA fails to reach the 128-bit security level NIST expects for its post-quantum transition.

Why it matters

Blind-signature and HSM-based RSA now provides 15-30 bits less security than assumed, dropping 4096-bit keys below the 128-bit threshold.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

1,380

CPU core-years for full 1024-bit attack

Total attack time including precomputation, versus 500,000-1,000,000 core-years to factor the same modulus.

2^32

Oracle queries made during attack

About 4.3 billion raw RSA signing queries, carried out against a hardware security module.

180

Core-years to forge one signature after precomputation

Offline phase requires no further oracle access and can be repeated at will.

2^65

Effective security of 1024-bit RSA in oracle model

Down from the 80-bit security estimate based on factoring difficulty.

15-30 bits

Reduction in RSA security estimates (1024-4096 bit)

Gap between factoring-based estimates and actual security in signing-oracle scenarios.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

People Involved

Nadia Heninger

Cryptographer and security researcher

Quoted in coverage as an independent expert on the attack's implications

Antoine Joux

Cryptographer, co-author of original 2007 algorithm

Original algorithm designer; current work validated by 2026 implementation

David Naccache

Cryptographer, co-author of original 2007 algorithm

Original algorithm designer

Emmanuel Thomé

Cryptographer, co-author of original 2007 algorithm

Original algorithm designer

Organizations Involved

International Association for Cryptologic Research

Professional organization

Published and announced the research paper

The main professional body for cryptologic researchers; hosts the ePrint archive where the attack paper was posted.

Apple

Technology company

Deploys Privacy Pass, a blind RSA protocol affected by the attack model

Uses Privacy Pass for anonymous authentication, making its RSA blind-signature infrastructure a theoretical target.

Cloudflare, Inc.

Network infrastructure company

Deploys Privacy Pass, a blind RSA protocol affected by the attack model

Uses Privacy Pass for bot detection and anonymous authentication, making its RSA blind-signature infrastructure a theoretical target.

Timeline

2007 September 2026

3 events Latest: September 25th, 2026 · 2 weeks ago

September 2026
Ars Technica covers the attack for a wider audience
Latest Media Coverage

The article explains the attack's mechanics, names Privacy Pass as the best-known affected deployment, and notes the practical threat is low for standard padded RSA.
September 25th, 2026
IACR posts paper detailing full-scale 1024-bit attack
Academic Publication

The paper, titled "Nearly SNFS-Speed Signature Forgery Sans Factoring N," reports the first public full-scale implementation: 1,380 CPU core-years, 2^32 oracle queries, and an HSM as the signing oracle.
September 22nd, 2026
2007
Joux, Naccache, Thomé publish oracle-based forgery algorithm
Academic Publication

The trio described asymptotic signature forgery via oracle access at special number field sieve speeds, without factoring the modulus. The algorithm went unimplemented at scale for 19 years.
2007

Scenarios

Blind RSA deployments announce migration away from RSA

Likely Resolves by End of 2027

Discussed by: The paper's authors, who identify blind RSA schemes as providing the exact oracle required; Ars Technica coverage naming Privacy Pass as the best-known affected protocol

Privacy Pass maintainers at Apple, Cloudflare, and other vendors announce a protocol shift away from RSA blind signatures toward post-quantum or padded alternatives. This could follow the existing NIST deprecation timeline (2030) or arrive sooner given the new security estimates. The migration influences the broader RSA-to-PQC transition already underway.

Attack extended toward 2048-bit keys or significantly improved

Unlikely Resolves by End of 2028

Discussed by: The paper's extrapolations: 2048-bit RSA estimated at 2^90 running time and 2^43 queries; 4096-bit at 2^119 and 2^57 queries

A follow-up paper on the IACR ePrint archive demonstrates the attack against a larger key size, or substantially improves the efficiency of the 1024-bit implementation. The paper's authors note their computation time should be interpreted as an upper bound and can almost certainly be improved. Practical 2048-bit attacks remain out of reach for most actors, but the extrapolation shows the gap between theoretical and practical RSA security.

Standards bodies revise RSA security strength estimates

Possible Resolves by Q2 2028

Discussed by: NIST's existing plan to deprecate RSA by 2030 and disallow by 2035; the paper's evidence that factoring-based security estimates are too optimistic in oracle models

NIST or another standards body publishes revised security strength guidance for RSA in signing-oracle scenarios (HSMs, blind signatures), reflecting the 15-30 bit reduction documented in the paper. This could accelerate existing deprecation timelines or add new warnings for specific deployment contexts. The 119-bit extrapolated security of 4096-bit RSA falls below the 128-bit threshold NIST expects for its post-quantum transition period.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

February 2017

SHAttered SHA-1 collision (2017)

Google and CWI Amsterdam found the first practical SHA-1 collision using 2^63 operations against the expected 2^80 attack cost. They identified two distinct PDFs with identical SHA-1 hashes, demonstrating that the hash's theoretical 80-bit security was not the real-world ceiling.

Then

Major browsers and certificate authorities accelerated SHA-1 removal within months; the attack cost remained high enough that SHA-1 continued briefly in legacy validation.

Now

SHAttered became the reference case for why theoretical security margins need realistic attack-cost validation. It directly fed the industry-wide push toward SHA-2 and SHA-3.

Why this matters now

Both SHAttered and the RSA attack show a known theoretical gap becoming a practical demonstration, with security estimates falling well below their nominal levels. The RSA paper's 15-30 bit reduction parallels how SHA-1's nominal 80 bits became an effective 63 in practice.

October 2017

ROCA vulnerability (2017)

Researchers broke 1024-bit RSA keys generated by Infineon's RSALib in hours, without solving the general factoring problem. The flaw was a structural weakness in key generation that made moduli factorable in polynomial time.

Then

Millions of affected devices (smart cards, TPMs, government ID systems) needed key replacement. Estonia's national ID system, which used vulnerable keys, underwent emergency rekeying.

Now

ROCA demonstrated that RSA security depends on the full implementation stack, not just key size. It helped drive the shift toward randomized key generation and side-channel-resistant designs.

Why this matters now

ROCA showed RSA could be broken via implementation weaknesses rather than raw factoring. The new oracle attack is another non-factoring path to the same end goal—signature forgery—this time exploiting protocol-level access to raw signing operations.

May 2015

Logjam attack on Diffie-Hellman (2015)

Researchers showed TLS servers using 512-bit export-grade Diffie-Hellman could be broken via a precomputation attack costing about 90 CPU core-years per prime. The precomputation was reusable across sessions, making the per-connection cost trivial.

Then

Browsers and servers rapidly disabled export-grade cipher suites. The attack affected roughly 8% of the top one million HTTPS domains at the time.

Now

Logjam coined the modern understanding of precomputation attacks: expensive one-time work that pays off per-target. It also pushed the IETF toward deprecating weak Diffie-Hellman groups entirely.

Why this matters now

The RSA attack mirrors Logjam's structure—expensive precomputation followed by cheap per-target forgery. Logjam also proved that precomputation-style attacks map cleanly from theory to practice, which is why the new paper's extrapolations are being taken seriously.