A new cryptographic attack has demonstrated the ability to compromise RSA encryption through signature forgery rather than the long-assumed requirement of factoring large integers. The breakthrough method uses a specialized variant of the number field sieve algorithm, substantially reducing the computational resources necessary to forge valid RSA signatures.
The practical implications vary by key size. For 1024-bit RSA keys, researchers successfully executed the attack on an academic computing cluster over several months, requiring approximately 1,380 core-years of computation—significantly less than the estimated tens of millions of dollars and years required for traditional factoring approaches. For 2048-bit and 4096-bit keys, the method reduces security levels to 290 and 2119 bits respectively, compared to the minimum 128-bit security standard mandated by the National Security Agency, National Institute of Standards and Technology, and European Union Agency for Network and Information Security.
The vulnerability specifically targets blind-signature implementations of RSA, sometimes called textbook RSA, rather than the widely deployed PKCS or PSS padded variants used in most modern systems. Privacy Pass, a protocol employed by companies including Apple and Cloudflare for anonymous authentication, represents a notable real-world application using this vulnerable implementation. However, attacking Privacy Pass would require an adversary to request 243 tokens, a volume comparable to Cloudflare’s reported daily network traffic. Key rotation practices employed by many implementations provide additional defensive measures, though not absolute protection.
Cryptography experts characterize the discovery as conceptually significant despite limited immediate practical risk. The research introduces an entirely unexpected attack vector previously unknown to the field and demonstrates orders-of-magnitude reductions in required computational resources. Researchers note that optimization opportunities remain, as their implementation used only manual coding without artificial intelligence or GPU acceleration. The finding is expected to accelerate ongoing efforts within the cryptographic community to transition away from RSA toward quantum-resistant alternatives.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI