Researchers find a way to break RSA without factoring the key

For decades, cryptographers believed that the only weak point of RSA encryption was factoring the key. As reported by Ars Technica, a research team led by Nadia Heninger of UC San Diego has developed a new method that overturns this assumption and can produce forged RSA signatures with far fewer computing resources.

How does the method work?

The new method uses a variant of the 'special number field sieve' algorithm described in 2007 to target a weakness (an 'oracle') in RSA and similar systems, and by performing a large number of operations it produces a valid forged signature without ever factoring the key. The attack works only on older RSA implementations known as 'blind signature' (textbook) RSA, which do not use PKCS or PSS padding; because the vast majority of RSA in use today relies on these padding methods, it is not directly affected.

Which key sizes are affected?

According to the research, the method reduces the security level of 1024, 2048 and 4096-bit RSA keys far below the 128-bit threshold that the NSA, NIST and the European Union Agency for Network and Information Security (ENISA) consider necessary. For 1024-bit keys, this makes the attack much more accessible than previously estimated; for 2048 and 4096-bit keys, the security level drops below the acceptable limit. The researchers note that the team did the calculations by hand without using AI or GPUs, and that these tools would probably lower the security level even further.

Is there a real-world risk?

Not in the short term. Carrying out the attack requires compromising a server that uses blind signatures (such as those of Apple or Cloudflare) and generating a large number of signatures; because most Privacy Pass implementations rotate their keys regularly, the risk is reduced further. The researchers and outside experts stress that the finding poses no practical threat in the short term but increases the urgency of moving from RSA to post-quantum cryptography.

What should software teams do?

• Take an inventory of services that use custom signature schemes for authentication or anonymous access; if any component uses blind-signature RSA, plan a move to PSS/PKCS padding or to elliptic-curve signatures.
• Standard TLS certificates and most web/API signing flows use PKCS or PSS padding, so they are not directly affected by this attack; the priority is custom or anonymous authentication protocols.
• For systems that need long-term data and signature security, put a post-quantum cryptography migration plan on the agenda now; this finding is a warning that adds to the urgency of that move.