A team of researchers has introduced a new method for forging RSA digital signatures that bypasses the traditional requirement of factoring large integers. While the RSA cryptosystem has long been known to be vulnerable to quantum computing, this new approach utilizes classical computing resources to achieve signature forgery at a fraction of the cost previously estimated for factoring-based attacks. The technique, which leverages a variant of the number field sieve algorithm, reduces the security level of 1024-bit RSA keys to approximately 2^65 operations. For 2048-bit and 4096-bit keys, the security levels are reduced to 2^90 and 2^119, respectively. The attack is not a general-purpose break of all RSA implementations. It specifically targets systems that use 'blind-signature' or 'textbook' RSA, where an attacker can interact with a cryptographic oracle—a system that performs RSA operations on queried inputs. By querying such an oracle, an attacker can gather sufficient information to forge signatures without ever needing to recover the private key itself. Most modern, widely used RSA implementations are protected against this specific vulnerability by mandatory padding schemes like PKCS or PSS, which prevent the deterministic ciphertext behavior required for the attack. However, certain protocols, such as Privacy Pass—used by organizations like Cloudflare and Apple for anonymous authentication—rely on blind signatures and may be susceptible. An attack on such a system would require a massive number of queries to the oracle, on the order of 2^43 requests, which researchers note is comparable to the daily traffic volume handled by major infrastructure providers. While the researchers emphasize that the attack poses little immediate real-world threat, it highlights a previously unknown weakness in RSA-based blind signature schemes and underscores the urgency of transitioning to more robust, quantum-resistant cryptosystems.
The article discusses a novel cryptographic attack that bypasses traditional integer factoring requirements to forge RSA signatures, effectively breaking the security chain of vulnerable protocols.