Loading story…
Researchers demonstrated eNFS, a special number field sieve attack that converts temporary access to an unpadded, raw RSA signing or decryption oracle into an enduring offline capability to forge signatures or decrypt chosen ciphertexts. In a large-scale proof of concept against a 1,024-bit RSA key, the attack used 232 oracle queries and roughly 1,380 CPU core-years over five months—less work than estimated full modulus factorization—without factoring the modulus or extracting the private key.
The attack targets textbook RSA exposed through raw PKCS#11 operations and blind-signature systems, including potentially Privacy Pass deployments. It does not apply to normally padded RSA schemes such as PKCS#1 v1.5 or RSA-PSS, and researchers assess immediate risk as low; however, organizations should eliminate unnecessary raw RSA interfaces, review HSM and signing-oracle exposure, rotate susceptible blind-signature keys more frequently, and migrate vulnerable designs to padded RSA schemes.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Antoine Joux, David Naccache, and Emmanuel Thomé introduced the underlying number-field-sieve-based algorithm later used in the attack.
The demonstrated 1,024-bit attack consumed 1,380 CPU core-years over five months and made 232 oracle queries, compared with an estimated 500,000 to 1 million CPU core-years to factor a 1,024-bit RSA modulus. The result applies to raw or blind-signature RSA oracle designs, not conventional RSA signatures protected by PKCS#1 v1.5 or RSA-PSS padding.
Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger, and Emmanuel Thomé implemented the first large-scale eNFS demonstration against a 1,024-bit RSA key. The attack used temporary access to an unpadded RSA signing or decryption oracle to enable offline signature forgery or chosen-ciphertext decryption without factoring the modulus or recovering the private key.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcearstechnica.com
Open sourceeprint.iacr.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers demonstrated that **remote timing attacks** against OpenSSL could recover long-term private keys from general-purpose servers, overturning the assumption that such side channels were only practical against local devices. One line of work showed that OpenSSL `0.9.7` systems using RSA without blinding—including deployments such as **Apache `mod_ssl`** and **stunnel**—leaked enough information during CRT-based decryption to extract a `1024-bit` RSA private key with roughly **1 million to 1.4 million queries** in about **two hours** under typical conditions. The leakage stemmed from timing differences tied to Montgomery extra reductions and the choice between Karatsuba and normal multiplication, and the attack was shown to work across processes, virtual machines, and routed campus networks.
Jun 29, 2026
A high-severity flaw tracked as **`CVE-2026-69247`** was disclosed in the Python **`cryptography`** package, where PKCS#7 `EnvelopedData` decryption can leak distinguishable errors and timing differences during RSA PKCS#1 v1.5 processing. The bug affects versions **44.0.0 through 49.x** and enables a classic Bleichenbacher-style oracle against `RecipientInfo` `encryptedKey` handling, potentially allowing an unauthenticated remote attacker to recover content-encryption keys and decrypt sensitive PKCS#7-protected data such as **S/MIME** messages. The exposure is most relevant to services that decrypt attacker-supplied PKCS#7 content at scale, including **S/MIME gateways, secure mail filters, and document-processing systems**. Reports say the issue stems from non-uniform error handling, early aborts, and observable timing discrepancies across invalid padding, wrong key sizes, malformed keys, and successful decryptions; **`cryptography` 50.0.0** fixes the problem by using RFC 3218-style random key substitution so failed RSA decryptions continue through symmetric decryption and reduce oracle leakage. No active exploitation has been reported, and the vulnerability is not listed in CISA's KEV catalog.
Aug 4, 2026
OpenSSL disclosed **CVE-2018-0737**, a low-severity cache-timing side channel in RSA private-key generation affecting versions before `1.0.2p` and `1.1.0i`. Three non-constant-time execution paths, including `BN_gcd`, could leak sensitive state to an attacker able to run a precisely timed cache attack on the same physical system while a key is generated, potentially allowing recovery of the newly generated RSA private key. Researchers demonstrated recovery through the `BN_gcd` path at an approximately 30% success rate across more than 10,000 cluster trials. OpenSSL incorporated fixes into `1.0.2p` and `1.1.0i`, with patches also available through upstream commits `349a41da1` and `6939eab03`. Exploitation requires stringent local or adjacent-system access and observation at the moment of key generation, limiting practical exposure; keys generated and retained in hardware security modules are not affected. Red Hat issued fixes for affected RHEL 7 and later systems and JBoss Core Services products.
Aug 29, 2026