Loading story…
Researchers including Laura Shea and Nadia Heninger at the University of California San Diego demonstrated an RSA signature-forgery attack without factoring the modulus or recovering the private key. Implementing an attack first proposed in 2007 with a variant of the Number Field Sieve, the team forged signatures for a 1024-bit RSA key using approximately 1,380 CPU-years of computation over five months on an academic cluster. That is substantially below the estimated 500,000 to one million CPU-years needed to factor a comparable modulus, but the attack requires temporary access to an oracle performing unpadded private-key RSA operations.
The demonstration is not a general break of RSA or an immediate threat to most deployments. Standard PKCS#1 v1.5 and RSA-PSS signing interfaces do not supply the required raw oracle. Potential exposure includes some blind RSA signature implementations, hardware security module interfaces, and Privacy Pass deployments, although enormous query requirements and regular key rotation limit practical exploitation. The researchers estimate attack-specific security levels of approximately 90 bits for RSA-2048 and 119 bits for RSA-4096; these estimates should not be applied to RSA deployments lacking the required oracle. Security teams should review interfaces that expose raw private-key operations rather than assume all RSA signatures are affected.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A theoretical attack using a variant of the Number Field Sieve was proposed in 2007. It provided the basis for the later demonstration of RSA signature forgery without factoring the modulus.
The researchers released the complete attack implementation on GitHub. The repository's FAQ explained the attack's limitations, including its dependence on access to a raw signing oracle.
The researchers described their results in “Forging 1024-bit RSA signatures in nearly SNFS time,” explaining that the attack requires temporary access to an unpadded private-key RSA oracle and does not apply to standard PKCS#1 v1.5 or RSA-PSS signing interfaces. Under the required oracle conditions, they estimated attack-specific security levels of approximately 90 bits for 2048-bit RSA and 119 bits for 4096-bit RSA.
A team including UC San Diego researchers Laura Shea and Nadia Heninger implemented the attack and forged signatures for a 1024-bit RSA key without factoring its modulus or recovering its private key. The demonstration ran over five months on an academic CPU cluster and consumed approximately 1,380 CPU core-years of computation.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers demonstrated **eNFS**, a special number field sieve attack that converts temporary access to an unpadded, raw RSA signing or decryption oracle into an enduring offline capability to forge signatures or decrypt chosen ciphertexts. In a large-scale proof of concept against a 1,024-bit RSA key, the attack used 232 oracle queries and roughly 1,380 CPU core-years over five months—less work than estimated full modulus factorization—without factoring the modulus or extracting the private key. The attack targets textbook RSA exposed through raw PKCS#11 operations and blind-signature systems, including potentially Privacy Pass deployments. It does not apply to normally padded RSA schemes such as PKCS#1 v1.5 or RSA-PSS, and researchers assess immediate risk as low; however, organizations should eliminate unnecessary raw RSA interfaces, review HSM and signing-oracle exposure, rotate susceptible blind-signature keys more frequently, and migrate vulnerable designs to padded RSA schemes.
Sep 29, 2026
Researchers demonstrated that **remote timing attacks** against OpenSSL could recover long-term private keys from general-purpose servers, overturning the assumption that such side channels were only practical against local devices. One line of work showed that OpenSSL `0.9.7` systems using RSA without blinding—including deployments such as **Apache `mod_ssl`** and **stunnel**—leaked enough information during CRT-based decryption to extract a `1024-bit` RSA private key with roughly **1 million to 1.4 million queries** in about **two hours** under typical conditions. The leakage stemmed from timing differences tied to Montgomery extra reductions and the choice between Karatsuba and normal multiplication, and the attack was shown to work across processes, virtual machines, and routed campus networks.
Jun 29, 2026
New quantum-computing research has significantly reduced the estimated resources needed to break widely used public-key cryptography, increasing pressure on organizations still relying on **RSA-2048** and **256-bit elliptic-curve cryptography**. A 2025 Google Quantum AI preprint reported that RSA-2048 factoring could, in theory, be achieved in less than a week with fewer than **1 million noisy qubits**, down roughly **20×** from earlier estimates, by combining techniques such as approximate residue arithmetic, yoked surface-code storage, and magic state cultivation. Separate reporting also described architectural work that could cut the hardware needed for RSA-2048 attacks by about **tenfold**, reinforcing the trend that algorithmic and engineering advances are shrinking the gap between theory and practical cryptanalytic capability. A 2026 paper on the elliptic-curve discrete logarithm problem similarly reduced the logical-qubit footprint for Shor-based attacks, estimating that a **256-bit prime-field curve** could be targeted with about **1,333 logical qubits**, down from **2,124** in a prior low-width design. Commentary on the new results highlighted an additional Caltech advance in lower-overhead fault tolerance and argued that, taken together, these developments could bring quantum attacks against systems such as **Bitcoin signatures** closer than previously expected, with some estimates dropping from millions of physical qubits to around **25,000** under favorable assumptions. While the work remains theoretical and depends on future fault-tolerant hardware, the direction of travel is clear: advances in quantum algorithms and error correction are accelerating the case for migration to **post-quantum cryptography**.
Jun 29, 2026