Until now, cryptographers thought factoring was the only way to break RSA. Not anymore.<\/h5>\n\n\n\n
By Dan Goodin<\/p>\n\n\n\n The world has known for decades that the RSA cryptosystem<\/a>\u2019s days are numbered. Once quantum computing becomes practical (estimates for that range from 3 to 20 or more years), the foundational security it provides will crumble. New research has revealed a novel method that uses classical computing to reduce the current RSA security level to an unacceptably low threshold.<\/p>\n\n\n\n The practical risk is limited, but still significant. Applying the attack against the deprecated use of 1024-bit keys took a handful of months on an academic CPU cluster, significantly less than the current estimates for 1024-bit factoring that would require resources that only nations or companies with massive resources could achieve. Widely used RSA implementations are also safe.<\/p>\n\n\n\n Nonetheless, the research has taken cryptographers by surprise because it introduces signature forgery, a new way to break RSA keys without factoring. Equally important, this novel method reduces the required computing resources by orders of magnitude.<\/p>\n\n\n\n \u201cIf this result holds up under peer review, it would indeed be a conceptual break-through,\u201d Karsten Nohl, a cryptography expert and the head of innovation at Allurity, said in an interview. \u201cRSA is as difficult to break as it is to factor large integers, at least so we thought. The researcher suggests that you can practically break RSA without cracking its key.\u201d<\/p>\n\n\n\n Nadia Heninger, a University of California at San Diego professor and co-author, elaborated:<\/p>\n\n\n\n Cryptographers thought that the only way to compute valid RSA digital signatures was to first compute the private key by factoring, and then use the private key to compute the signatures. For 1024-bit RSA, this was thought to be very expensive, albeit probably doable if you have the computational resources of the large tech companies or the NSA\u2014on the order of tens of millions of dollars of computation time for a single key. For 2048-bit RSA, it was thought to be totally out of reach.<\/p>\n<\/blockquote>\n\n\n\n The key forgery attack<\/a> Heninger and the other researchers devised is fully practical now for 1024-bit RSA. Even for 2048- and 4096-bit keys, the method reduces the security of RSA to unacceptable levels. The National Security Agency, National Institute of Standards and Technology<\/a>, and European Union Agency for Network and Information Security<\/a> require that any cryptosystem should provide a level of no less than 128 or more bits, meaning the operations required must exceed 2128<\/sup>.<\/p>\n\n\n\n The forgery attack drops these levels to 265<\/sup>, 290<\/sup>, and 2119<\/sup> for 1024-, 2048-, and 4096-bit keys respectively. These levels may further drop because Heninger\u2019s team did all the coding by hand and used no AI or GPUs in performing the forgeries. The researcher said these tools will \u201calmost certainly\u201d drop the security levels further.<\/p>\n\n\n\n The attack works only against blind-signature<\/a> implementations of RSA. The overwhelming majority of RSA in use today provides PKCS or PSS padding, a format that adds data to the plaintext before it\u2019s encrypted. It prevents ciphertext from being deterministic and makes it less vulnerable to side channel and similar attacks. Still, some real-world systems continue to use blind-signature, also known as textbook, RSA. The best-known example, Heninger said, is Privacy Pass<\/a>, a protocol that allows users to authenticate themselves without revealing their identity. Privacy Pass is used by both Apple and Cloudflare, among many others.<\/p>\n\n\n\n An attack on Privacy Pass would require an attacker to request 243<\/sup> tokens from Cloudflare, Apple, or another organization.<\/p>\n\n\n\n An attack on Privacy Pass would require an attacker to request tokens from Cloudflare, Apple, or another organization 2^43 times.<\/p>\n\n\n\n Heninger said the requirement \u201csounds [like] a lot, but is on the same order of magnitude of the network traffic that Cloudflare has said publicly it handles in about a day.\u201d Most Privacy Pass implementations rotate keys regularly, a measure that greatly reduces, but doesn\u2019t automatically eliminate, the chances of attacker success.<\/p>\n\n\n\n The technique implements a variant of the number field sieve algorithm that was invented<\/a> in 2007. This \u201c\u2018special\u2019 number field sieve\u201d is used with an \u201coracle\u201d, a property of some cryptographic protocols that gives answers to queried inputs. By performing a massive number of operations, attackers can gather enough information to decipher the ciphertext. (This technique doesn\u2019t appear to pose a practical threat against RSA with PKCS or PSS padding, because they provide a different type of oracle..) While factoring a 1024-bit key requires an estimated 280<\/sup> operations and 500,000 to 1 million CPU core-years, using the sieve to forge a signature took just (as noted earlier) 265<\/sup> operations and 1,380 core-years.<\/p>\n\n\n\n The paper\u2019s authors and other researchers stress that the new attack poses little real-world threat, at least for now. It does, however, drastically lower the estimated security of RSA, and it does so in a way no one knew of previously.<\/p>\n\n\n\n Cryptographers have worked furiously in recent years to devise alternative cryptosystems that aren\u2019t vulnerable to quantum computing attacks. The new attack will further increase the urgency of completely moving away from the cryptosystem. The paper authors provide an easier-to-digest explainer here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Something to be aware of if you’re using Privacy Pass in use by Apple and Cloudflare. https:\/\/arstechnica.com\/security\/2026\/09\/theres-a-new-way-to-break-rsa-thats-faster-than-anything-weve-seen-before\/ Until now, cryptographers thought factoring was the only way to break RSA. Not anymore. By Dan Goodin The world has known for decades that the RSA cryptosystem\u2019s days are numbered. Once quantum computing becomes practical (estimates for that […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-18900","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18900","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=18900"}],"version-history":[{"count":1,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18900\/revisions"}],"predecessor-version":[{"id":18901,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18900\/revisions\/18901"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=18900"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=18900"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=18900"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"A](\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2026\/09\/breaking-digital-chain-1152x648.jpg\")
Out of reach no more<\/h2>\n\n\n\n
\n