New RSA Attack Skips Factoring, Shocks Cryptographers
Original: There's a new way to break RSA that's faster than anything we've seen before
Why This Matters
Signature forgery without factoring opens RSA to classical attacks decades earlier than expected.
Researchers have found a classical-computing method to forge RSA signatures without factoring keys, reducing 2048-bit RSA security to just 2^90 operations — far below the accepted 128-bit minimum threshold.
A research team led by UC San Diego's Nadia Heninger has published a novel attack on RSA that bypasses the assumption cryptographers held for decades: that breaking RSA requires factoring the private key first. The method targets blind-signature implementations and can forge valid RSA signatures without ever computing the private key.
For 1024-bit RSA — already deprecated but still in use — the attack ran to completion on an academic CPU cluster in a matter of months. That compares favorably to current 1024-bit factoring estimates, which demand resources on par with nation-states or major tech companies, costing tens of millions of dollars per key. For 2048- and 4096-bit keys, the security levels drop to 2^90 and 2^119 respectively — well below the 2^128 minimum mandated by the NSA, NIST, and ENISA.
The team performed all computation by hand, using no GPUs or AI assistance. Heninger noted those tools would 'almost certainly' push the security levels even lower.
Cryptographer Karsten Nohl of Allurity called it a 'conceptual breakthrough' if peer review holds. The practical blast radius is currently limited: most RSA deployments use PKCS or PSS padding, which are not vulnerable. Still, the attack rewrites a core assumption about RSA's security model.