Researchers broke RSA 1024-bit signatures without factoring

Summary

Researchers from UCSD and Inria Nancy demonstrated a method called eNFS that can forge RSA-1024-bit signatures without factoring the public key. It reduces the computational cost from approximately 500,000–1,000,000 CPU-years to about 1,380 CPU-years of precomputation and 180 CPU-years per forgery. The method uses only a university cluster and a commercial HSM as an oracle.

Why it matters

This result dismantles the assumption of equivalence between breaking RSA signatures and factoring the modulus. It lowers the theoretical security margin of 1024-bit keys to a level achievable by a well-resourced academic team within five months. Although NIST has already deprecated 1024-bit RSA, this finding accelerates the industry's mandatory transition to post-quantum standards like ML-KEM and ML-DSA. Furthermore, by showing that even hardware security modules can be used as oracles, it weakens the trust layer in legacy cryptographic infrastructure.

Highlights

• The attack requires only 2^32 oracle queries and then operates entirely offline; continuous access is not needed.
• Completed in 5 months on a standard university cluster; no quantum computer, GPU, or AI acceleration was used.
• A commercial HSM served as a signature oracle. This proves that 'ultra-secure' hardware can be turned into a forgery tool.

Critical take

The attack's prerequisite is temporary access to a raw, unmasked signature oracle or a blind signing service. This narrow vector is explicitly avoided by modern, correctly configured TLS stacks. Therefore, the practical impact is largely limited to legacy and misconfigured setups. Additionally, while the 1,380 CPU-year precomputation is a dramatic reduction, it remains a significant resource commitment that most non-state actors cannot realistically handle. This softens the 'imminent threat' framing.