New RSA forgery breaks signatures without factoring key

TL;DR: Researchers forged 1024-bit RSA signatures without factoring the key by pairing temporary access to a raw signing oracle with a special number-field-sieve computation.

The result reframes a long-held assumption about RSA security. Ars Technica reported on Sept. 24, 2026 that a team led by Laura Shea of the University of California at San Diego had demonstrated signature forgery without first recovering a private key through factoring. The work was described by writer Dan Goodin and summarized in an IACR News item dated Sept. 22, 2026 listing Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé as contributors.

Until this demonstration, many cryptographers treated factoring a modulus as the necessary path to producing valid RSA signatures. According to Ars Technica, the new work introduces forgery as a separate path that avoids factoring altogether. Karsten Nohl, identified as a cryptography expert and head of innovation at Allurity, told the publication that the finding would represent a conceptual advance if sustained through peer review.

What the team actually did

The demonstration targeted 1024-bit RSA, a size already regarded as deprecated. Over five calendar months, the researchers expended 1,380 CPU core-years and issued 2 to the 32nd power oracle queries, according to the IACR News item. That total was dominated by precomputation. Once that phase finished, the attacker could produce a selected forgery offline at a cost of 180 core-years.

The oracle in the laboratory case was a hardware security module used as a signing device. Through black-box API interactions, the team showed it could impersonate the module without extracting the stored key. Blind RSA designs can supply a comparable oracle, the abstract states.

The method builds on a 2007 algorithm associated with Joux, Naccache and Thomé. The researchers implemented and executed that approach for a 1024-bit modulus. Their calculation ran in time near the special number field sieve, rather than the general number field sieve normally used to extrapolate RSA key-size guidance.

Why skipping factoring matters

Conventional RSA key-size guidance derives from the general number field sieve for factoring. The new forgery route tracks the special number field sieve, a faster subexponential process. Ars Technica placed the contrast in operational terms: factoring a 1024-bit key is estimated to need 2 to the 80th power operations and 500,000 to 1 million CPU core-years, while the forgery needed 2 to the 65th power operations and 1,380 core-years.

Nadia Heninger, a University of California at San Diego professor and co-author, explained the prior view in comments reported by Ars Technica. She said specialists had believed that valid signatures required first obtaining the private key by factoring, then signing with it. For 1024-bit RSA, that factoring step had been viewed as very costly but potentially within reach of large technology firms or the NSA, at a scale described as tens of millions of dollars of computation for one key. For 2048-bit RSA, she said, factoring had been viewed as completely beyond reach.

The new sequence changes that comparison for systems that expose a raw signing or decryption interface. Temporary oracle access plus the sieve computation yields lasting offline forgery capability. The private factors themselves never need to be recovered.

How much security is left in oracle-exposed RSA

The headline numbers concern security levels expressed in bits. The National Security Agency, National Institute of Standards and Technology and European Union Agency for Network and Information Security require at least 128 bits, meaning an attacker should face more than 2 to the 128th power operations, according to Ars Technica.

The forgery analysis lowers that picture for oracle-exposed RSA to 2 to the 65th power for 1024-bit keys, 2 to the 90th power for 2048-bit keys and 2 to the 119th power for 4096-bit keys. The IACR News item expresses the same shift differently, stating that concrete security with a signing oracle should be 15 to 30 bits below factoring-based estimates across 1024-bit to 4096-bit parameters. It adds that even 4096-bit RSA does not appear to satisfy a 128-bit level in this attack model.

Those figures are extrapolations from measured 1024-bit running times to larger sizes. They apply to the oracle setting, not to RSA as an abstract mathematical problem. The authors also note that refinement could push costs lower because the reported implementation was produced manually.

Hand-coded run leaves room for faster repeats

Heninger’s group performed the coding by hand and did not use AI assistance or graphics processors, Ars Technica reported. Heninger said those tools would almost certainly reduce security levels further if applied to the same workflow.

That detail is important for interpreting the 1,380 core-year total. Academic CPU clusters completed the work in months. Optimized software, accelerators or larger fleets could alter calendar time without changing the underlying mathematics. At the same time, neither source published a revised figure incorporating such optimizations. The only completed measurement available by Sept. 25 was the CPU-based run.

The researchers also separated one-time preparation from later forgeries. Because most effort sits in precomputation, a single investment can support later offline production of selected signatures at the stated 180 core-year incremental cost for 1024-bit keys.

Which deployments are exposed

The attack applies only to blind-signature implementations, also described as textbook RSA. Most RSA in current use employs PKCS or PSS padding, which adds data before encryption, avoids deterministic ciphertext and limits exposure to side-channel and related techniques, according to Ars Technica. That padding structure supplies a different kind of oracle, and the publication states the sieve technique does not appear to create a practical threat against PKCS- or PSS-padded RSA.

Some deployed systems still use blind signatures. The best-known case named by Heninger is Privacy Pass, a protocol for authentication without revealing identity. Ars Technica identifies Apple and Cloudflare among its users.

A Privacy Pass attack would require requesting 2 to the 43rd power tokens from Cloudflare, Apple or another operator. Heninger said that volume sounds large but is on the same order as traffic Cloudflare has publicly said it handles in about a day. She added that most Privacy Pass deployments rotate keys regularly, which greatly reduces but does not automatically eliminate the chance of success.

Limited immediate risk, wider standards question

The paper authors and other specialists emphasize that the immediate operational danger is small. Ars Technica states that widely used RSA implementations are safe and that the authors describe little present real-world threat. The 1024-bit target is deprecated, larger blind-signature keys still demand very large efforts, and key rotation narrows the window for token-collection attacks.

The broader point concerns security assumptions. If factoring-based estimates overstate protection whenever a raw oracle exists, standards and deployment reviews may need to treat oracle-exposed RSA separately. The IACR abstract describes a gap in current RSA-type assumptions and presents the result as classical cryptanalytic support for leaving RSA behind during the post-quantum transition.

That transition is already underway because practical quantum computing would undermine RSA foundations. Ars Technica cites estimates of three to 20 or more years for that horizon. The new work does not rely on quantum hardware. It uses classical computing to lower present estimates for a defined subset of RSA use.

What happens next

Peer review is the next filter. Nohl’s comment to Ars Technica was explicitly conditional on the result holding up under that scrutiny. The authors also published an easier-to-digest explainer linked from the Ars Technica report.

For operators, the completed facts point to inventory rather than emergency patching. The demonstrated case involved a hardware security module placed in a mode that permits raw RSA operations, plus an academic cluster and months of calculation. Systems using PKCS or PSS padding were not shown to be practically threatened. Systems still relying on 1024-bit keys, unpadded signing interfaces or long-lived blind-signature keys face the clearest reason to reassess.

The conceptual shift is therefore narrow but consequential. Factoring remains hard. Forgery without factoring, given temporary oracle access and sieve computation, is now measured rather than hypothetical for 1024-bit RSA, with extrapolated reductions for 2048-bit and 4096-bit RSA in the same setting.