Forging 1024-bit RSA signatures in nearly SNFS time

This project implements and demonstrates a variant of the number field sieve (the Joux-Naccache-Thomé approach) that uses temporary access to a raw, unpadded RSA signing/decryption oracle to permanently forge signatures and decrypt ciphertexts without factoring the RSA modulus. The technique is subexponential rather than polynomial; it exploits the special-number-field-sieve (SNFS) speedup to push the precomputation cost far below generic factoring estimates. A full 1024-bit run completed in August 2026 using about 1,380 core‑years, versus common estimates of 500,000-1,000,000 core‑years to factor a similar modulus. After the large public-key-dependent precomputation, individual forgeries become much cheaper, so temporary oracle access yields long‑term ability to impersonate the key.

The implementation is the first large-scale public run of this 2007 algorithmic idea, built on CADO‑NFS, with code, data, timings and a paper included. The attack only succeeds when a raw signing oracle is exposed (examples: blind RSA services, some HSM APIs); standard RSA signature schemes with PKCS#1v1.5 or PSS padding are not exposed. Estimated work for a 2048-bit target is about 2^90 operations and 2^43 oracle queries, which the project treats as below desirable margins but not an immediate widespread operational threat. Recommendations include retiring vulnerable blind-RSA deployments, shortening key epochs, increasing key lengths where appropriate, and accelerating migration away from legacy RSA toward elliptic‑curve or post‑quantum signatures.