There's a new way to break RSA that's faster than anything we've seen before

Researchers have demonstrated a new classical attack that forges RSA signatures without factoring the key, representing a conceptual breakthrough in how RSA can be broken. The technique adapts a “special” number field sieve plus an oracle to extract enough information to produce valid signatures; the team forged signatures on 1024-bit RSA in a matter of months on an academic CPU cluster, using about 1,380 core‑years and roughly 2^65 work - vastly cheaper than the estimated ~2^80 work and 500,000-1,000,000 core‑years needed to factor a 1024‑bit key. The attack lowers RSA’s effective security to about 65, 90, and 119 bits for 1024‑, 2048‑, and 4096‑bit keys respectively (well below the 128‑bit minimum required by NSA/NIST/EU), and the authors (lead author Laura Shea, with co‑author Nadia Heninger) note their implementation used no AI or GPUs so costs should fall further with optimized tooling.

Practical risk is limited but real: the method targets blind‑signature (textbook) RSA, not common PKCS or PSS‑padded RSA, so most deployed RSA is unchanged. A notable vulnerable system is Privacy Pass (used by Cloudflare and Apple); exploiting it would require about 2^43 token requests - within the scale of large providers’ daily traffic - and key rotation reduces exposure. The work accelerates the urgency to finish migrating away from RSA and to adopt more robust, post‑quantum‑resistant schemes.