By ByteBot
Last week, an Anthropic engineer used Claude and 2,048 GPUs to factor RSA-896 — a record. This week, researchers from UC San Diego and INRIA Nancy demonstrated something arguably more unsettling: forging RSA-1024 signatures without factoring the key at all. The paper, posted to IACR’s ePrint archive on September 20, exploits unpadded RSA signing oracles using a Special Number Field Sieve variant. The result: 1,380 CPU core-years to forge signatures permanently — versus 500,000 or more core-years just to factor the same key.
Two completely different attacks on RSA, in the same week. This is not a coincidence — it’s a trajectory.
How the RSA Signing Oracle Attack Works
Standard RSA factoring attacks go after the private key directly. This one doesn’t. Instead, the technique targets systems that perform raw, unpadded RSA operations — called a signing oracle — and exploits that access to gain permanent offline forgery capability.
The attack runs in two phases. First, the attacker sends roughly 4.29 billion (2^32) raw signature requests to the target. That sounds enormous, but against a high-traffic service like Cloudflare, it matches daily HTTP request volume. Second, using a Special Number Field Sieve variant that runs dramatically faster than factoring for properly structured RSA moduli, the attacker runs an upfront computation. After that, they can forge unlimited signatures offline — indefinitely — without ever recovering the private key. The UCSD team published their open-source implementation on GitHub under the name NSNFSSSFSFN — Nearly SNFS-Speed Signature Forgery Sans Factoring N. The mouthful title carries a direct message: you don’t have to factor the lock to pick it.
The full technical details are in the IACR preprint “Forging 1024-bit RSA signatures in nearly SNFS time” by Laura Shea, Miro Haller, Adam Suhl, and Nadia Heninger (UC San Diego) with Emmanuel Thomé (INRIA Nancy), approved September 22.
Who Is Actually Vulnerable to This Attack
Standard TLS, HTTPS, and SSH all use padded RSA — PKCS#1 v1.5 or RSA-PSS — and are unaffected. Most banking and certificate infrastructure is safe. However, unpadded RSA is more common in deployed systems than most developers realize.
Researcher Nadia Heninger confirmed that Apple’s iCloud Private Relay, Cloudflare Privacy Pass, and Apple’s Private Cloud Compute all implement 2,048-bit blind RSA without padding. An attack on these services would require query volume matching Cloudflare’s daily HTTP traffic — expensive, but within reach of a nation-state adversary. PKCS#11 hardware security modules, smart cards, USB tokens, and code-signing pipelines are also at risk wherever they permit raw RSA operations. Many legacy HSM setups enable both padded and raw mechanisms for compatibility, leaving organizations exposed without knowing it.
The security reduction is measurable: unpadded RSA is 15–30 bits weaker than factoring-based estimates across all common key sizes. RSA-2048 unpadded drops to approximately 90-bit effective security — below the 128-bit floor that NSA, NIST, and EU regulators consider the modern minimum. As Gizmodo reported, the researchers’ findings affect RSA-1024, 2048, and even 4096-bit keys in this unpadded threat model.
Related: RSA-896 Cracked with Claude: Audit Your RSA-1024 Keys Now
Three RSA Warnings in Seven Days
September 19: RSA-896 factored using Claude and GPU clusters. September 20: the forgery paper lands at IACR. September 24: EU financial, insurance, and securities regulators publish a joint warning that classical and quantum threats to cryptography are accelerating faster than previously modeled. Three independent events. One message.
Each attack in isolation gets written off as theoretical or nation-state territory. The convergence is harder to dismiss. NIST’s deadline to deprecate RSA is 2030, with disallowance by 2035 — a timeline set when RSA-1024 factoring still required an estimated million CPU core-years. A forgery attack now achieves the same result with 1,380. Privacy Guides noted on September 26 that the ongoing post-quantum migration is the right opportunity to leave RSA behind entirely — not patch it.
Key Takeaways
- Rotate any RSA-1024 keys immediately — this has been overdue for years, and this week closes the debate.
- Audit PKCS#11 configurations: if CKM_RSA_X_509 (raw RSA) is enabled on internet-accessible HSMs, disable it or enforce padding at the application layer.
- Standard TLS and padded RSA are unaffected by this specific attack — but check whether your systems use blind RSA or raw signing APIs, particularly in Privacy Pass implementations or legacy HSM code.
- For new signature schemes, use Ed25519 or ECDSA — both are immune to this attack class and widely supported across modern libraries.
- NIST’s 2030 RSA deprecation deadline is real. Plan migration to ML-DSA (formerly CRYSTALS-Dilithium) now, before it becomes a scramble.
