There's a new way to break RSA that's faster than anything we've seen before

RSA has been the workhorse of internet security for decades, but the latest research from UC San Diego has thrown a new wrench in the works. A novel “special” number field sieve attack can forge RSA signatures without ever factoring the private key, slashing the computational effort required by orders of magnitude. While the attack only hits blind‑signature (textbook) RSA, the fact that it works at all forces every hosting provider, VPN operator, and SaaS founder to re‑evaluate their key‑management playbooks before the next wave of quantum‑ready cryptography hits the market.

What the new attack actually does

The researchers, led by Laura Shea and Nadia Heninger, built a variant of the number field sieve algorithm that was first introduced in 2007. By coupling it with an “oracle” – essentially a way for the attacker to query the cryptographic protocol and get answers – they can collect enough information to forge a valid RSA signature. Crucially, this bypasses the need to factor the modulus, which has traditionally been the only practical path to break RSA.

In practice, the team demonstrated the attack on a 1024‑bit key using an academic CPU cluster. The operation count was about 2^65, translating to roughly 1,380 core‑years. By contrast, conventional factoring of a 1024‑bit key is estimated at 2^80 operations and requires 500,000 to 1 million CPU core‑years. The result is a dramatic reduction in effort, even though the attack still demands a sizable but achievable amount of compute.

Why blind‑signature RSA matters

Most modern RSA deployments use PKCS or PSS padding, which adds randomness and thwarts the kind of oracle the researchers exploit. Those padded schemes remain safe from this particular forgery technique. However, a non‑trivial slice of the ecosystem still relies on blind‑signature, or “textbook,” RSA. The most prominent example cited is Privacy Pass – a privacy‑preserving token system used by Apple, Cloudflare, and other services to let users prove they are human without revealing identity.

Privacy Pass implementations that expose a blind‑signature endpoint become potential targets. An attacker would need to request about 2^43 tokens from a provider to mount the attack. Heninger notes that this request volume is on the same order of magnitude as the daily traffic Cloudflare publicly reports handling, meaning the barrier is not insurmountable for a determined adversary with sufficient resources.

Impact on key sizes and security levels

The paper quantifies the security erosion in terms of the standard 2^128 benchmark that agencies like the NSA, NIST, and ENISA use to define a minimum acceptable security level. For 1024‑bit RSA, the forgery attack drops the effective security to about 2^65. Even for larger keys, the reduction is stark: 2048‑bit keys fall to roughly 2^90, and 4096‑bit keys to around 2^119. While the latter still exceeds the 2^128 threshold, the margin is thin enough that any additional optimisation – such as leveraging GPUs or AI‑assisted code – could push those numbers below the safe zone.

Because the researchers performed the attack without AI or GPU acceleration, there is a clear path for future work to shave the effort further. In a hosting environment where you already allocate spare CPU cycles for backup, monitoring, and scaling, the incremental cost of adding a specialised sieve job could be justified by an attacker with a malicious agenda.

Real‑world risk for hosting providers

For independent hosting operators, the immediate threat is limited. Most of our customers run TLS stacks that employ PKCS#1 v1.5 or PSS padding, which are not vulnerable to this specific forgery. However, the risk spikes when you expose APIs that accept raw RSA signatures – a pattern that still shows up in legacy authentication services, custom SSO solutions, and certain token‑issuance systems.

In practice, the attack requires an attacker to control a sizeable CPU farm for months. That is beyond the reach of a lone script‑kiddie but well within the capabilities of a state‑sponsored actor or a well‑funded cyber‑crime group. If your service issues blind‑signature tokens for privacy or anonymity, you should treat the 2^43 token request threshold as a realistic attack surface and plan mitigation accordingly.

What this means for the race to post‑quantum crypto

The timing of this breakthrough is noteworthy. The cryptographic community has been pushing hard to adopt post‑quantum algorithms, citing the looming threat of quantum computers becoming practical within a window of three to twenty years. This classical‑computing attack accelerates the erosion of confidence in RSA, especially for 1024‑bit keys that many legacy systems still cling to.

Even though the attack does not yet break the padded RSA schemes that dominate TLS, it underscores a broader point: relying on a single hard problem (integer factorisation) is a fragile strategy. As we watch the quantum timeline shrink, the added pressure from classical attacks like this one makes the case for migration to lattice‑based, hash‑based, or code‑based schemes even more urgent.

Actionable steps for founders and ops teams

First, audit every service that uses RSA. Identify any endpoint that accepts raw RSA signatures – especially those that might be part of a blind‑signature flow such as Privacy Pass or custom token issuers. If you find any, move them to PKCS#1 v2.1 or PSS padding immediately, or replace RSA with an elliptic‑curve alternative like Ed25519, which does not suffer from this specific forgery route.

Second, rotate keys more frequently. The paper notes that rotating RSA keys reduces the window of opportunity for an attacker, even if the underlying algorithm remains vulnerable. Shortening key lifetimes to weeks rather than months can dramatically cut the risk of a successful forgery campaign.

Third, monitor token request patterns. A sudden surge toward the 2^43 request level should trigger rate‑limiting and anomaly alerts. Implement strict quotas per client and enforce proof‑of‑work challenges if you must continue to support blind‑signature flows for legacy compatibility.

Finally, start planning a migration path to post‑quantum primitives. The industry’s momentum is already shifting, and the cost of a late‑stage scramble will be far higher than the incremental effort to test and deploy newer algorithms now. In the hosting world, where uptime and trust are currency, staying ahead of the cryptographic curve is non‑negotiable.

Bottom line for independent providers

The new blind‑signature forgery attack is a wake‑up call rather than an immediate catastrophe. It proves that RSA’s security margin is thinner than we thought, even without quantum computers. For founders running real‑world infrastructure, the lesson is clear: audit, patch, rotate, and migrate. Treat any RSA implementation that still leans on textbook signatures as a liability and retire it before an attacker decides to throw a CPU farm at your service.

In the fast‑moving world of security, waiting for a perfect solution is a recipe for breach. The prudent move is to tighten the known holes now and start the journey toward quantum‑resistant cryptography before the next research breakthrough forces you to do it under fire.

— Allan Ali, Founder

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: Ars Technica; arstechnica.com; Global1.News (24 September 2026).

By Allan Ali, Global1.News