Blind RSA Forgery via Special NFS Oracle Drops 1024-bit Cost to 2^65 Operations
The reported attack applies a 2007 special NFS variant only to blind RSA oracles and achieves forgery at 2^65 operations for 1024-bit keys. It leaves padded RSA untouched and is mitigated by existing key rotation. Future GPU or AI assistance may reduce costs further but does not alter the narrow scope.
The attack targets only blind-signature RSA implementations that expose an oracle for chosen inputs. It gathers relations through repeated queries until the sieve factors the modulus. Standard PKCS#1 and PSS padding block the required oracle, leaving the overwhelming majority of deployed RSA unaffected. Privacy Pass, used by Cloudflare and Apple, remains exposed because it relies on textbook blinding.
Measured costs fall to 2^65, 2^90, and 2^119 for 1024-, 2048-, and 4096-bit keys. These figures come from hand-coded runs without GPUs or machine-learning assistance. The same workload matches one day of Cloudflare’s reported token traffic, yet regular key rotation already limits an attacker to a narrow window.
Operationally, services using blind RSA must shorten rotation intervals or migrate to padded variants. Continued manual optimization and future GPU acceleration will further compress the attack cost. No evidence indicates the method extends to padded RSA or general factoring.
Systems that retain blind signatures without rotation face forgery risk at current traffic volumes; those enforcing daily key changes retain at least 2^80 effective security.
Heninger: Cloudflare will enforce 24-hour key rotation for Privacy Pass within nine months once measured forgery cost falls below 2^70.
Sources (2)
- [1]Primary Source(https://eprint.iacr.org/2025/1423)
- [2]Supporting Source(https://arstechnica.com/security/2026/09/theres-a-new-way-to-break-rsa-thats-faster-than-anything-weve-seen-before/)