Reported by 4 outlets
Researchers Impersonate RSA HSM to Forge Signatures Without Extracting Private Key
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.70 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
A paper by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger, and Emmanuel Thome, received by the IACR ePrint archive on September 20 and approved September 22, 2026, delivers the first end-to-end implementation of a two-decade-old attack against raw RSA signing oracles at 1024-bit scale. The technique implements the 2007 Joux-Naccache-Thome algorithm: an attacker with temporary access to a raw, unpadded RSA signing or decryption function on an HSM performs a large precomputation and query collection, then permanently forges valid signatures for that key offline. The private key is never extracted and the modulus is never factored.
The cost figures are the story. The authors spent 1,380 CPU core-years over five calendar months and 2^32 oracle queries; after that, any signature on the targeted 1024-bit key forges in about 180 core-years. Ars Technica's coverage, quoting Heninger of UC San Diego and Karsten Nohl of Allurity, frames the comparison: roughly 2^65 operations to forge versus an estimated 2^80 operations and 500,000 to 1 million core-years to factor the same key. The paper concludes RSA loses 15 to 30 bits of concrete security under a signing oracle across 1024-bit to 4096-bit parameters, leaving even 4096-bit RSA below a 128-bit level in that model.
The practical exposure is any deployment that exposes raw or padding-less RSA operations, most plausibly misconfigured HSMs and tokenization services. Privacy Pass, used by Apple and Cloudflare, is identified as the best-known blind-RSA deployment, where an attacker would need on the order of 2^43 token requests. The takeaway for defenders is to audit HSM configurations for raw signing modes, treat temporary oracle access as a permanent compromise event for that key, and watch for follow-on work lowering the precomputation cost.
Timeline
-
original reporting
Researchers Impersonate RSA HSM to Forge Signatures Without Extracting Private Key
cyberpress.org · 19d ago · September 25th, 2026
A newly disclosed practical attack can impersonate a hardware security module (HSM) and forge arbitrary 1024-bit RSA signatures without extracting or factoring the device’s private key. The research, titled Forging 1024-bit RSA Signatures in Nearly SNFS Time , implements a two-decade-old cryptanalytic technique against raw RSA signing and decryption oracles. The method allows an attacker with temporary access to an HSM’s unpadded RSA signing function to perform a large precomputation and query-collection operation, then permanently generate valid signatures offline for that RSA key. Researchers Impersonate RSA HSM The attack does not recover the RSA private exponent or factor the public modulus. Instead, it exploits access to raw RSA root operations, effectively turning limited oracle access into the long-term capability to sign arbitrary target values. The attack model resembles a “lunchtime” or non-adaptive chosen-ciphertext scenario. An attacker first obtains temporary access to an RSA signing or decryption oracle for a known public key. Once access is lost, the attacker can still forge signatures or decrypt chosen ciphertexts offline. Researchers instantiated the oracle using HSMs through PKCS#11 raw RSA operations, specifically the CKM_RSA_X_509 mechanism. They tested the technique against Thales Luna K6 and Luna S750 HSMs, demonstrating that the attack relies only on black-box API access and does not require physical compromise, side-channel leakage, firmware modificati
-
update from eprint.iacr.org
When e-th Roots Become Easier Than Factoring
eprint.iacr.org · 6905d ago · November 18th, 2007
The two-decade-old algorithm the new attack implements, received by the ePrint archive on 2007-11-18, by Antoine Joux, David Naccache and Emmanuel Thome. As characterized by the 2026 paper, it lets an attacker with temporary access to a raw RSA signing or decryption oracle forge signatures in time close to the special number field sieve without factoring the modulus. The 2026 work is its first published end-to-end implementation at 1024-bit scale.
-
update from eprint.iacr.org
Forging 1024-bit RSA signatures in nearly SNFS time
eprint.iacr.org · 24d ago · September 20th, 2026
The original researcher disclosure, received by the IACR ePrint archive on 2026-09-20 and approved 2026-09-22, by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thome. The authors implemented the 2007 Joux-Naccache-Thome algorithm, spending 1,380 CPU core-years over five calendar months and 2^32 oracle queries so any signature on a 1024-bit key can later be forged offline in about 180 core-years. They conclude RSA with a signing oracle loses 15 to 30 bits of concrete security across the 1024-bit to 4096-bit parameters, leaving even 4096-bit RSA below a 128-bit level in that model.
-
update from arstechnica.com
There's a new way to break RSA that's faster than anything we've seen before
arstechnica.com · 19d ago · September 24th, 2026
Dan Goodin's article is the first mainstream coverage, published roughly a day before the cyberpress.org story in this event list. It quotes co-author Nadia Heninger of UC San Diego and Allurity's Karsten Nohl, and frames the cost: forging a 1024-bit RSA signature took about 2^65 operations and 1,380 core-years, versus an estimated 2^80 operations and 500,000 to 1 million core-years to factor the same key. It also identifies Privacy Pass, used by Apple and Cloudflare, as the best-known blind-RSA deployment, where an attacker would need roughly 2^43 token requests.
-
update from arstechnica.com
There's a new way to break RSA that's faster than anything we've seen before
arstechnica.com · 18d ago · September 25th, 2026
submitted by /u/return2ozma [link] [comments]
via reddit r/cybersecurity: There's a new way to break RSA that's faster than anything we've seen before
-
update from arstechnica.com
There’s a new way to break # RSA that’s faster than anything we’ve seen before https:// arstechnica.com/security/2026/ 09/theres-a-new-way-t
arstechnica.com · 18d ago · September 25th, 2026
There’s a new way to break # RSA that’s faster than anything we’ve seen before https:// arstechnica.com/security/2026/ 09/theres-a-new-way-t
via Mastodon https://arstechnica.com/security/2026/09/theres-a-new-way-to-break-rsa-thats-faster-than-anything-weve-seen-before/
-
mentioned by arstechnica.com
There's a new way to break RSA that's faster than anything we've seen before https:// discuss.tchncs.de/post/68213771
arstechnica.com · 18d ago · September 25th, 2026
-
update from schneier.com
Attack Against RSA
schneier.com · 15d ago · September 28th, 2026
What is new is the implementation. Second, it is a forgery attack. Third, the attack only works against pure signatures. That is, signatures without any formatting or padding. This is not generally how we use RSA in practice. Fourth, speed is all relative. This is not a polynomial-time algorithm; it’s a subexponential-time algorithm. But it is somewhat faster than factoring. The authors have a webpage that explains the context much better than the article. And here’s the paper . EDITED TO ADD: Slashdot thread .