Researchers forged 1024-bit RSA signatures, but ordinary RSA is not suddenly broken

Researchers report a full-scale demonstration of a method for forging 1024-bit RSA signatures without factoring the public modulus or extracting the private key. The result is technically significant, but it is not a general break of RSA: the attack required temporary access to a service performing raw, unpadded RSA operations on attacker-selected inputs, followed by an unusually large computation.

The work appears in Cryptology ePrint paper 2026/2131, a preprint by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé. The archive received the paper on 20 September 2026 and approved it on 22 September. The paper is a preprint, rather than a peer-reviewed conference or journal publication. No independent reproduction was identified in the research available for this report.

What the researchers demonstrated

In the reported experiment, a hardware security module, or HSM, acted as a raw RSA oracle. In this context, an oracle is an interface that performs a private-key RSA operation on inputs supplied by the caller. The attack collected the results of 2^32 such queries and used 1,380 CPU core-years of computation, spread across five calendar months.

After the main precomputation, the researchers reported that they could forge a chosen signature offline for the tested public key with a further 180 CPU core-years. The private key remained inside the HSM. It was not recovered or exfiltrated, and the modulus was not factored. Instead, the process produced a capability that could impersonate the key’s signing function for chosen signatures.

Those distinctions matter. This experiment did something narrower than factoring the modulus or recovering the key: it used enough responses from a particular signing or decryption interface to construct valid signatures later. The researchers did not demonstrate universal RSA decryption or compromise a named production service or commercial product.

The underlying mathematics is also not new. Joux, Naccache and Thomé published the relevant algorithm in 2007. The 2026 contribution is the engineering and empirical demonstration needed to carry that approach through a complete 1024-bit run.

The raw oracle is the critical condition

Ordinary RSA signing interfaces generally apply an encoding scheme, such as PKCS#1 v1.5 or PSS, inside the implementation before using the private key. According to the preprint and reporting by Ars Technica, those interfaces generally do not expose the raw operation required by this attack. Merely using RSA therefore does not establish that a system is affected.

Blind RSA schemes and some HSM interfaces can provide the oracle behaviour assumed by the researchers. Applicability still depends on the exact protocol and interface, including whether an untrusted caller can obtain enough suitable private-key operations. The research does not establish that every blind-signature service or HSM deployment meets those conditions.

PSS does not resolve that question by itself. RFC 9474 standardises RSA blind-signature variants that use PSS encoding, showing that blind RSA and PSS can coexist. The relevant architectural issue is whether the protocol exposes the caller-controlled operation needed by the attack, not simply whether PSS appears somewhere in the design.

What the result says about larger keys

The completed experiment concerns 1024-bit RSA, a size already unsuitable for new signature generation under NIST SP 800-131A Rev. 2. That guidance lists RSA moduli of at least 2048 bits as acceptable for generating digital signatures. Removing remaining 1024-bit signing keys is therefore established maintenance rather than a response created solely by this preprint.

The paper’s implications for larger keys are less settled. Its authors extrapolate that RSA in this specialised oracle model offers 15 to 30 fewer bits of security than estimates based on factorisation for parameters from 1024 to 4096 bits. They also say 4096-bit RSA may fall below 128-bit security in that model. Those are model-based estimates, not results from completed attacks against 2048-bit or 4096-bit keys.

The practical cost of a more optimised implementation also remains unknown. The reported run did not use graphics processors, and independent testing has not established how the method would perform with different hardware or engineering choices. Nor does the available research measure how many deployed services expose a qualifying oracle, making the immediate operational reach of the result difficult to assess.

Who should review their systems

The clearest next step falls to operators and designers of blind-signature services and HSM-backed signing systems. They can audit whether untrusted callers may request raw RSA private-key operations on values they control. The researchers also suggest larger moduli and shorter key epochs as interim risk reductions for blind RSA, while noting that these measures are not a complete fix. Protocol-level hardening or a design that avoids the required oracle addresses the underlying exposure more directly.

For ordinary users of internally padded RSA signature interfaces, the preprint does not establish an emergency or a general RSA failure. Its importance is architectural: a private key can remain protected inside an HSM while an overly capable interface still enables signature forgery after substantial precomputation. The unresolved question is not whether all RSA has fallen, but how often real services expose the narrow operation that made this demonstration possible.

Keeping key material inside an HSM does not remove the need to scrutinise which operations its interface permits. Use The Hack Academy’s online cybersecurity training programme for a self-paced route into cryptography and cybersecurity fundamentals, pairing practical exercises with theory.