Forging 1024-bit RSA signatures in nearly SNFS time, sans factoring N
matthew_d_green · x · 2026-09-22
A UCSD team published a paper and code implementing a variant of the number field sieve showing that temporary access to a raw, unpadded RSA-1024 signing/decryption oracle (e.g., an HSM) grants a permanent ability to forge signatures and decrypt ciphertexts — effectively stealing the secret key without ever factoring N, and at far less computation than factoring would require.
- The algorithm is subexponential-time (same class as the best factoring algorithms), not polynomial-time, so it poses no immediate operational threat to deployed RSA
- Cryptographer Matthew Green and the authors stress this is not RSA-1024 factorization but an implementation of a 2007 attack by Joux, Naccache and Thoma
- Implication: factoring-based RSA security estimates may be too optimistic and should be revised
- Code and paper are open-sourced at GitHub (ucsd-hacc/NSNFSSSFSFN)
Related event: UCSD Researchers Forge 1024-bit RSA Signatures Near SNFS Time(3 posts)→
More from Safety
- Exabeam exec: hardest AI security problems now live outside the model — virtualsteve · 2026-09-22
- Automated reinforcement learning should scare you: from AlphaGo to math to bio labs — hattusili-the-third · 2026-09-22
- Stanford Accused of Using AI to Alter Students' Race and Gender in Ads — Polymarket · 2026-09-22
- ChatGPT reportedly refuses simple questions unless users grant email access — RexDouglass · 2026-09-22
- OpenAI calls for US leadership in setting global AI standards — Anxious-Yoghurt-9207 · 2026-09-22
- 'Right to act' for agents could break the ad-funded platform moat — _sholtodouglas · 2026-09-22