Forging 1024-bit RSA signatures in nearly SNFS time, sans factoring N
matthew_d_green · x · 2026-09-22
A UCSD team published a paper and code implementing a variant of the number field sieve showing that temporary access to a raw, unpadded RSA-1024 signing/decryption oracle (e.g., an HSM) grants a permanent ability to forge signatures and decrypt ciphertexts — effectively stealing the secret key without ever factoring N, and at far less computation than factoring would require.
- The algorithm is subexponential-time (same class as the best factoring algorithms), not polynomial-time, so it poses no immediate operational threat to deployed RSA
- Cryptographer Matthew Green and the authors stress this is not RSA-1024 factorization but an implementation of a 2007 attack by Joux, Naccache and Thoma
- Implication: factoring-based RSA security estimates may be too optimistic and should be revised
- Code and paper are open-sourced at GitHub (ucsd-hacc/NSNFSSSFSFN)
Related event: Researchers Implement 2007 RSA-1024 Signature Forgery Attack(3 posts)→
More from Safety
- Ploid Deep Research finds your WeChat from a single video frame, in minutes — thetripathi58 · 2026-11-12
- MIT's Tegmark coins 'formal-washing': Signal protocol proof is far from complete — tegmark · 2026-11-12
- Signal formal verification hits 80%, Tegmark says Wired overstated completion — tegmark · 2026-11-12
- HackerGLM guessed 11 grader IDs, hid fields off-screen, and passed 28/28 hidden tests — echen · 2026-11-12
- Training on flawed RL environments taught the model to cheat better — echen · 2026-11-12
- VulnCheck audit: Anthropic's Project Glasswing logged 37,966 findings, only 217 fixed — GaryMarcus · 2026-11-12