New RSA Signature Forgery Attack Implementation
Research from 2007 gets practical implementation, exposing vulnerabilities in textbook RSA signatures
1Not actually new research
The attack builds on 2007 academic research but presents the first practical implementation. It targets textbook RSA signatures without padding or formatting, which are rarely used in modern systems. The method allows signature forgery without recovering private keys, representing a conceptual shift in RSA vulnerability models. Current implementations in Privacy Pass protocols by Apple and Cloudflare remain protected due to rate limiting.
2Technical limitations
The attack requires 1380 CPU core-years to forge 1024-bit RSA signatures, equivalent to five real-world months of computation. It only works against pure signatures without formatting, unlike the padded signatures used in most practical applications. Researchers emphasize this doesn't break properly implemented RSA systems but exposes theoretical weaknesses in the algorithm's fundamental design assumptions about factoring equivalence.
3Corporate impact analysis
Apple's implementation would require 17 million years to exploit on a single device due to rate limiting. Even parallelized across all 2.3 billion Apple devices, the attack would take 2.3 days. At Persona's API pricing, the computational cost would reach $13 trillion. These practical barriers make current implementations resistant despite the theoretical breakthrough in cryptanalysis techniques.
4Key rotation considerations
Regular key rotation significantly reduces but doesn't eliminate attack risks. The cryptographic community notes that poor key management practices can negate rotation benefits. Many systems use weaker algorithms for key generation due to performance constraints, creating potential vulnerabilities beyond factoring attacks. This highlights the importance of robust key material generation and disposal protocols.
5Comparison to Rabin signatures
Unlike RSA, Rabin signatures are provably equivalent to factorization but require twice the key size. The new attack demonstrates RSA's theoretical weakness compared to alternatives. While 4096-bit RSA keys remain 2^1536 times stronger than 1024-bit versions, the research reinforces the need for cryptographic agility and post-RSA planning across the industry.
6AI's potential role
Researchers speculate that modified AI systems could potentially identify statistical patterns in cryptographic noise. Digital Neural Networks might be adapted to decompose seemingly random signals into constituent components. This aligns with known vulnerabilities in pseudo-random number generators where deterministic signals can compromise entropy sources.
7Practical recommendations
Security experts recommend migrating from 1024-bit keys, adopting modern padding schemes like PSS, and planning post-RSA transitions. While current systems using proper formatting remain secure, the research underscores cryptography's evolutionary nature. Organizations should audit their exposure to textbook RSA implementations and accelerate deprecation timelines for vulnerable configurations.
8Historical context
The attack continues cryptography's pattern of incremental advances rather than sudden breaks. Similar to past vulnerabilities in pseudo-random number generators, this demonstrates how theoretical weaknesses eventually find practical implementations. The community recalls Intel's RNG flaws and emphasizes the importance of testing raw entropy sources rather than relying on cryptographic post-processing.
9Strategic implications
While not requiring immediate panic, the attack reinforces the need for cryptographic agility. Systems still using vulnerable configurations must prioritize upgrades. The research serves as another data point in the gradual transition toward post-quantum cryptography, highlighting that RSA's long-term viability continues to diminish with each new cryptanalytic advance.
Original article: Schneier on Security — New RSA Signature Forgery Attack Implementation