New Method Could Weaken RSA Encryption Faster Than Before, But Immediate Risk Is Low

Researchers have found a new way to attack RSA encryption, one of the most common methods used to keep online information secure. This technique doesn’t break RSA by the usual method of factoring large numbers, but instead uses a clever trick that could let attackers forge digital signatures or decrypt messages more quickly than before.

The discovery comes from a team led by cryptography expert Nadia Heninger. They used a variant of an algorithm first created in 2007, called the special number field sieve, and applied it to a certain type of RSA setup that’s less common today. The key idea is that if an attacker can temporarily access a system that signs or decrypts messages without using extra protections (known as a raw RSA oracle), they can then carry out a big computation to gain the ability to forge signatures or decrypt messages later without needing the private key.

In practical terms, the team successfully demonstrated this attack on a 1024-bit RSA key. It took a lot of computing power—about 1,380 CPU core-years over several months—but it was faster than traditional factoring methods. For larger keys (2048- and 4096-bit), the researchers estimate the attack would still be possible but much more expensive, and they haven’t actually broken those yet.

It’s important to know this attack only works on RSA implementations that don’t use common padding methods like PKCS#1 v1.5 or RSA-PSS, which most systems use today. Instead, it targets “blind” RSA signatures, a rarer setup used in some privacy-focused systems like Privacy Pass, which helps users prove they’re not bots without revealing their identity. Even there, carrying out the attack would require compromising a server and generating a huge number of signature requests, which is difficult for most attackers.

The researchers did not use AI or advanced graphics processors for their tests, but they believe such tools could speed up the attack in the future. For now, this method doesn’t pose an immediate threat to most online security systems. However, it does lower the estimated security of certain RSA uses and adds urgency to the ongoing move toward newer, quantum-resistant cryptography.