RSA: an attack forges valid signatures without factoring the key

For decades, RSA’s security has rested on an equivalence everyone treated as settled: breaking a key means factoring a big integer, and factoring a big integer is ruinously expensive. Work reported on 24 September 2026 by Ars Technica describes a method that walks around that equivalence instead of through it: it forges valid signatures without ever computing the private key, and it does so on classical hardware, with no quantum computer anywhere in sight.

A valid signature, no private key required

Nadia Heninger, a professor at the University of California, San Diego and the study’s first author, explains that cryptographers had until now assumed that producing a valid RSA signature meant first recovering the private key by factoring. For a 1024-bit key, that was considered expensive but reachable by a very large actor — on the order of tens of millions of dollars of compute time, for a single key. For 2048 bits, it was filed under “not happening”.

The technique is a variant of the algebraic sieve introduced in 2007, the “special” sieve, pointed at an oracle: a weakness that answers yes or no to carefully chosen questions. Ask it enough times and the answers add up to a signature. For scale, factoring a 1024-bit key is estimated at 2^80 operations and 500,000 to 1 million CPU core-years — the kind of figure that normally ends the conversation.

Three key sizes below the regulatory floor

The NSA, NIST and Europe’s ENISA all require a cryptosystem to offer at least 128 bits of security, meaning more than 2^128 operations to break it. The forgery attack brings that down to 2^65 for a 1024-bit key, 2^90 for 2048 bits and 2^119 for 4096 bits. All three land under the floor.

And those numbers are ceilings, not floors. The team coded everything by hand, with no AI and no GPUs, and reckons that either one would push the levels lower still.

The real blast radius: “textbook” RSA

The attack only works against RSA implementations used for blind signatures, the so-called “textbook” flavour. The overwhelming majority of deployments apply PKCS or PSS padding, which adds data to the plaintext before encryption and strips the ciphertext of its determinism — and with it the oracle the whole method leans on. Those implementations are not affected.

The best-known vulnerable case is Privacy Pass, the anonymous authentication protocol used by Apple and Cloudflare among others. To attack it, you would first have to compromise a server belonging to the organisation concerned, then generate 2^43 signatures: a lot, but the same order of magnitude as the daily network traffic Cloudflare publicly says it handles. Most implementations rotate their keys regularly, which sharply cuts the odds of success without taking them to zero.

What you actually need to do today

In the short term the practical threat is close to nil, a handful of edge cases aside. Even against 1024-bit keys, deprecated though they are, the method demands more compute than anyone short of a nation state or a company with very deep pockets can assemble. So the useful work here is an inventory, not an emergency migration: find the places in your own services where an RSA signature is computed with no padding.

One last caveat, and it is a big one: the result has not been through peer review yet. Karsten Nohl, cryptography expert and chief innovation officer at Allurity, reckons that if it holds up it will be a conceptual breakthrough.

RSA had an expiry date pencilled in: the arrival of practical quantum computing, three to twenty years out depending on whose estimate you believe. This attack waited for neither a qubit nor a GPU. Someone simply sat down and wrote it by hand.