hckrnws
Forging 1024-bit RSA signatures in nearly SNFS time [pdf]
by int0x29
by int0x29
So it's not a straightforward general-purpose RSA-1024 signature break; it's pretty situational. The paper goes into detail (in section 5) about how those situations can emerge in practical scenarios.
Why are we even contemplating quantum computers breaking encryption when they can't even factorize a 3-digit prime number? I'm wondering if I'll even see quantum computers breaking RSA in my lifetime.
Nearly SNFS-Speed Signature Forgery Sans Factoring N (NSNFSSSFSFN)Also no ai, so we can expect some speedups soon.
I really didn’t expect rsa to be targeted so much this year. Hope that these results will motivate people to pursue algorithmic improvements!
[dead]
This is not "we broke RSA", it's "we managed to find an implementation you've probably never heard of before that's so broken that an attack that nothing should be vulnerable to is actually feasible". This is a blog post, not a news story. I found a much bigger vuln than this in Android RSA auth some years ago, I'm talking beginner-level crypto misuse, told Google about it, and it was quietly fixed. I didn't publish a paper about it or get it in the news because it was a non-story.
Except that in this case every single piece of crypto code or downstream app out there that has the name "RSA" associated with it, which is all of them, has to reassure every one of its users who have seen the news headline that no, it's overblown hype, you're not vulnerable, nothing to do since there's no vulnerability present in your use of RSA.
The worst possible outcome would be if this thing actually gets a CVE assigned to it. How do you fix a "vulnerability" that doesn't exist?
>Still, some real-world systems continue to use blind-signature, also known as textbook, RSA.
I think those are two different things.
But the technique is interesting as an object of study, in a way that finding "beginner-levle crypto misuse" absolutely wouldn't be, so it makes it more relevant as an academic publication. It further clarifies just how fragile these constructs are.
Also from a security perspective I suspect this may be a total break on some blind signature token schemes that use RSA. I've seen some of those avoid using ECC on the basis of the complexity required to avoid one-more-signature attacks that require making a fair number of concurrent blind signatures. (and have a shape a lot like this attack!)
> How do you fix a "vulnerability" that doesn't exist?
Don't make a signing oracle (esp one that doesn't even do the padding itself) available!
Yes, it creates bullshit for experts to deal with. Unfortunately dealing with bullshit is part of the job. The amount of AI hacking doomerism and naive super optimism I have to deal with is revolting, but grounding the paranoia and boosterism is part of the job.
The people I take issue with are the ones who claim expertise, and then say "This new paper says 1024 but RSA is broken, we must move to PQC immediately!" They are so good at blowing their own trumpet they get appointed to boards and are anointed as experts in regulators, and you can't expose them without experiencing institutional anger.