UCSD and INRIA researchers forge 1024-bit RSA signatures without factoring, for about 1,380 core-years

IACR ePrint (also Ars Technica, Gizmodo)·high signalXBlueskyLinkedInCopy link

Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé implemented the 2007 Joux-Naccache-Thomé algorithm. With temporary access to a raw, unpadded RSA signing or decryption oracle, it lets an attacker forge signatures or decrypt chosen ciphertexts offline later. Against a 1024-bit key the run took 1,380 CPU core-years over five months plus 2^32 oracle queries. Factoring the same modulus is estimated at 500,000 to one million core-years. The attack does not reach padded RSA-2048 in practice, but it shows that factoring-based security estimates overstate RSA's strength in any system that exposes a raw RSA oracle. The paper is on IACR ePrint 2026/2131 and the code is on GitHub.