New Technique Discovered for Breaking RSA Faster Than Ever Before

Researchers have demonstrated a way to attack RSA encryption faster than before, allowing them to compromise (admittedly already deprecated) 1024-bit RSA in just five months on classical computers in an academic CPU cluster.

This method foregoes factoring the key and instead relies on forging signatures:

We carried out our attack using a hardware security module (HSM) as the signing oracle, thus demonstrating the ability to impersonate the HSM through black-box API interactions, without exfiltrating the key. Blind RSA schemes also provide such a signing oracle.

Extrapolating the time it took for 1024-bit RSA, the researchers say that "concrete security of RSA with a signing oracle should be 15 to 30 bits lower than the factoring-based security estimates for the 1024-bit to 4096-bit RSA parameters that are common in practice." They say the attack "reduces security levels below acceptable thresholds for modern cryptographic deployments."

This is a problem, since RSA is still widely used for many things such as TLS and OAuth, with 2048-bit RSA being the most common choice.

The method "highlights a gap" in our current security assumptions around RSA. Interestingly, the method was known since about 2007, but the full implications seemingly weren't well understood by the cryptographic community.

The researchers recommend moving away fully from RSA. Luckily, the move toward post-quantum cryptography (PQC) is well underway.

NIST plans to deprecate RSA and elliptical curve cryptography (ECC) by 2030 disallow them by 2035.

Currently, hybrid cryptography is commonly used as a "bridge" between older cryptography and newer PQC. However, now that RSA is potentially more vulnerable to even attacks by classical computers, the benefits of hybrid cryptography seem more questionable.

Google moved its Q-day for securing communications with PQC to 2029. They've been upgrading their products with PQC, such as introducing post-quantum signatures in Android 17 and their post-quantum secure boot in the Google Pixel 11. Post-quantum signatures seem even more important given the attacks in the paper involve forging signatures for hardware security modules.

Messengers like Signal and iMessage have moved to PQC ahead of the threat of quantum computers.

Major web browsers now support post-quantum cryptography to protect your web browsing.

Seemingly, the outlook for RSA looks bleak. Now not only are quantum computers the only threat, but classical computers could potentially pose a risk as well.