A team from UC San Diego and Inria has done something cryptographers long assumed was impossible or at least pointless: forged 1024-bit RSA signatures without ever factoring the modulus. The paper, posted September 20 by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger, and Emmanuel Thomé, ran a 2007 algorithm at real scale and found that RSA’s security estimates in a common attack model are 15 to 30 bits too optimistic.
The attack model matters
This is not a break you can run against a web server’s TLS key from the internet. The attack assumes a lunchtime scenario, formally a non-adaptive chosen-ciphertext attack: the attacker gets temporary access to a raw RSA signing or decryption oracle, then loses it. The question is whether that temporary access leaves permanent damage.
For properly padded RSA, such as RSA-PSS or PKCS#1 v1.5 as implemented in mainstream libraries, the answer has always been no, because padding scrambles the input so the oracle is useless. But raw, unpadded RSA operations do exist in the real world. Hardware security modules expose raw signing APIs, and blind signature schemes intentionally provide exactly this kind of oracle. The researchers demonstrated the attack against an HSM, queried purely through its black-box API, showing that an attacker could impersonate the device without ever exfiltrating the key from it.
The numbers
The algorithm is a variant of the number field sieve published by Joux, Naccache, and Thomé in 2007, which nobody had implemented at scale until now. It runs in time close to the special number field sieve, L[1/3, 1.577], rather than the general number field sieve used for factoring, L[1/3, 1.923]. That exponent gap is enormous in practice.
The actual run took 1,380 CPU core-years over five calendar months, from March 13 to August 31, 2026, and about 2^32 raw oracle queries. Most of the cost is a one-time precomputation, roughly 1,200 core-years, that depends only on the modulus. After that, forging any signature the attacker wants is an offline job of about 180 core-years, with no further oracle access needed.
Compare that to factoring: current estimates put 1024-bit RSA factoring at 500,000 to 1,000,000 CPU core-years. The attack borrows oracle queries to buy roughly a three-order-of-magnitude discount. As Ars Technica’s coverage of the paper notes, extrapating the empirical results drops the effective security from 2^80 for 1024-bit keys to about 2^65, from 2^110 to about 2^90 for 2048-bit, and from 2^140 to about 2^119 for 4096-bit. Under the 128-bit minimum that NSA, NIST, and ENISA require, even 4096-bit RSA falls short in this model.
How close is the practical threat?
Not close. Even the deprecated 1024-bit case requires more compute than anyone short of a nation-state or a very large cloud operator can mount for a single key. Mainstream RSA implementations with padding are unaffected, because they do not expose the oracle the attack needs. The researchers also point out their numbers are an upper bound: the code was written by hand, with no GPU acceleration and no AI-assisted optimization, and both would almost certainly cut the cost further.
The threat is really about two narrower scenarios. First, systems that expose raw RSA operations through an API, which includes some HSM configurations, some cryptographic protocols, and blind signature schemes such as those used in certain e-cash and privacy systems. Second, the extrapolation itself: the security margins cryptographers quote for 2048- and 4096-bit RSA assume factoring is the best attack, and this paper shows a materially cheaper attack exists in a model nobody was measuring.
A brief history of 1024-bit RSA
It is worth remembering how the field got here. RSA-1024 has never been publicly factored; the largest general factoring records sit around 829 bits, achieved in 2020 with about 2,700 core-years. A 1039-bit special-form Mersenne number was factored back in 2007 with only 225 core-years using the special number field sieve, which is why special-form moduli have always been treated as weaker. The new attack widens that gap: it brings nearly SNFS-class performance to arbitrary moduli, provided the attacker can buy oracle queries. Academic teams have been chipping at the practical cost of factoring too, with GPU-based records in 2026 reaching 862 and 896 bits at a fraction of the CPU cost of the 2020 runs.
Why it matters beyond 1024 bits
The paper’s framing is pointed: this is classical cryptanalytic evidence for moving away from RSA entirely during the post-quantum transition. Regulators are already pushing that direction, with NIST’s post-quantum standards finalized and migration timelines stretching into the 2030s. A result that trims 15 to 30 bits off RSA’s security estimates in a realistic model gives migration planners one more reason to prefer lattice-based and hash-based schemes over stretching RSA key sizes another decade.
For practitioners, the actionable list is short. Audit whether any system you operate exposes raw RSA signing or decryption through an interface an attacker could reach, especially HSMs. Prefer padded RSA everywhere padding is not yet mandatory. And when the post-quantum migration plan gets written, treat RSA-2048’s margin as thinner than the textbook says.