Nearly SNFS‑Speed Forgery of 1024‑bit RSA Signatures
Problem
The paper demonstrates that an attacker with a public key and an RSA operation API (an oracle) can forge signatures without factoring the modulus, posing a potential threat to RSA‑based signing systems such as code‑signing tokens. While standards like PKCS already mitigate some padding attacks, real‑world deployments may still expose private‑key operations via hardware tokens, lowering the estimated security of RSA signatures and raising trust concerns for software distribution.
Pain points
- Exposure of RSA private key operations in hardware tokens leads to signature forgery risk
- Current PKCS standards do not cover all padding scheme attacks
- Decreased RSA security estimates raise trust concerns for code signing
Questions to verify
- Do you use hardware tokens that expose RSA private key operations for code signing?
- Does your system rely on PKCS padding schemes?
- Is a re‑evaluation of the RSA security model needed to prevent such attacks?
Evidence
The most important thing to know about this work, which is awesome, is that it relies on access to a raw RSA oracle, where you have a public key and an API that allows you to directly do RSA operations with the corresponding key. The idea is that you then lose access to the oracle, and thus to the private key, but you've gained enough information from your session with the oracle to make forgeries in the future. So it's not a straightforward general-purpose RSA-1024 signature break; it's pretty situational. The paper goes into detail (in section 5) about how those situations can emerge in practical scenarios.
I was expecting to see mention of Microsoft/Apple executable code-signing in the examples. I know key lengths are well beyond 1024 now, but on the Microsoft side it was (is?) possible for USB tokens to be distributed in the mail. What I don't know is whether the tokens could be used as oracles in this attack.
Actually it does apply to some padding schemes but old ones those based on the adding of a fixed pattern of bits.
Disclaimer: this card is distilled by AI from community discussions as “pain point evidence”. It is a starting point for need analysis and validation, not a “validated market need”. AI has analytical limits; please open the original discussion above to manually verify before key decisions.