Five researchers at UC San Diego and Inria have forged an RSA signature on a 1024-bit key without ever learning the private key. A digital signature is how software and documents prove that the holder of a private key approved them, and until now forging one meant recovering that key, which for RSA means factoring a very large number. This team took a different route. They spent 1,380 CPU core-years between March 13 and August 31, 2026 running a 2007 algorithm by Joux, Naccache and Thomé that no one had tried at full size, and they describe the result in ePrint 2026/2131. A core-year is one processor core working for a year; spread across a university cluster, that was five months of computing.
The paper also puts a number on what the attack does to RSA in the setting where it applies. Security is measured in bits: a system with 112 bits of security takes roughly 2112 operations to break, and every bit removed halves the work. Under this attack a 1024-bit RSA key offers 265, a 2048-bit key 290 and a 4096-bit key 2119. That puts 1024 and 2048 below NIST’s current 112-bit minimum, and all three below the 128 bits that NIST assigns to a 3072-bit RSA modulus, the minimum CNSA 1.0 still sets for National Security Systems.
The attack
The attack needs one thing that well-run systems rarely hand out: temporary access to a raw RSA signing oracle. An oracle, in this sense, is any system that will apply the private key to whatever number you give it and return the result, without first putting that number into the standard format that signing normally uses. The attacker never sees the key. They only need to ask the oracle about 232 questions, roughly four billion signing requests, and then do the heavy computation offline.
What they get in return is permanent. Once the precomputation is done, the attacker can sign any message they choose, on their own hardware, long after their access to the oracle has been revoked, and each further forgery on the same key costs about 180 core-years. The authors demonstrated this against a hardware security module, the tamper-resistant appliance organizations buy precisely so that keys never leave it, and showed they could impersonate it through its ordinary programming interface without extracting the key. For a security team the operational reading is simple: temporary access to the wrong interface can become a signing capability that outlives every access review.
The cost will fall. The team used neither GPUs nor AI, and with existing GPU sieving code the authors estimate the 1024-bit computation at two to nine GPU-years and a 2048-bit forgery at roughly 227 GPU-years. Nadia Heninger, one of the authors, expects both GPUs and AI to push those numbers down further.
Where raw signing still exists
Most RSA signing is not exposed this way. Before a message is signed it is normally wrapped in a fixed structure called padding, either the older PKCS#1 v1.5 format or the randomized PSS scheme, and that wrapping denies an attacker the raw mathematical operation this method needs. The authors make no claim against padded RSA.
Raw RSA survives in two places. The first is blind signatures, where a service signs a value it cannot see so that the token it issues cannot later be traced back to the person who asked for it. Privacy Pass, the anonymous-token protocol deployed by Cloudflare and Apple to let people prove they are legitimate without identifying themselves, is built on blind RSA, and in that design the issuer necessarily signs whatever it receives. Heninger told Ars Technica that the number of requests the attack needs is on the order of the traffic Cloudflare handles in about a day. The second is hardware security modules configured so that the application adds the padding and the module performs the bare RSA operation. In that arrangement anyone who can reach the module’s interface, including a compromised application server, is holding a raw oracle. Rotating keys raises the cost of the attack, because the precomputation must be repeated for each new key, but it does not remove it.
The same key, two security levels
The same 2048-bit key therefore has two security levels. Behind PSS it retains roughly 2112 of security against factoring, while behind a raw signing oracle it offers 290, a difference of about four million times less work for the attacker. Nothing about the key itself differs; the security level belongs to the protocol around it. A cryptographic inventory that records “RSA-2048” has recorded a key length and left the security level blank, and it cannot tell a TLS handshake with PSS apart from a blind-signature token issuer or an HSM interface left in raw mode. Grading the asset requires that calling context.
Because a key length cannot carry a grade on its own, [PQ]probe caps an endpoint at C until it negotiates post-quantum hybrid key exchange, whatever its RSA key size, and the worst address behind a name sets that name’s grade.
The signature deferral
Post-quantum migration plans sequence key exchange before signatures, and the order is right. Key exchange protects confidentiality, and an adversary can record encrypted traffic today and decrypt it once a quantum computer exists, an approach known as harvest now, decrypt later. A signature is checked when it is used, so a forgery made in the future cannot reach back and alter a decision already taken. Executive Order 14412 follows that logic, setting the end of 2030 for key establishment and 2031 for signatures.
The year between those dates was priced on the cost of factoring, because forging a signature meant recovering the key and recovering a 2048-bit key was out of reach. This result forges a signature without factoring at all, and in the oracle setting it lowers the estimate underwriting the deferral by fifteen bits at 1024, about 33,000 times less work, and by twenty-two bits at 2048. The deadline has not moved, but the margin that justified waiting for it is thinner than the planning assumed.
Nineteen years on the shelf
The team’s README explains why a 2007 algorithm is news in 2026: little money goes to classical cryptanalysis, and the job market rewards post-quantum and AI work, so the algorithm stayed theoretical until someone funded five months of cluster time.
Other attacks waited just as long for someone to run them. Bleichenbacher published the RSA padding oracle attack in 1998, and the ROBOT researchers found it working against production TLS in 2017; Wang published MD5 collisions in 2004, and the Flame malware carried a forged Microsoft certificate in 2012. Each time the mathematics sat in public for eight years or more before anyone ran it against a deployed system. The lesson for risk owners is that the published cost of an attack is an upper bound set by how many people have tried, not a measure of what the mathematics allows.
Three results in one month
The forgery arrived alongside two factoring records. On September 3 Eric Lu at Cognition factored RSA-260, an 862-bit number, with a GPU implementation of the number field sieve that the Devin coding agent wrote, at about 4,900 GPU-days. Sixteen days later Stephen Weis factored RSA-896 on idle GPUs in ten days, with a peak of 2,048 accelerators and about 30 GPU-years of work, and with no hardware bought or rented. Lu estimates that a hyperscaler could factor RSA-1024 for about $30 million, and notes that RSA-2048 is roughly a billion times harder.
Over the long run the record for the general number field sieve, the best known method for factoring numbers like these, has moved from about 430 bits in the mid-1990s to 862 bits on September 3. That is roughly fourteen bits a year, and it includes a ten-year gap between 768 bits in 2009 and 795 in 2019 when no one ran the computation at all. On that slope, plotted in the figure, RSA-2048 is about eighty years away.
Records: RSA-129 to RSA-250, compiled by Paul Zimmermann; RSA-260, Eric Lu; RSA-896, Stephen Weis.
JP Aumasson plotted the two September records on the same axes on September 20, fitted a line through them and read off March 14, 2028 for RSA-2048, labelling it “wildly irresponsible extrapolation” and following up with a request that no one write an article about it. The joke holds, because two points always give a line, and the thirty-year series shows why it is a line rather than a trend. Records measure how often someone was funded to try, and that frequency is what changed in September.
In one month the price of the same key moved three times by three separate routes: agent-written GPU sieving, spare-capacity factoring, and a forgery that needs no factoring at all, whose 1024-bit cost the authors put below Lu’s cost for a smaller number. A grade captures that price on one day. The direction it is moving can only be measured across a population rescanned with the method held fixed, because two points make a chart and only repeated measurement makes a census.
What changes
The immediate risk is small, and the authors say so: most deployed RSA is padded, and most raw-RSA deployments rotate their keys. What has changed is the number used to justify deferring signature migration. It was a factoring estimate, and factoring was never the only route to a signature.
For a security leader that translates into two pieces of work. The first is to find the places where RSA keys sign without padding, which in most organizations means token and blind-signature services and hardware security modules whose interfaces permit raw RSA operations, and to limit who can reach those interfaces. The second is to stop treating a key length as a risk rating. An inventory that records key lengths without their calling context cannot grade RSA at all. Record the protocol and grade the use. The 2031 signature deadline is the fixed date it already is.