Researchers devise new signature-forgery attack that breaks blind-signature RSA without factoring, drastically cutting the compute needed

A team led by Nadia Heninger (UC San Diego) reportedly found a way to forge RSA signatures without factoring the private key, using a variant of a 2007 number-sieve algorithm against a weakness in "textbook" (unpadded, blind-signature) RSA. In their test, forging a 1024-bit signature took about 1,380 CPU core-years, versus an estimated 500,000 to 1,000,000 core-years to factor the same key. The claim comes from Ars Technica's report on the work; the underlying paper is not linked in this extraction and the result has not yet been peer-reviewed.

This does not touch the padded RSA (PKCS/PSS) used in almost all real-world encryption and signing, so most systems are unaffected. It matters specifically for blind-signature RSA deployments such as Privacy Pass, used by Cloudflare and Apple for privacy-preserving authentication, and any other system built on unpadded RSA assumptions. For those specific systems, it is a genuine and useful early warning to check exposure and plan migration, but it is not a general RSA break and does not change near-term risk for the vast majority of encrypted traffic or digital signatures.

The headline framing ("faster than anything we've seen before") oversells this as a general RSA break; it is not. The Privacy Pass attack path reportedly still requires compromising a server and collecting around 2^43 signatures against keys that are rotated regularly, which is a heavy practical bar, not an imminent exploit. No link to the paper or independent verification is present in the sourcing, so the numbers and claims rest entirely on one outlet's secondary reporting of unreviewed research.

1. 01Publication of the actual paper or preprint (e.g. on eprint.iacr.org) with reproducible attack code or parameters, allowing independent verification of the core-year figures.
2. 02Peer review outcome or commentary from other cryptographers (beyond Karsten Nohl/Allurity) confirming or disputing the forgery method and its scope.
3. 03Any advisory or migration guidance from Cloudflare, Apple, NIST, or ENISA specifically addressing Privacy Pass or other blind-signature RSA deployments in the following weeks.