The most important thing to know about this work, which is awesome, is that it relies on access to a raw RSA oracle, where you have a public key and an API that allows you to directly do RSA operations with the corresponding key. The idea is that you then lose access to the oracle, and thus to the private key, but you've gained enough information from your session with the oracle to make forgeries in the future. So it's not a straightforward general-purpose RSA-1024 signature break; it's pretty situational. The paper goes into detail (in section 5) about how those situations can emerge in practical scenarios.
nk_kolja
I was unaware of snfs algorithms for generic moduli and/or signatures. Very nice. The theoretical result is purely due to the 2007 Joux et al. paper. What’s new is the implementation and the 1024-bit rsa signature forgery. Also no ai, so we can expect some speedups soon. I really didn’t expect rsa to be targeted so much this year. Hope that these results will motivate people to pursue algorithmic improvements!
benmmurphy
nice poem at the end of the paper
RossBencina
I was expecting to see mention of Microsoft/Apple executable code-signing in the examples. I know key lengths are well beyond 1024 now, but on the Microsoft side it was (is?) possible for USB tokens to be distributed in the mail. What I don't know is whether the tokens could be used as oracles in this attack.
upofadown
From the article: >Still, some real-world systems continue to use blind-signature, also known as textbook, RSA. I think those are two different things.
yababa_y
in the PDF metadata we find the proper and appropriate title of this work: Nearly SNFS-Speed Signature Forgery Sans Factoring N (NSNFSSSFSFN)
Related Discussions
Found 5 related stories in 71.2ms across 7,602 title embeddings via pgvector HNSW
Discussion Highlights (6 comments)
tptacek
The most important thing to know about this work, which is awesome, is that it relies on access to a raw RSA oracle, where you have a public key and an API that allows you to directly do RSA operations with the corresponding key. The idea is that you then lose access to the oracle, and thus to the private key, but you've gained enough information from your session with the oracle to make forgeries in the future. So it's not a straightforward general-purpose RSA-1024 signature break; it's pretty situational. The paper goes into detail (in section 5) about how those situations can emerge in practical scenarios.
nk_kolja
I was unaware of snfs algorithms for generic moduli and/or signatures. Very nice. The theoretical result is purely due to the 2007 Joux et al. paper. What’s new is the implementation and the 1024-bit rsa signature forgery. Also no ai, so we can expect some speedups soon. I really didn’t expect rsa to be targeted so much this year. Hope that these results will motivate people to pursue algorithmic improvements!
benmmurphy
nice poem at the end of the paper
RossBencina
I was expecting to see mention of Microsoft/Apple executable code-signing in the examples. I know key lengths are well beyond 1024 now, but on the Microsoft side it was (is?) possible for USB tokens to be distributed in the mail. What I don't know is whether the tokens could be used as oracles in this attack.
upofadown
From the article: >Still, some real-world systems continue to use blind-signature, also known as textbook, RSA. I think those are two different things.
yababa_y
in the PDF metadata we find the proper and appropriate title of this work: Nearly SNFS-Speed Signature Forgery Sans Factoring N (NSNFSSSFSFN)