Full Breakdown
New eNFS Attack Undermines 1024-bit RSA Without Factoring
By Drooid · · How we work
Breakthrough eNFS Attack Targets 1024-bit RSA
Researchers from the University of California, San Diego and Inria Nancy have demonstrated a signature-forgery technique that compromises 1,024-bit RSA keys without recovering the underlying prime factors. The method, termed eNFS, was detailed in a paper that describes a practical implementation against a standard 1,024-bit modulus.
Technical Approach and Required Resources
The attack proceeds in two phases. First, a precomputation stage consumes roughly 1,200 CPU core-years and depends only on the public modulus and exponent. Next, the attacker queries a raw RSA signing or decryption oracle — a service that performs exponentiation without padding — for about 232 carefully chosen inputs. After collecting these oracle responses, the attacker can forge arbitrary signatures or decrypt chosen ciphertexts offline, using an additional ~180 core-years of computation. The entire demonstration required 1,380 CPU core-years spread over five months and leveraged the number-field sieve family of algorithms, specifically a “special” variant that replaces part of the mathematical work with oracle answers. Crucially, the private key and its prime factors are never recovered.
Comparative Security Assessment
Factoring a 1,024-bit RSA modulus is estimated to need 500,000–1,000,000 CPU core-years, making the eNFS effort orders of magnitude cheaper. For larger keys, the researchers project roughly 2^90 work and 2^43 oracle queries against 2,048-bit RSA, and about 2^119 work for 4,096-bit RSA—still below the 128-bit security target used for modern cryptographic standards. The technique is ineffective against RSA implementations that employ PKCS#1 v1.5 or RSA-PSS padding, which embed additional data to thwart raw exponentiation attacks.
Recommended Mitigations and Future Directions
The authors advise operators to disable unnecessary raw RSA interfaces, audit hardware security module (HSM) policies, and limit exposure of signing or decryption oracles. For protocols that rely on blind-signature schemes such as Privacy Pass, more frequent key rotation is recommended. Longer-term, the research community is urged to transition to modern signature algorithms and post-quantum cryptography rather than relying on larger RSA keys as a permanent safeguard.