What happened
The first paper addresses computing roots modulo N when an attacker has prior access to a signing “oracle” – in practice, a device signing data with an RSA key via a PKCS#11 interface, such as an HSM. The authors show that when an attacker controls approximately half or more of the signed block, padding ceases to provide protection. This also extends to long data in PKCS#1 v1.5 format. The 1024-bit computation itself was conducted on a “raw,” unpadded signature.
On the same problem instance used in prior work, obtaining the first root required 391 CPU core-years instead of 1,380. Two collaborating AI agents designed, executed, and debugged the computation in less than four days; according to SecurityWeek, the researcher sent them approximately 20 messages, consisting primarily of approvals. The attack requires roughly 4 billion advance queries to the signing device and does not recover the private key.
The second paper addresses the factorization of multiple keys of the same length: following an initial large precomputation, each subsequent 1024-bit key would theoretically be on average about 30 times cheaper to factor than with the best existing method. This remains a theoretical estimate – the method has not been implemented. The authors emphasize that these findings do not threaten deployed systems using RSA keys of 2048 bits or longer.
Key findings
- 391 instead of 1,380 CPU core-years – 3.5x reduction on the exact same problem instance.
- Prerequisites: approximately 4 billion queries to the signing device in advance; per SecurityWeek, the method fails against devices that independently hash the message to be signed.
- Key was not recovered; factoring it would require between 500,000 and 1,000,000 core-years according to SecurityWeek.
- Batch factorization: roughly 30x cheaper for each subsequent key – currently theoretical.
- RSA keys of 2048 bits and longer remain secure, according to the authors.