Security researchers have uncovered a faster method to compromise certain RSA implementations without factoring the public modulus, challenging the notion that RSA’s practical strength always correlates with the cost of integer factorization. The attack transforms temporary access to a raw, unpadded RSA signing or decryption service into the ability to forge signatures or decrypt chosen ciphertexts offline. Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger, and Emmanuel Thomé successfully executed the technique against a 1,024-bit RSA key.

Unlike the general number field sieve used for factoring RSA moduli, it optimizes the "special" number field sieve complexity by substituting part of the standard mathematical work with answers from the signing oracle.

The code is heavily based on CADO-NFS, but it also includes the engineering needed for polynomial selection, sieving, linear algebra, root extraction, and descent at this scale. More realistic targets include HSM interfaces that permit raw PKCS#11 RSA operations and blind-signature protocols like Privacy Pass, where blinded requests can simulate the required oracle behavior. Organizations should not rush to abandon correctly padded RSA immediately.

Protocol designers can explore zero-knowledge proofs of well-formed requests, while migrating to modern signature schemes and post-quantum cryptography is recommended over sticking with larger RSA keys as a permanent solution.