Cryptographers Forge RSA Signatures Without Factoring the Key, While a Separate Team Uses Claude to Factor a 896-Bit RSA Number

Since EU financial regulators warned this week that quantum computers could break encryption before the technology is commercially ready, two separate pieces of research have shown that classical computers are already chipping away at RSA's math, no quantum hardware required.

The bigger of the two comes from a team led by Nadia Heninger, a University of California San Diego professor, along with Laura Shea, Miro Haller, Adam Suhl and Emmanuel Thomé. According to Cybersecurity News, the group demonstrated a way to forge RSA signatures on a 1,024-bit key without ever computing the private key or factoring the modulus, something cryptographers had long assumed was impossible.

How the attack works

The method, which the researchers call eNFS, needs temporary access to a raw, unpadded RSA signing oracle. Once it has that access, it can forge signatures or decrypt messages offline, indefinitely, even after the oracle access is cut off.

Cybersecurity News reported the full attack took 1,380 CPU core-years spread over five months and required 232 queries to the oracle. Compare that to the 500,000 to one million core-years typically estimated to factor a 1,024-bit RSA modulus outright. That is a difference of roughly three orders of magnitude.

Karsten Nohl, head of innovation at the security firm Allurity, told Ars Technica the result would be "a conceptual breakthrough" if it holds up under peer review, since it breaks the long-standing assumption that forging an RSA signature is exactly as hard as factoring the key. Heninger told Ars Technica that computing a private key for a 1,024-bit key by brute-force factoring was thought to cost tens of millions of dollars, achievable only by large tech companies or the NSA, and that 2,048-bit factoring was considered completely out of reach.

The forgery method does not close that gap entirely, but it does erode it. Cybersecurity News reported the researchers estimate roughly 2^90 of work and 2^43 oracle queries would be needed against 2,048-bit RSA, and about 2^119 of work for 4,096-bit keys, both short of the 128-bit security floor that NIST and the EU Agency for Network and Information Security require of modern cryptosystems. Ars Technica put those same figures at 2^65, 2^90 and 2^119 bits of effective security for 1,024-, 2,048- and 4,096-bit keys, respectively, down from the 128-bit target regulators expect.

The attack has real limits

This is not a break of RSA as most people use it. Cybersecurity News and Ars Technica both note the technique only works against "raw" RSA operations without proper padding, meaning it does not touch the PKCS#1 v1.5 or PSS padding schemes used in almost all deployed RSA signatures and certificates today. The realistic targets are narrower: hardware security modules that expose raw PKCS#11 RSA operations, and blind-signature protocols such as Privacy Pass, where the blinding process can behave like the oracle the attack needs.

Heninger also flagged that her team did the computation by hand, with no AI assistance and no GPUs. She told Ars Technica those tools would "almost certainly" push the security levels down further.

A second, unrelated development underscores that warning. According to Quantum Zeitgeist, Steve Weis, a member of Anthropic's Secure Frameworks team, reported factoring a 896-bit RSA challenge number using Claude to help adapt the CADO-NFS factoring software for GPUs and to orchestrate the run across roughly 2,048 GPUs over about 10 days, consuming around 30 GPU-years of compute. Quantum Zeitgeist also noted that earlier in September, Eric Lu of Cognition used the company's Devin coding agent to factor a smaller 260-bit RSA challenge.

Weis was direct about the limits of his own result: it does not improve the underlying General Number Field Sieve algorithm, and it does not threaten deployed 2,048-bit RSA keys. He argues, per Quantum Zeitgeist, that it does show 1,024-bit RSA is within reach of any organization with data-center-scale GPU access, a threat model that increasingly includes ordinary well-funded companies, not just nation-states.

What the migration guidance actually says

None of this is happening in a vacuum. NIST finalized its first three post-quantum cryptography standards, FIPS 203, 204 and 205, on August 13, 2024, and the industry has spent two years migrating toward ML-KEM as a replacement for RSA and elliptic-curve key exchange, according to Shattered.io. That site put a number on the transition cost: hybrid post-quantum key exchange adds roughly 4% to handshake latency and 1 to 2 kilobytes of overhead per connection, citing benchmark data from Cloudflare and Google's Chrome engineering team.

The practical case for panic is thin. Widely deployed, correctly padded RSA in TLS, SSH and code signing is not affected by either result. But the argument for urgency is that the margin between deployed and broken keeps shrinking faster than expected, and neither the signature-forgery paper nor Weis's factoring result has needed a quantum computer to do it.

The Heninger paper is still undergoing peer review. Whether it holds up will determine how seriously HSM vendors and blind-signature protocols like Privacy Pass need to rotate keys and audit raw RSA exposure in the near term, an open question neither Ars Technica nor Cybersecurity News has an answer to yet.