New Method Compromises 1,024-Bit RSA Keys Without Factoring
A team from UC San Diego and Inria Nancy has shown a new way to break 1,024-bit RSA encryption without factoring the underlying primes, using only 1,380 CPU core-years. The method, based on a variant of the number field sieve, could lower the security of even 2,048-bit and 4,096-bit keys if confirmed. The attack does not work against RSA with common padding schemes, limiting its immediate impact.
The attack leverages a variant of the number field sieve first proposed in 2007, but this is the first time it has been executed at sufficient scale. The researchers used an academic cluster over five months, consuming 1,380 CPU core-years—far less than the estimated 500,000 to 1 million core-years needed for traditional factoring. The method targets RSA implementations lacking PKCS#1 v1.5 or PSS padding, which are common in some protocols like Privacy Pass but not in most standard web traffic. The NIST already plans to phase out RSA by 2030, and this work could accelerate that timeline if peer review confirms the results.
If confirmed, this method could undermine confidence in RSA for long-term data protection, especially for organizations using unpadded implementations. Governments, cloud providers, and certificate authorities may need to accelerate migration to post-quantum or elliptic-curve alternatives. However, the high computational cost and padding limitations mean immediate real-world impact is likely limited, though it could pressure standards bodies to tighten deprecation schedules.