A new forgery attack on RSA encryption has been reported, significantly reducing the security levels of 1024-, 2048-, and 4096-bit keys to 265, 290, and 2119 respectively. This development, detailed by researchers led by Heninger, indicates that these levels may decrease further as the team performed all coding manually without the aid of AI or GPUs, suggesting that the use of such tools could enhance the attack’s effectiveness. The findings were published by Ars Technica.
Vulnerability in Blind-Signature Implementations
The attack specifically targets blind-signature implementations of RSA, which are less common than those using PKCS or PSS padding. The latter formats add data to plaintext before encryption, making the ciphertext non-deterministic and less susceptible to various attacks. However, some systems still utilize blind-signature RSA, with Privacy Pass being a notable example. This protocol allows users to authenticate without revealing their identity and is employed by major companies like Apple and Cloudflare.
Potential Impact on Privacy Pass
To successfully exploit Privacy Pass, an attacker would need to request tokens from the service provider 243 times. While this may seem substantial, Heninger noted that it is comparable to the network traffic Cloudflare handles in a single day. Most implementations of Privacy Pass rotate keys regularly, which mitigates but does not completely eliminate the risk of successful attacks.
Technical Details of the Attack
The forgery technique employs a variant of the number field sieve algorithm, originally developed in 2007. This specialized version utilizes an “oracle,” a feature of certain cryptographic protocols that provides answers to specific queries. The attack requires significantly fewer operations compared to traditional key factoring methods; for instance, while factoring a 1024-bit key typically demands around 280 operations, forging a signature with this new method only requires 265 operations and approximately 1,380 core-years of computational effort.
Follow Cyber Warriors Middle East for further global cybersecurity developments.
