A recent breakthrough in cybersecurity has revealed significant vulnerabilities associated with the blind-signature implementations of the RSA cryptographic algorithm. Researchers led by Daniel Heninger have demonstrated a forgery attack that drops previously accepted security levels to 265, 290, and 2119 for 1024-, 2048-, and 4096-bit keys, respectively. Heninger cautioned that these figures could decline even further, as their team manually coded the attack without leveraging artificial intelligence or GPU acceleration, suggesting that the assistance of modern computational tools could enhance the efficiency of such exploits.
The attack specifically targets systems using blind-signature RSA, a variant of RSA that lacks the padding structures like PKCS or PSS, which are widely deployed in contemporary cryptography. Most implementations of RSA today utilize these padding schemas to append extra data to the plaintext, thereby enhancing security against deterministic ciphertext generation and various forms of side-channel attacks. Nevertheless, certain applications, particularly the Privacy Pass protocol—which enables anonymous user authentication—still employ blind signatures. This method is notably used by major entities such as Apple and Cloudflare.
Executing the attack on Privacy Pass necessitates an adversary to compromise associated servers and facilitate the generation of approximately 243 signatures. While this number seems substantial, Heninger remarked that it is in line with the network traffic Cloudflare publicly claims to process within a single day. Most implementations of Privacy Pass include measures to regularly rotate cryptographic keys, which significantly mitigates, though does not entirely negate, the success probability of such an attack.
The technique exploited in this research utilizes a modified number field sieve algorithm which was initially introduced in 2007. This “special” number field sieve exploits a vulnerability known as an “oracle,” found in RSA and certain other cryptographic algorithms, which is capable of providing binary responses to carefully designed queries. By conducting a vast number of operations, attackers can extract sufficient data to decrypt ciphertext. This method does not pose a practical threat to RSA systems utilizing PKCS or PSS padding due to their ability to eliminate oracle-related vulnerabilities. For context, while factoring a 1024-bit key is predicted to demand around 280 operations and 500,000 to 1 million CPU core-years, the signature forgery took only 265 operations and required 1,380 core-years.
The authors of the study, alongside other cryptographic researchers, have emphasized that the attack, while theoretically potent, does not currently present an immediate risk in real-world applications. Nonetheless, it has dramatically recalibrated the perceived security of textbook RSA implementations in a manner previously unrecognized.
In recent years, cryptographers have intensified their efforts to create alternative security protocols that offer resilience against the emerging threats posed by quantum computing. This latest revelation regarding the vulnerabilities of blind-signature RSA serves as a potential catalyst for businesses and organizations to accelerate their transition away from these outdated cryptosystems. With ongoing advancements in the field, further research into enhancing cryptographic security measures is imperative.
From a cybersecurity perspective, initial access to systems utilizing blind-signature RSA could represent a significant tactic in the MITRE ATT&CK framework. Techniques associated with this attack may include exploitation of software vulnerabilities and targeting of insecure APIs. Business leaders must remain vigilant and proactive in fortifying their cybersecurity strategies to mitigate risks posed by vulnerabilities revealed in these studies.