Cryptographers Confront RSA Signature Forgery Path That Sidesteps Factoring

A Threat Model Nobody Expected

The RSA cryptosystem has lived under a known death sentence for years. Quantum computers, once mature, will tear through its defences. Most timelines place that reckoning somewhere between three and twenty years out, depending on whom you ask and how optimistic their engineering assumptions run. What cryptographers did not anticipate was a classical route that could undermine RSA's security margin this dramatically, this soon.

A team has now demonstrated a signature forgery technique that breaks 1024-bit RSA keys in a matter of months on ordinary academic CPU clusters. The method does not rely on factoring large integers, the mathematical problem that has anchored RSA's security architecture since the 1970s. Instead, it constructs forged signatures directly, a fundamentally different attack surface that existing defences were not designed to address. The practical risk remains bounded: widely deployed RSA implementations and key sizes above 1024 bits remain secure for now. But the research has unsettled the field because it collapses the resource threshold for breaking weak RSA from nation-state budgets to university lab scale.

Why Signature Forgery Changes the Equation

RSA's resilience has always rested on a single hard problem: given a very large composite number, find its prime factors. Breaking that problem requires either a sufficiently powerful quantum computer running Shor's algorithm or an implausibly large classical computing effort. Current estimates for factoring a 1024-bit RSA modulus using classical methods place the cost in the realm of what only governments or the largest technology companies could marshal.

Signature forgery bypasses that bottleneck. Rather than attempting to recover the private key by factoring, the attack synthesises valid signatures for arbitrary messages without ever knowing the key. The computational cost drops by orders of magnitude because the attacker no longer needs to solve the underlying integer factorisation problem. The technique exploits structural weaknesses in how certain RSA implementations handle signature generation, turning what should be a one-way operation into something tractable on modest hardware.

This distinction matters because it severs the link between RSA security and factoring difficulty. For decades, cryptographers have treated those two concepts as synonymous. If you could not factor the modulus, you could not break RSA. That equivalence no longer holds universally. An adversary with access to this forgery method can compromise certain RSA deployments without touching the factoring problem at all.

The 1024-Bit Threshold and What It Means Today

The attack demonstrated in the research targets 1024-bit RSA keys, a key size that has been officially deprecated for more than a decade. Industry standards bodies and certificate authorities stopped issuing 1024-bit certificates in 2013, and most modern systems have migrated to 2048-bit or 4096-bit keys. The attack does not threaten those larger key sizes, at least not with current computational resources.

Yet 1024-bit RSA has not disappeared. Legacy systems, embedded devices, and older enterprise infrastructure still rely on it. In some regulated industries and government networks, upgrading cryptographic implementations requires lengthy approval cycles and compatibility testing. The gap between best practice and deployed reality remains wide. An attack that can break 1024-bit RSA in months rather than decades transforms those legacy systems from theoretically vulnerable to practically exploitable.

At Opentechwire, we have tracked the slow decay of cryptographic standards across Asia's industrial base. Manufacturing control systems in South Korea, payment terminals in Indonesia, and telecommunications equipment across Southeast Asia often run firmware that has not been updated in years. The cost of replacing or patching that equipment is high, and the perceived urgency low, because the threat model has always assumed that breaking RSA required either a quantum computer or a supercomputer. This research narrows that window considerably.

Classical Computing and the Resource Gap

The significance of this work lies not just in the method but in the resource profile. Factoring a 1024-bit RSA modulus using the general number field sieve, the most efficient classical factoring algorithm, would require a computing effort measured in tens of thousands of core-years. That places it beyond the reach of most attackers, even well-funded ones. The signature forgery technique collapses that requirement to something achievable on a mid-sized academic cluster in a few months.

This shift in accessibility changes the threat landscape. Nation-state actors have always been assumed capable of breaking weak RSA if they committed the resources. Now, that capability extends to well-resourced criminal organisations, corporate espionage teams, and even determined individual researchers. The attack does not require exotic hardware or access to classified algorithms. It runs on commodity CPUs, the kind available through cloud providers or university computing centres.

The implications ripple outward. Systems that were considered "good enough" because breaking them required implausible resources are now vulnerable to a much broader set of adversaries. The margin between theoretical vulnerability and practical exploitation has compressed.

What Remains Secure, and for How Long

Modern RSA implementations using 2048-bit or 4096-bit keys are not immediately at risk. The signature forgery technique scales poorly with key size, and the computational cost rises steeply enough that current hardware cannot bridge the gap. Cryptographers stress that organisations following current best practices, rotating keys regularly, and using recommended key sizes have no immediate cause for alarm.

But the existence of this attack path raises uncomfortable questions about what else might be possible. If signature forgery can undermine 1024-bit RSA without factoring, could similar techniques apply to larger keys given further algorithmic refinements or more powerful hardware? The research does not answer that question, but it opens the door to it. Cryptographic security has always relied on the assumption that certain problems are hard. When a new method demonstrates that a problem everyone thought was hard can be solved more easily, it forces a re-evaluation of the entire threat model.

The quantum threat remains the longer-term concern. Post-quantum cryptography standards are being rolled out, and organisations are beginning the slow process of migrating away from RSA entirely. This classical attack does not change that timeline, but it adds urgency to the migration for anyone still relying on deprecated key sizes.

The Asia Dimension: Legacy Infrastructure and Upgrade Cycles

Asia's cryptographic landscape is fragmented. Singapore's financial sector and Japan's telecommunications networks have largely moved to modern standards, but the region's manufacturing hubs, logistics networks, and smaller economies lag behind. The cost of upgrading embedded systems is high, and the perceived risk of cryptographic compromise has traditionally been low enough that it gets deprioritised.

This research shifts that calculus. A 1024-bit RSA key that seemed "probably fine" because breaking it required a quantum computer or a national intelligence agency now falls within reach of a much wider set of attackers. For supply chain operators, industrial control vendors, and payment processors across the region, the window for safe deprecation has narrowed. The question is no longer whether to upgrade, but how quickly it can be done before someone exploits the gap.

Regulatory frameworks in the region have been slow to mandate cryptographic hygiene. China's Cryptography Law and Singapore's Cybersecurity Act set baseline requirements, but enforcement varies, and legacy systems often receive exemptions. The technical capability to break weak RSA at scale may force regulators to tighten those requirements faster than they otherwise would have.

What This Means for Cryptographic Assumptions

The broader lesson is about assumptions. Cryptographers have built security models on the premise that RSA's security is equivalent to the difficulty of factoring. That premise has held for decades, and it has shaped everything from protocol design to key-size recommendations. This research demonstrates that the equivalence is not absolute. There are other ways to attack RSA, and some of those ways are easier than factoring.

That realisation does not invalidate RSA overnight, but it does erode confidence in the margins. When a cryptographic system's security depends on a single hard problem, discovering an alternative attack path weakens the entire structure. The fact that this attack emerged from classical computing, not quantum, makes it more immediate. Quantum threats are still years away; this one is here now, at least for weak keys.

The cryptographic community will now scrutinise other public-key systems for similar vulnerabilities. If RSA can be broken without factoring, can elliptic-curve cryptography be broken without solving the discrete logarithm problem? The answer is probably not, but the question is now worth asking in a way it was not before.

The timeline for RSA's obsolescence has not changed dramatically, but the path to that obsolescence has become less predictable. That uncertainty is, in some ways, more disruptive than a clear threat. It forces organisations to hedge, to accelerate migrations they might have delayed, and to reconsider what "good enough" means in a landscape where the rules are shifting faster than expected.