New Subexponential Forgery Attack Demonstrated Against Pure RSA Signatures
What Happened — Researchers published a 2026 implementation of a 2007 cryptographic attack that can forge RSA digital signatures when the signature is generated without any padding. The method runs in sub‑exponential time and succeeded in forging 1024‑bit RSA signatures after roughly five months of compute (≈ 1 380 CPU core‑years). The attack does not recover the private key; it merely creates a valid signature for arbitrary messages.
Why It Matters for Trust & Control Assurance
- It tests the control objective of cryptographic protection – ensuring only approved algorithms and proper implementation safeguards (e.g., padding) are used.
- Continuous control‑assurance programs must capture evidence that legacy “pure” RSA is retired and that approved padding schemes (RSA‑PSS, PKCS#1 v1.5) are enforced.
- Demonstrates the need for control mapping across frameworks so that audit evidence can show compliance with cryptographic policy requirements.
Who Is Affected
- Enterprises that still rely on raw RSA signatures for code signing, authentication tokens, or financial transaction validation.
- SaaS platforms, PKI services, and any legacy infrastructure that has not migrated to padded RSA or elliptic‑curve alternatives.
Recommended Actions
- Audit all systems that generate RSA signatures and verify that a padding scheme is applied.
- Update cryptographic policies to deprecate raw RSA and mandate approved padding (RSA‑PSS) or modern algorithms (ECDSA, EdDSA).
- Collect and retain evidence of algorithm usage (configuration files, library versions) for audit readiness.
Technical Notes – The attack exploits the mathematical structure of unpadded RSA signatures; it is a subexponential‑time algorithm (not polynomial) and required 1 380 CPU core‑years to forge a 1024‑bit signature. No CVE is associated because the weakness lies in algorithmic usage, not a software defect. Source: Schneier on Security