- Published on
A Clever RSA Attack Fooled a Hardware Vault—Here's What It Means for Crypto
- Authors
- Name
- DeepHorus
Researchers at UC San Diego and France’s INRIA forged RSA signatures on a 1,024-bit key inside a hardware security module without extracting it. They submitted the paper to the IACR Cryptology ePrint Archive on September 20. The result tests assumptions behind devices used for institutional crypto custody.
The team impersonated the module and obtained about 2^32, or four billion, signatures on chosen, unformatted numbers. The computation took 1,380 CPU core-years, enabling mathematical analysis that produced forgeries. The private key remained inside the tamper-resistant device throughout.
The researchers disabled the module’s certified FIPS mode and used their own test key. This exposed a signing oracle by allowing attacker-controlled inputs outside normal formatting. The authors said those unusual conditions make the attack unlikely to threaten modern RSA deployments, which use padding.
RSA, introduced in 1977 by Ron Rivest, Adi Shamir and Leonard Adleman, relies on the difficulty of factoring two large primes’ product. The team neither factored the key nor proved forgery equivalent to factoring. Standard schemes add padding such as PKCS#1 v1.5 or PSS, which prevents the reported oracle.
Bitcoin and Ethereum use ECDSA and other elliptic-curve signatures, not RSA, so this demonstration did not affect their transaction systems. RSA blind signatures intentionally let a server sign unseen data, and Cloudflare said Apple uses a Privacy Pass variant. The work nevertheless shows that hardware isolation cannot address unsafe modes, protocols or inputs.
The authors presented the work as classical evidence for moving away from RSA during the post-quantum transition, while quantum threats to elliptic curves remain separate. Because it is a preprint, peer review and further testing are still needed to establish its practical scope. Its immediate significance is a warning about RSA hardware workflows, not a cryptocurrency crisis.
