7
—
New Forgery Attacks Threaten RSA Security
Recent research has uncovered new forgery attacks that drastically reduce the security levels of RSA encryption. These attacks lower the security levels to 265, 290, and 2119, corresponding to 1024-bit, 2048-bit, and 4096-bit keys. Despite being coded manually without the use of AI or GPUs, further advancements in technology are likely to further weaken security levels.
Targeted Implementation
The forgery attack is effective only against blind sign implementations of RSA. Most RSAs in use today utilize PKCS or PSS padding, adding a layer of security by preventing determinism in ciphertext. However, some systems continue to use blind signatures, such as the popular Privacy Pass protocol used by companies like Apple and Cloudflare.
Implications for Privacy Pass
Attacking Privacy Pass requires compromising a server and generating two Security Passes signatures. While implementing key rotation reduces the attacker’s success rate, the threat still remains due to the use of textbook RSA and the underlying vulnerabilities it presents.
New Attack Technique
The newly developed numerical field sieving algorithm targets weaknesses in RSA and other cryptographic systems that provide “yes” or “no” responses to specific queries. This technique, while posing minimal real-world threat currently, highlights the need for alternative cryptographic systems that are more resilient to attacks.
Urgency for Divestment
Cryptographers are working tirelessly to create cryptographic systems that can withstand quantum computing attacks. The emergence of these new attacks further emphasizes the urgency for transitioning away from susceptible cryptosystems.
For more detailed information, refer to the research paper here.
Source: arstechnica.com
