1024-Bit RSA Keys Broken by New Signature-Forgery Method

A team led by University of California San Diego professor Nadia Heninger forged valid RSA digital signatures without factoring the underlying private key, cracking deprecated 1024-bit RSA in a matter of months on an academic CPU cluster, according to research described by Ars Technica on Sept. 24, 2026.

The result, which has not yet completed peer review, is the first documented method for breaking RSA blind-signature implementations through signature forgery rather than the factoring process cryptographers have treated as the only path to breaking the system for decades, Ars Technica reported.

What Method Did Heninger's Team Use?

"Cryptographers thought that the only way to compute valid RSA digital signatures was to first compute the private key by factoring, and then use the private key to compute the signatures," Heninger said, according to Ars Technica. For 1024-bit RSA, factoring was believed to require roughly tens of millions of dollars in computation time, resources available mainly to large tech companies or the NSA. For 2048-bit RSA, factoring was considered "totally out of reach," Heninger said. Her team's forgery approach instead produces valid signatures directly, bypassing that factoring step entirely.

How Much Does the Attack Cut Security Levels?

NIST, the NSA and the European Union Agency for Network and Information Security require cryptosystems to provide at least 128 bits of security, meaning an attacker must perform more than 2^128 operations to break them, Ars Technica reported. The forgery method drops that threshold to 2^65 for 1024-bit keys, 2^90 for 2048-bit keys and 2^119 for 4096-bit keys, according to the outlet's account of the research.

Could AI or Faster Hardware Push the Numbers Lower?

Heninger's team wrote all the attack code by hand and used no AI tools or GPUs to perform the forgeries, according to Ars Technica. The researcher said those tools would "almost certainly" reduce the security levels further, meaning the current figures may represent a ceiling rather than a floor for the technique's eventual performance.

Is Widely Used RSA at Risk Right Now?

The attack works only against blind-signature implementations of RSA, Ars Technica reported. The overwhelming majority of RSA deployed today uses PKCS or PSS padding, formats that add data to the plaintext before signing and that the current method does not defeat. Practical risk to standard, widely deployed RSA remains limited for now, even as the 1024-bit result stands as a direct, near-term threat to that already-deprecated key size.

What Do Other Cryptographers Say About the Finding?

Karsten Nohl, head of innovation at the security firm Allurity, called the implications significant if the work withstands scrutiny. "If this result holds up under peer review, it would indeed be a conceptual break-through," Nohl said, according to Ars Technica. "RSA is as difficult to break as it is to factor large integers, at least so we thought. The researcher suggests that you can practically break RSA without cracking its key." Peer review of the paper is ongoing, and cryptographers are expected to test whether the forgery technique can be extended beyond blind-signature schemes to the padding formats that secure most RSA traffic today.