Researchers have devised a classical-computing attack that can forge RSA signatures without factoring the underlying key, challenging the long-held assumption that factoring was the only practical route to breaking RSA. The discovery is conceptually significant but poses little immediate risk to most users because it targets a rarely used form of RSA and requires enormous computing resources.

The attack reduces estimated security to roughly 2⁶⁵ operations for 1024-bit keys, 2⁹⁰ for 2048-bit keys and 2¹¹⁹ for 4096-bit keys, below commonly required security thresholds. It affects blind-signature, or “textbook”, RSA implementations, including some Privacy Pass systems, while widely used RSA with PKCS or PSS padding remains protected; further optimisation using GPUs or AI could reduce the costs.