Researchers have forged RSA signatures in a hardware security module without key extraction, raising concerns about RSA's security.
Summary
- Researchers from UC San Diego and France's INRIA successfully forged RSA signatures using a 1,024-bit key in a hardware security module, achieving this without extracting the key.
- This research is focused on RSA signatures, while Bitcoin and Ethereum use elliptic-curve digital signatures.
- The attack required around 4 billion signing requests and 1,380 CPU core-years, but the authors assert that it does not threaten most modern RSA systems using padding.
In a groundbreaking study, researchers from UC San Diego and the French Institute for Research in Computer Science have demonstrated the ability to forge RSA signatures within a hardware security module (HSM) without needing to extract the private key. This significant finding, detailed in a paper submitted to the IACR Cryptology ePrint Archive on September 20, raises questions about the security of RSA cryptography.
Despite the implications of this research, cryptocurrency users can breathe easy; the vulnerabilities discussed do not apply to Bitcoin or Ethereum. These cryptocurrencies rely on elliptic-curve digital signature algorithms (ECDSA), which are different from the RSA method studied.
The research highlights the importance of key protection mechanisms, particularly as institutional custody providers use HSMs to safeguard private keys. Remarkably, the researchers were able to generate forged signatures without the key ever leaving the device.
To carry out their experiment, the team disabled the hardware module's FIPS mode, a certified security setting, allowing them to sign arbitrary numbers with a test key they created. They then requested signatures for about 4 billion chosen numbers, analyzing the outcomes to illustrate their findings.
Understanding Digital Signatures
Digital signatures are crucial in confirming transactions, using private keys to sign and ensuring the integrity of messages during transmission. RSA, established in 1977, is one method of creating these signatures, relying on the difficulty of factoring large prime numbers.
The authors emphasize that while their method does not involve actual factorization, it raises critical questions about RSA's security, particularly as most RSA implementations use padding methods that mitigate such attacks.
Potential Implications
The study suggests that RSA-based systems employing padding are generally safe from this specific attack. However, certain systems that provide an oracle, such as RSA-based blind signatures, may require more scrutiny, especially in applications like Privacy Pass.
Despite the concerns raised, the authors caution against overreacting to claims that "RSA is broken." Previous reports of quantum threats have often been dismissed as negligible. Nonetheless, this research underscores the need for a shift towards quantum-resistant encryption as the era of quantum computing approaches.
For Bitcoin, the future threat lies in elliptic-curve signatures, with estimates suggesting that between 10,000 and 20,000 qubits could potentially execute algorithms that compromise these signatures. Google aims to transition to post-quantum cryptography by 2029.
