RSA vulnerable: researchers force digital signatures without extracting the key

Researchers bypass a hardware security module without extracting the key

A joint team from the University of California at San Diego and the French INRIA has demonstrated the possibility of forging RSA signatures on a 1,024-bit key within a hardware security module (HSM), devices used to safeguard cryptographic keys, without ever physically extracting the key. The study, published on September 20 on the IACR Cryptology ePrint Archive repository, represents a significant case study for the security of cryptographic keys.

Quick Answer

The attack does not threaten Bitcoin and Ethereum

Bitcoin and Ethereum use different signing algorithms (ECDSA and Schnorr for Bitcoin, ECDSA for Ethereum), so they are not directly affected by this vulnerability. However, the result raises important questions about the security of hardware modules that safeguard cryptographic keys, including those used by institutional custody providers like BitGo.

How the attack works

The researchers disabled the HSM's FIPS mode, which ensures certified security standards, allowing the device to sign unformatted numbers. They sent approximately 4 billion selected numbers to be signed, analyzing the responses to reconstruct the signing process. This method has been compared to an authentication system that works without ever opening the physical safe.

What are digital signatures

Every cryptographic transaction requires a digital signature created with the user's private key. This signature proves the authenticity of the transaction and its integrity. RSA, developed in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman, is based on the difficulty of factoring very large numbers into prime factors. However, the demonstrated attack did not directly violate this fundamental principle.

Who is really affected

The attack is only effective on RSA implementations without padding, a formatting step that prevents this type of vulnerability. Most modern RSA systems use padding (such as PKCS#1 v1.5 or PSS), making an immediate operational threat unlikely. Some systems, like Cloudflare's Privacy Pass, use blind RSA signatures for privacy purposes, but they are not directly affected by this vulnerability.

The quantum threat remains greater

Announcements declaring "RSA is broken" have a history of exaggeration. In January 2023, Chinese researchers claimed to have developed a quantum method for cracking RSA, but their demonstration was limited to 48-bit numbers, insufficient to threaten real systems. This new study represents a significant advancement, but it remains a classic, not quantum, problem.

The post-quantum future

The study authors suggest that the results provide further evidence for the transition to post-quantum cryptography, designed to resist attacks from quantum computers. For Bitcoin, the main concern involves elliptic curve signatures. Caltech researchers estimated that between 10,000 and 20,000 qubits could be sufficient to perform Shor's algorithm, threatening these signatures. Google has set 2029 as the deadline to complete the migration of its systems to post-quantum cryptography.

Implications for institutional custody

Institutional custody providers like BitGo use hardware security modules to protect cryptographic keys, ensuring that the keys never physically leave the device. This attack demonstrates that, even without extracting the key, it is possible to manipulate the signing process. However, the attack requires specific conditions and significant computational investment, limiting its immediate practical impact.

Compliance and risk management

For companies using RSA, this study underscores the importance of properly implementing padding and keeping security devices in active FIPS mode. Risk management must include regular security assessments of cryptographic systems and planning for the transition to post-quantum solutions. Compliance with standards such as the NIS2 Directive and the DORA Regulation becomes even more critical in this context.

Protection against advanced attacks

To mitigate similar risks, organizations should consider implementing managed SOC services and Managed Detection and Response (MDR) solutions. These services offer continuous monitoring and incident response, crucial for identifying and quickly responding to advanced threats like those demonstrated in the study.

Digital operational resilience

Digital operational resilience, a pillar of the DORA regulation, requires that companies implement robust measures of disaster recovery and business continuity. This includes protecting cryptographic keys and preparing for attack scenarios that could compromise existing security systems.

The importance of post-quantum cryptography

While the demonstrated attack is classic, the broader context underscores the urgency of adopting post-quantum cryptography. Companies should start evaluating solutions that offer resilience against future quantum attacks, ensuring the long-term security of their cryptographic systems. This includes assessing alternative algorithms and implementing zero-trust architectures to improve overall security.