On 28/09/2026 17:15, Robert J. Hansen via Gnupg-users wrote:
A new paper has been published[1] presenting attacks on RSA signatures. The paper is legitimately interesting, but not panic-worthy.Shea-Haller (as I'm calling the paper, after the leading two authors) is interesting but not without fault. The first sentence in their abstract has a claim the field cannot quite support. They claim, "[t]he security of RSA is generally understood to be based on the complexity of factoring." Well, that's just not true, the security of RSA has never been proven equivalent to factoring. More to the point, there are good reasons to think it can't be. Cryptographers call the task of breaking RSA "the RSA problem," or RSAP. The problem of factoring large composites is "the integer factorization problem," or IFP. The RSA conjecture — and be sure to call it that — is RSAP = IFP.[2] We'll call this conjecture RSAC. We've had strong hints as far back as 1998 that RSAC was not strictly true. At EUROCRYPT '98 Dan Boneh, one of the smartest cryppies of his generation, presented with Ram Venkatesan a fairly strong bit of evidence[3] RSAC was false. Unfortunately, the Boneh-Venkatesan result didn't really lend itself well to follow-up papers. It took a few years to see more published results related to RSAC, such as a 2007 paper by Joux, Naccache, and Thomé[4]. The Shea-Haller paper builds on the Joux, Naccache, and Thomé paper. It's legitimately good work: it's going to have cryppies the world over talking. At the same time, it's not something working nerds need to worry about. The overwhelming majority of computer systems that use RSA add a little special seasoning[5] to the mix that foils this kind of attack. Neither LibrePGP nor OpenPGP are susceptible to this attack. Don't panic. You're probably not at risk. RSAC is probably false, but that's okay. 1 https://eprint.iacr.org/2026/2131.pdf 2 Sigh, okay, fine: "polynomial-time reductions exist between instances of RSAP and IFP." 3 https://crypto.stanford.edu/~dabo/papers/no_rsa_red.pdf 4 https://eprint.iacr.org/2007/424 5 Okay, fine: it's a mix of cayenne pepper, salt, and MSG. Happy?
Dear Mr. Hansen, As a working nerd who also deals with other uses of the RSA algorithm, it would be nice to know which seasonings counteract this new poison and the old results that it builds upon. I happen to be the designer of at least one non-public protocol that touches RSA, and thus had to do my own seasoning back in the day, thus this is not just curiousity. Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded
_______________________________________________ Gnupg-users mailing list [email protected] https://lists.gnupg.org/mailman/listinfo/gnupg-users
