Oh good, more bad news
Useful information: https://eprint.iacr.org/2026/2131.pdf
So for RSA without padding, a threat actor could request lots of tokens (without getting rate-limited?), and use that as information to more precisely focus efforts to brute-force the key, and thereby reducing the number of operations required to do so? Or am I misunderstanding it?
That’s what I think I read as well.
This is interesting but it’s essentially a protocol attack against a certain type of RSA signature. It talks about PKCS5 not being affected. Says nothing about OAEP which I’d hope also holds up.
tell me again why people still use RSA?
Modern crypto systems don’t. They’re still available for legacy interoperation, but modern stuff uses ed25519 and the like.
RSA has been around a long time and is relatively easy to understand and implement. But for new deployments we’re supposed to use ECC instead. The comment earlier about P vs NP is unfortunately confused. Factoring is not known to be NP-hard and it probably isn’t.
We can actually make stronger claims about factoring. We know for certain do that it is not in NP hard, so you are correct there
And I’m not exactly a security expert, but moving away from RSA at this point makes sense. Early assumptions about the difficulty of factoring large semi-primes certainly hasn’t panned out (in particular in light of the growing risk of quantum computers.)
Factoring is at most NP-complete because we have a polynomial time verification for it.
Factoring is not NP-complete because it is not a member of NP-hard.
You are correct that verifiability is in there, but you have to also be able to do the reduction.
There are plenty of problems out there where we lack polynomial time solutions, while the problem also lacks the expressiveness required to reduce back and forth.
Factoring is not in any category because we don’t have a proof for it. As it stands, the algorithms we have require exponential time in the worst case, but solutions can be verified in polynomial time, which is NP-complete. I said “at most” for a reason.
Also, every algorithm is verifiable. If there’s no better way to do it then re-running the algorithm and that algorithm is exponential, then it’s NP-Hard.
Factoring is in a category. Everything computable exists somewhere. We know factoring to be in NP.
What I was disagreeing with was the “at least” and “at most” characterization of NP completeness. It is a set, not a boundary. The actual diagram of the complexity zoo is much more complicated than concentric circles.
And for verifiability, I was not referring to it as an existential sort of thing. I was simply saying that I agreed with you in that particular facet, but it isn’t sufficient to describe NP completeness. You also need NP-hardness.
RSA is secure because it relies on P vs NP. Very basically, RSA multiplies 2 very large prime numbers together to encrypt things. We rely on something similar for secure Internet connections
it relies on P vs NP
That is incorrect. It relies on perceived difficulty of factoring large semi-prime. P equals NP is related, of course, if it happens to be an NP-intermediate problem, but the difficulty of factoring is not because it’s NP-complete.
There are already classical algorithms that are sub-exponential to solve the problem. If it were the case that the problem was NP-complete, then we would have had a big advance in our theory and practice based on it.
I’m not about to get into the weeds about P vs NP to explain a concept to someone that doesn’t know much about encryption in the first place. I’m aware that factoring isn’t really NP complete, but P vs NP is about solving vs verifying solutions for something in Polynomial time, which can’t be done via brute force for RSA keys.
really NP complete
I don’t care who you want to get in the weeds with or what you wish to spar about, you’re just not correct.
There is no almost NP complete. There are strong and weak variants, sure, and those have particular implications.
But you’re drawing conclusions that don’t exist from definitions that you clearly don’t understand.
Signed: Somebody who has taught theory of computation for over a decade.
If you want to be pedantic, fine. Integer factoring is not in P. Therefore the math used to encrypt RSA is not in P. The usage of integer factoring to encrypt therefore means it can’t be decrypted in P using brute force. That’s the point I’m making.
We actually don’t know if integer factorization is not in P, though.
Right now, I think most of us would guess that it is a prime candidate for NP Intermediate. Hence why I mentioned it earlier.
And you absolutely can solve it in polynomial time just not with classical architectures.
but do we not have other, much more secure encryption that is just as easy to employ?
There are tradeoffs with encryption. RSA is so secure, that the US government has tried to insert a mathematic backdoor into the key selection because that’s the easiest method to attack the encryption. RSA uses thousands of bits for their encryption, making it inefficient for most attacks. The attack detailed in this article is on one of the weaker RSA algorithms, with only 1024 bits. The high end RSA uses 4096 bits or more, I believe the algorithm has increased the bit length to officially support 8192.
On the other side of RSA is another secure algorithm called AES. It can go up to 512 bits, but it hashes the key to meet the key length instead of relying on generating huge prime numbers. It makes it more resilient to certain types of attacks, but the bit limitation makes it easier to brute force or use rainbow tables.
AES is asymmetric encryption and cannot be used for the same things as RSA. EdDSA would be more comparable to RSA.
I know that AES is symmetrical. I was using it to illustrate that symmetrical and asymmetrical encryption have tradeoffs that cannot be worked around.
Thanks for this answer. The article makes it sound as though even the 4096-bit versions are now more or less trivial to defeat given a bit of money for a capable machine and this new method:
Even for 2048- and 4096-bit keys, the method reduces the security of RSA to unacceptable levels. The National Security Agency, National Institute of Standards and Technology, and European Union Agency for Network and Information Security require that any cryptosystem should provide a level of no less than 128 or more bits, meaning the operations required must exceed 2^128.
The forgery attack drops these levels to 2^65, 2^90, and 2^119 for 1024-, 2048-, and 4096-bit keys respectively. These levels may further drop because Heninger’s team did all the coding by hand and used no AI or GPUs in performing the forgeries. The researcher said these tools will “almost certainly” drop the security levels further.
Yes it’s becoming more common to have Elliptic Curve keys. But many still use RSA.
Elliptical curve for RSA was immediately phased out as soon as it was proven that the NIST was influenced by the NSA to implement it
And if I remember correctly, I believe it has more weaknesses (especially potential unknown ones) than RSA.
But it’s definitely more efficient on embedded hardware, and for sure still gets used in that space. Not that I’d know cough cough
Well, as they say the S in IoT is for security
Ohhh so that’s what they meant by putting IoT nodes on the Edge!
Yes we’re supposed to use ECC instead of RSA now. The major crypto libraries support it so you just configure your program to use it.
deleted by creator
