Researchers Forge RSA Signatures From a Hardware Vault Without Extracting the Key: What It Means for Crypto Assets

This article draws mainly on a single Decrypt report, with background on Privacy Pass from Cloudflare's official blog. The research findings described below are the claims of the researchers and organisations involved, as reported by those sources.

What happened

According to Decrypt, researchers from UC San Diego and France's INRIA impersonated a hardware security module (HSM, a tamper-resistant device that stores private keys and signs on request) and forged an RSA signature for a 1,024-bit key without the key ever leaving the device. The team detailed the result in a paper submitted to the IACR Cryptology ePrint Archive on September 20. The paper is a preprint, meaning it has not yet been formally peer-reviewed and published.

Read the full description

Sources are collected, independently checked, then reviewed by Jev.

Decrypt also points out that the demonstration came with important caveats: the researchers turned off the HSM's FIPS mode (a certified security configuration) so that it would sign unformatted numbers, and they used their own test key. According to the report, the process required roughly 4 billion (about 2^32) signing requests and 1,380 CPU core-years of computation.

Notably, according to Decrypt, the authors write that RSA's security is generally understood to rest on the difficulty of factoring large numbers, but breaking RSA has never been proven equivalent to factoring, and the team did not factor any numbers. In other words, this is not "RSA broken mathematically" but an abuse of the signing service itself under a specific configuration.

Are crypto asset holders affected?

According to Decrypt, Bitcoin uses the ECDSA elliptic-curve digital signature algorithm, and its curve also supports Schnorr signatures; Ethereum and most larger blockchains use similar methods. The paper's claims cover only RSA, so Decrypt states plainly that this is not a break of Bitcoin or Ethereum.

Still, the episode is relevant to how assets are custodied. Decrypt cites BitGo as saying institutional custodians use HSMs so that keys never exist outside the device. This research shows that even if a key never leaves the device, the signing capability itself can still be abused if the device is willing to sign arbitrary, unformatted data. For general readers, the takeaway is that "keeping the key well hidden" and "configuring the signing service properly" matter equally.

Which systems deserve closer attention

According to Decrypt, padded RSA signatures do not create an exploitable "oracle", meaning a device that will sign whatever raw input it is given, much like a vault that stamps any blank paper slid under its door. Some systems, however, deliberately offer this kind of signing capability. RSA-based blind signatures let a server sign something without seeing its contents, and one variant of Privacy Pass works exactly this way.

Cloudflare says on its official blog that it began supporting Privacy Pass in 2017, and that Apple uses a version of Privacy Pass in its Private Access Tokens system, letting users prove they passed a check (such as a CAPTCHA) without revealing their identity. Cloudflare also says the related work helped shape standards such as RSA Blind Signatures (RFC 9474). The Decrypt report does not say these systems have been broken; it only notes that blind signatures are a design type that warrants particular attention.

Blind signatures also have roots in cryptocurrency history: according to Decrypt, cryptographer David Chaum was already using the technique when he founded DigiCash in 1989.

The bigger issue: the post-quantum transition

According to Decrypt, the authors describe the result as "classical" (non-quantum) evidence for moving away from RSA during the post-quantum transition, meaning the shift to cryptography that can withstand quantum computers. Decrypt also notes that "RSA broken" headlines are not new: in January 2023, Chinese researchers claimed a quantum method threatening RSA but only factored a 48-bit number, and experts dismissed it. This time the demonstration used a real 1,024-bit key, but with the major caveat of an enormous number of signing requests.

For Bitcoin, according to Decrypt, the real quantum issue lies with elliptic-curve signatures: Caltech researchers estimated in late March that 10,000 to 20,000 qubits may be enough to run Shor's algorithm in a way that threatens such signatures. Decrypt also reports that Google has set 2029 as its deadline for migrating its own systems to post-quantum cryptography.

Frequently asked questions

Browse the latest news in this topic

• Crypto & blockchain