The practical risk is limited, but still significant. Applying the attack against the deprecated use of 1024-bit keys took a handful of months on an academic CPU cluster, significantly less than the current estimates for 1024-bit factoring that would require resources that only nations or companies with massive resources could achieve. Widely used RSA implementations are also safe.

Nonetheless, the research has taken cryptographers by surprise because it introduces signature forgery, a new way to break RSA keys without factoring. Equally important, this novel method reduces the required computing resources by orders of magnitude.

Soooo, alternatives? Age?

This is interesting but it's essentially a protocol attack against a certain type of RSA signature. It talks about PKCS5 not being affected. Says nothing about OAEP which I'd hope also holds up.

So for RSA without padding, a threat actor could request lots of tokens (without getting rate-limited?), and use that as information to more precisely focus efforts to brute-force the key, and thereby reducing the number of operations required to do so? Or am I misunderstanding it?

Oh good, more bad news

The practical risk is limited, but still significant. Applying the attack against the deprecated use of 1024-bit keys took a handful of months on an academic CPU cluster, significantly less than the current estimates for 1024-bit factoring that would require resources that only nations or companies with massive resources could achieve. Widely used RSA implementations are also safe.

Bold emphasis is mine. It's a nothing Burger article.

Useful information: https://eprint.iacr.org/2026/2131.pdf

An attack on Privacy Pass would require an attacker to request 2^43^ tokens from Cloudflare, Apple, or another organization.

An attack on Privacy Pass would require an attacker to request tokens from Cloudflare, Apple, or another organization 2^43 times.

... is there a button I can push to summon a copy editor?

Personally I'd go with the former, probably not both simultaneously.

“If this result holds up under peer review, it would indeed be a conceptual break-through,” Karsten Nohl, a cryptography expert and the head of innovation at Allurity, said in an interview.

Emphasis mine. It's also only problematic for blind-signature types.

The attack works only against blind-signature implementations of RSA. The overwhelming majority of RSA in use today provides PKCS or PSS padding, a format that adds data to the plaintext before it’s encrypted.

So even if it passes peer review, it's only an issue for older implementations.

The forgery attack drops these levels to 2^65, 2^90, and 2^119 for 1024-, 2048-, and 4096-bit keys respectively.

Well that's terrifying, and all the more reason to get off of RSA signatures and onto anything else, probably EdDSA. Even though the article and paper don't address the real-world systems which use padding, the algorithmic safety that underpins RSA is under serious scrutiny. It's hard to see how RSA 4096-bit keys can remain as a first choice, when this type of attack exists and there are credible alternatives, both PQC and not.

The fact of the matter is that for signatures where there isn't an HNDL problem, we still have the issue of being confident in the signature years after signing. Will an RSA-4096 signed blob be acceptable in 20 years? Do we really think RSA will be above reproach by then? Signers in 2026 might do well to at least have a second signature scheme in place to doubly sign their blobs, and to maybe revalidate then doubly re-sign older blobs previously signed with just their RSA keys, to maintain their provenance for decades to come.