Forging 1024-bit RSA signatures in nearly SNFS time
 

This repository contains a paper (eprint 2026/XXXX) and code implementing a variant of the number field sieve (NFS) algorithm. It shows that an attacker can use temporary access to a raw, unpadded RSA signing/decryption oracle to gain the permanent ability to forge signatures / decrypt ciphertexts.
The algorithm only works if a raw signing oracle is available. Most RSA usage in practice (that is, RSA signatures using PKCS#1v1.5 or RSA-PSS padding) do not expose such an oracle, and thus this attack does not pose a practical risk. Examples of RSA use that do expose such a signing oracle would include blind RSA signatures (e.g. Privacy Pass) or HSM APIs.