A Clever RSA Attack Fooled a Hardware Vault—Here's What It Means for Crypto

A Clever RSA Attack Fooled a Hardware Vault—What It Means for Crypto

A team of researchers from UC San Diego and France’s INRIA has shown that a hardware security module (HSM)—the tamper‑resistant device that keeps private keys locked away—can be tricked into forging RSA signatures without ever exposing the key. The experiment, detailed in a paper submitted to the IACR Cryptology ePrint Archive, involved about four billion signing requests and 1,380 CPU core‑years. While the attack does not threaten the elliptic‑curve schemes that power Bitcoin or Ethereum, it raises questions about how we guard RSA‑based keys in the real world.

How the Attack Works

RSA signatures are generated by raising a message to the private exponent modulo a product of two large primes. The security of RSA rests on the difficulty of factoring that product. In practice, a signing operation is wrapped in a padding scheme—such as PKCS#1 v1.5 or PSS—to prevent simple mathematical manipulation. The UC San Diego/INRIA team disabled the HSM’s FIPS mode, allowing it to sign raw, unformatted numbers. They then sent the device roughly 4 billion carefully chosen inputs and collected the corresponding signatures. By analysing the pattern of outputs, they were able to reconstruct a valid signature for a new message, effectively forging a signature without ever learning the private key.

The key insight is that a signature oracle—a system that will sign any input you provide—can be exploited if the padding step is omitted. By repeatedly querying the oracle, the attacker can learn enough about the underlying mathematical relationship to produce a forgery. The attack is classical; it does not rely on quantum computation.

Why Most Deployments Are Still Safe

The paper’s authors emphasize that the attack targets un‑padded RSA signatures. Modern RSA deployments almost always use padding, and the padding step destroys the oracle that the attack exploits. In addition, the experiment required a massive amount of computational effort and a specialized hardware setup. For the average custodian or wallet provider, the cost and complexity of reproducing the attack are prohibitive.

That said, the demonstration is a useful stress test for the security community. It shows that if an HSM is misconfigured—by disabling FIPS mode or otherwise allowing raw signatures—then the device can be subverted. Custodial services that rely on HSMs should verify that their devices enforce proper padding and that firmware updates are applied promptly.

Implications for the Crypto Ecosystem

1. RSA is Still the “Legacy” Scheme

Bitcoin, Ethereum, and most other blockchains use elliptic‑curve digital signatures (ECDSA or Schnorr). RSA is largely absent from on‑chain protocols, so a break in RSA does not directly threaten the security of these networks. However, many off‑chain services—such as exchanges, custodial wallets, and identity providers—still use RSA for authentication and signing. The attack reminds us that even well‑established hardware can be vulnerable if misconfigured.

2. Post‑Quantum Transition

The demonstration adds weight to the argument that the crypto community should accelerate its move away from RSA. While quantum computers have not yet broken RSA, the fact that a classical attack can forge signatures on a 1,024‑bit key suggests that RSA’s practical security margin is shrinking. Post‑quantum algorithms, such as lattice‑based signatures, are designed to resist both classical and quantum attacks and are already being standardized by NIST.

3. Blind Signatures and Privacy Pass

Some systems intentionally expose a signing oracle for privacy‑preserving protocols. RSA‑based blind signatures allow a server to sign a message without learning its contents, a technique used in early digital cash systems and in modern privacy‑pass implementations. The UC San Diego/INRIA attack shows that blind signatures can be vulnerable if the underlying RSA implementation is not properly padded. Designers of privacy‑preserving protocols must therefore ensure that blind signing is only performed on hardened, padded implementations.

Practical Takeaways for Custodians and Developers

1. Verify HSM Configuration – Ensure that FIPS mode is enabled and that the device only signs padded messages. Regularly audit firmware and configuration settings.
2. Use Modern Signature Schemes – Prefer elliptic‑curve or post‑quantum signatures for new systems. If RSA must be used, enforce strict padding and limit the exposure of signing oracles.
3. Monitor for Unusual Signing Activity – A sudden spike in signing requests could indicate an attempt to mount an oracle attack. Implement rate limiting and anomaly detection.
4. Plan for Post‑Quantum Migration – Begin evaluating post‑quantum signature schemes now. The transition will be smoother if started early, before quantum‑ready hardware becomes mainstream.

Conclusion

The UC San Diego/INRIA experiment demonstrates that a hardware vault can be fooled into forging RSA signatures without extracting the key. While the attack does not threaten the elliptic‑curve schemes that secure Bitcoin or Ethereum, it highlights the importance of proper configuration and padding in RSA deployments. For the broader crypto ecosystem, the result is a reminder that legacy cryptography can still be vulnerable and that the transition to post‑quantum algorithms should not be delayed.

---

TL;DR: A research team forged RSA signatures on a hardware vault without extracting the key, showing that misconfigured RSA systems can be subverted; the attack doesn’t threaten Bitcoin or Ethereum but underscores the need for proper padding and a move toward post‑quantum cryptography.