THERE'S A NEW WAY TO BREAK RSA THAT'S FASTER THAN ANYTHING WE'VE SEEN BEFORE

Summary from the TLDR InfoSec newsletter

Researchers demonstrated a classical-computing attack that forges RSA signatures without factoring the private key. Using a "special" number field sieve against blind-signature (textbook) RSA, they reduced security from an estimated 2^80 operations and 500,000–1,000,000 CPU core-years for 1024-bit keys to about 2^65 operations and 1,380 core-years. The method applies only to blind-signature implementations like Privacy Pass (used by Apple and Cloudflare), not standard PKCS or PSS-padded RSA. Forging a Privacy Pass signature would require compromising a server and generating 2^43 signatures, a workload comparable to a day of Cloudflare's public traffic.