Happy New Heninger Paper Day to all who celebrate!

An under-appreciated 2007 algorithm of Joux, Naccache, and Thomé allows an attacker to forge RSA signatures after temporary access to a raw RSA signing/decryption oracle in time close to the special number field sieve (SNFS) without factoring the key. We implement and run this algorithm for 1024-bit RSA. In total, the attack took 1380 CPU core-years over five calendar months, and made 232 oracle queries. Most of this time is precomputation; after the precomputation the attacker can forge any signature of choice, offline, in 180 core-years.

Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger, and Emmanuel Thomé, “Forging 1024-bit RSA signatures in nearly SNFS time,” Sep. 2026. Online: https://eprint.iacr.org/2026/2131