New RSA Forgery Attack Bypasses Factoring

Researchers have implemented a 2007 forgery attack against RSA that bypasses factoring, forging signatures for 1024-bit keys using 1380 CPU core-years over five real-world months. It only works on pure, unpadded signatures, not typical RSA deployments, and does not recover private keys. The subexponential attack is faster than factoring but not polynomial-time.