Researchers forge RSA signatures from a hardware security module by making it sign 4 billion raw numbers

The forgery's cost comes in two units. The compute was 1,380 CPU core-years ^[5], about 12.1 million core-hours at 8,760 hours a year ^[1], spent doing math on the device's answers ^[6]. The requests numbered 2^32, or 4,294,967,296 signatures on numbers the researchers chose ^[2]. The attackers' machines ran the math, and the module holding the key answered every request ^[1].

The promise custodians make is about where the key lives. According to BitGo, institutional providers use these modules so that keys never exist outside the device ^[7], and in this experiment the key stayed put ^[1]. The weak point was what the device would agree to sign ^[3]. The researchers also used a test key of their own ^[3], so no production key in a live custody system was involved.

I think the paper adds lines to a custodian's configuration review and leaves the hardware budget where it was. That budget follows migration timelines. Google, for example, has set 2029 as its deadline to move its own systems to post-quantum cryptography ^[12]. Decrypt's account does not say whether the module logged or throttled the roughly 4 billion requests ^[5]. In my view request volume belongs in the review beside the FIPS setting. An attack that needs 2^32 answers only works if the device gives all of them ^[2]. The counter-case is that 4.3 billion queries and 12.1 million core-hours keep this a laboratory result that no operator needs to budget for ^[1][2].

Review of the preprint could narrow the result ^[13]. A follow-up could also reach the same oracle with padding switched on. That would put ordinary deployments in range and show the configuration argument to be too narrow. Claims that RSA is broken have a record. In January 2023, Chinese researchers claimed a quantum method that threatened RSA, yet they had factored only a 48-bit number ^[14]. This team worked on a real 1,024-bit key and factored nothing ^[1][15].