Vault Stays Shut, But Researchers Still Stamp Their Own Passes Anyway 🔏

Researchers at UC San Diego and France's Institute for Research in Computer Science and Random Systems impersonated a hardware security module without extracting its private key, according to a paper submitted to the IACR Cryptology ePrint Archive on September 20. The team forged signatures on messages of their choosing while the key remained sealed inside the tamper-resistant device. Bitcoin and Ethereum were not affected: both rely on the elliptic curve digital signature algorithm, with Bitcoin also supporting Schnorr signatures, rather than on Rivest-Shamir-Adleman cryptography.

The attack works on RSA, a separate signature scheme created in 1977 by Ron Rivest, Leonard Adleman, and Adi Shamir. The researchers disabled the module's FIPS mode, a certified security setting, so it would sign unformatted numbers, and supplied a test key of their own. They then asked the box to sign roughly 4 billion numbers and performed mathematical analysis on the outputs, the paper states. Standard RSA deployments apply padding schemes such as PKCS#1 v1.5 or PSS before signing, and those padded signatures do not create the exploitable oracle, the authors wrote. They added that the attack likely poses no immediate operational threat to most modern RSA deployments, and that breaking RSA has never been proven equivalent to factoring.

The paper remains a preprint and has not undergone peer review. Institutional custody providers, including BitGo, rely on hardware security modules so that keys never exist outside the device, a design choice the researchers said the attack did not circumvent. Some RSA-based systems deliberately expose a similar signing oracle: blind signature schemes let a server sign a hidden message, a technique that cryptographer David Chaum used when founding DigiCash in 1989. Cloudflare has stated that Apple uses a variant of Privacy Pass, which relies on blind signatures, so users can prove they passed a check such as a CAPTCHA without revealing their identity.

Previous "RSA is broken" claims have drawn scrutiny. In January 2023, Chinese researchers announced a quantum method said to threaten RSA but had factored only a 48-bit number, far short of the key sizes used in production. The new work, by contrast, does not claim to factor RSA at all; it targets the signing behavior of a misconfigured hardware module. The authors frame their result as a stress test of how signing keys are guarded in practice rather than as a break of the RSA algorithm itself.