Researchers from the University of California, San Diego and France’s INRIA have demonstrated a way to forge RSA digital signatures from inside a hardware security module without removing the private key stored in the device.
The finding shows how a poorly configured signing interface can weaken a security system designed to keep cryptographic keys isolated. However, it does not represent a break of Bitcoin or Ethereum, whose transaction signatures rely on elliptic-curve cryptography rather than RSA.
According to Decrypt, the researchers described the attack in a paper submitted to the IACR Cryptology ePrint Archive on September 20. Their demonstration used a 1,024-bit RSA key and required approximately 2^32 signing requests—about 4 billion—in addition to an estimated 1,380 CPU core-years of computation.
How the attack worked
A hardware security module, or HSM, is a tamper-resistant device that stores private keys and performs signing operations when an authorized system sends it a request. The design is intended to ensure that the key itself never appears outside the device, even when the device is used by a bank, technology company or cryptocurrency custodian.
In this experiment, the researchers did not extract the key. Instead, they presented the HSM with a very large number of selected inputs and studied the signatures returned by the device. The results allowed them to create valid RSA signatures without directly accessing the private key.
The test required an important configuration change: the HSM’s FIPS mode was turned off. FIPS mode is a certified security setting, and disabling it allowed the device to sign unformatted numbers. The researchers also used an RSA test key that they controlled.
The underlying weakness is often described using the idea of a signing oracle. In simple terms, a device that will sign arbitrary raw inputs can reveal enough information through repeated responses to make the signing process reproducible. The demonstration therefore targeted the way the device accepted requests, rather than recovering the secret key through a conventional extraction method.
Why this does not break Bitcoin or Ethereum
The result applies to RSA, a public-key cryptographic system whose name comes from Ron Rivest, Adi Shamir and Leonard Adleman. RSA’s security is generally associated with the difficulty of factoring very large numbers, although the researchers did not factor the key and the security of RSA has not been proven equivalent to factoring.
Bitcoin uses the elliptic-curve digital signature algorithm, or ECDSA, for transaction signatures. Its elliptic-curve system also supports Schnorr signatures. Ethereum and most major blockchains likewise use elliptic-curve signatures rather than RSA.
That distinction is important for digital-asset holders. The paper does not show that a Bitcoin or Ethereum private key can be derived, nor does it demonstrate that transactions on those networks can be forged. Its relevance to crypto is instead connected to the infrastructure used by custodians and other institutions to protect keys.
The researchers’ own assessment was that the attack is unlikely to pose an immediate operational threat to most current RSA deployments. The paper is a preprint, and modern RSA signing normally uses padding schemes such as PKCS#1 v1.5 or PSS. Those formatting steps prevent the exploitable oracle from being created in the same way.
Some systems deliberately provide a related capability. RSA blind signatures allow a server to sign information without seeing the underlying content. One version of Privacy Pass uses this approach, allowing a user to prove that they passed a check such as a CAPTCHA without disclosing their identity. Cloudflare has said Apple uses a version of Privacy Pass. The technique has older cryptographic roots: David Chaum used blind signatures when he founded DigiCash in 1989.
The wider post-quantum issue
The demonstration adds to the broader discussion about moving away from RSA and preparing systems for post-quantum cryptography. The researchers characterize their result as classical evidence supporting that transition, rather than as proof that ordinary RSA systems can be broken at scale today.
Earlier claims about quantum threats have also required careful qualification. In January 2023, Chinese researchers reported a quantum method that they said threatened RSA, but the work had factored only a 48-bit number and was dismissed by experts. The latest research is different in that it demonstrates signatures being forged using an actual 1,024-bit RSA key, although only under the specific unpadded-oracle conditions and extreme computational requirements described by the authors.
For Bitcoin, the post-quantum question concerns its elliptic-curve signatures rather than RSA. Caltech researchers estimated at the end of March that between 10,000 and 20,000 qubits could be sufficient to run Shor’s algorithm, which threatens elliptic-curve signatures. Google has set 2029 as its deadline for completing its own migration to post-quantum cryptography.
Current market picture
Moneyiar market data, recorded at the stated times, shows OriginTrail (TRAC) at $0.3767661846, up 1.25% over 24 hours and 10.53% over seven days as of September 25, 2026, at 22:04 +03:30.
TAC Protocol (TAC) was priced at $0.0065984417, with a 24-hour increase of 69.35% and a seven-day increase of 166.36%, according to Moneyiar data as of August 27, 2026, at 09:53 +03:30. These market movements are separate from the RSA research and do not indicate an impact from the finding.
