The most important thing to know about this work, which is awesome, is that it relies on access to a raw RSA oracle, where you have a public key and an API that allows you to directly do RSA operations with the corresponding key. The idea is that you then lose access to the oracle, and thus to the private key, but you've gained enough information from your session with the oracle to make forgeries in the future.

So it's not a straightforward general-purpose RSA-1024 signature break; it's pretty situational. The paper goes into detail (in section 5) about how those situations can emerge in practical scenarios.

All these articles are merely clickbait. I knew there wasn't a real break in RSA before reading the article. It's just some weird subset of usage which allows this. It's nowhere near breaking RSA.

Why are we even contemplating quantum computers breaking encryption when they can't even factorize a 3-digit prime number? I'm wondering if I'll even see quantum computers breaking RSA in my lifetime.

Another piece of overblown academic panic-mongering. It's been known since forever that you never use RSA that way, which is why every single standard that specifies RSA use also specifies padding mechanisms designed to avoid this, but nowhere in the title or abstract, which is about all that 99% of non-cryptographers will read, does it ever mention this. In fact it's written to imply the exact opposite.

This is not "we broke RSA", it's "we managed to find an implementation you've probably never heard of before that's so broken that an attack that nothing should be vulnerable to is actually feasible". This is a blog post, not a news story. I found a much bigger vuln than this in Android RSA auth some years ago, I'm talking beginner-level crypto misuse, told Google about it, and it was quietly fixed. I didn't publish a paper about it or get it in the news because it was a non-story.

Except that in this case every single piece of crypto code or downstream app out there that has the name "RSA" associated with it, which is all of them, has to reassure every one of its users who have seen the news headline that no, it's overblown hype, you're not vulnerable, nothing to do since there's no vulnerability present in your use of RSA.

The worst possible outcome would be if this thing actually gets a CVE assigned to it. How do you fix a "vulnerability" that doesn't exist?

It is a rare privilege to read such volcanic straw-manning.

Actually it's just thoughts from someone who has to deal with the fallout from this stuff. Which will include spending at least a week researching and writing up a sufficiently nontechnical analysis for mgt explaining why its completely irrelevant, all wasted time I should be spending dealing with actual real security issues.

But is that the fault of Heninger et al? Far from being academic and alarmist attention seekers, they have done the hard yards of dealing with real hardware, albeit a reduced difficulty variant.

I would say so, yes, because as I pointed out in my previous post, nowhere in the title or abstract do they say that this doesn't apply to virtually any use of RSA today. It's an interesting academic result but a giant headache for anyone who has to deal with the fallout, because anyone who reads about it will only see "RSA is broken" and demand action, and the cleanup task will fall on people who are already overloaded dealing with a malware infection and suspected penetration of one of the networks by parties unknown (probably Russia or China again) and an SAR audit all going on at the same time.