Shea-Haller: LibrePGP not at risk

[Robert J. Hansen]

A new paper has been published[1] presenting attacks on RSA signatures.
The paper is legitimately interesting, but not panic-worthy.

Shea-Haller (as I'm calling the paper, after the leading two authors) is
interesting but not without fault. The first sentence in their abstract
has a claim the field cannot quite support. They claim, "[t]he security
of RSA is generally understood to be based on the complexity of factoring."

Well, that's just not true, the security of RSA has never been proven
equivalent to factoring. More to the point, there are good reasons to
think it can't be.

Cryptographers call the task of breaking RSA "the RSA problem," or RSAP.
The problem of factoring large composites is "the integer factorization
problem," or IFP. The RSA conjecture — and be sure to call it that — is
RSAP = IFP.[2] We'll call this conjecture RSAC.

We've had strong hints as far back as 1998 that RSAC was not strictly
true. At EUROCRYPT '98 Dan Boneh, one of the smartest cryppies of his
generation, presented with Ram Venkatesan a fairly strong bit of
evidence[3] RSAC was false.

Unfortunately, the Boneh-Venkatesan result didn't really lend itself
well to follow-up papers. It took a few years to see more published
results related to RSAC, such as a 2007 paper by Joux, Naccache, and
Thomé[4].

The Shea-Haller paper builds on the Joux, Naccache, and Thomé paper.
It's legitimately good work: it's going to have cryppies the world over
talking.

At the same time, it's not something working nerds need to worry about.
The overwhelming majority of computer systems that use RSA add a little
special seasoning[5] to the mix that foils this kind of attack.

Neither LibrePGP nor OpenPGP are susceptible to this attack.

Don't panic. You're probably not at risk. RSAC is probably false, but
that's okay.


    1 https://eprint.iacr.org/2026/2131.pdf
    2 Sigh, okay, fine: "polynomial-time reductions exist between
instances of RSAP and IFP."
    3 https://crypto.stanford.edu/~dabo/papers/no_rsa_red.pdf
    4 https://eprint.iacr.org/2007/424
    5 Okay, fine: it's a mix of cayenne pepper, salt, and MSG. Happy?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20260928/61479e17/attachment.sig>