Shea-Haller: LibrePGP not at risk

[Jakob Bohm]

On 28/09/2026 17:15, Robert J. Hansen via Gnupg-users wrote:
> A new paper has been published[1] presenting attacks on RSA signatures.
> The paper is legitimately interesting, but not panic-worthy.
>
> Shea-Haller (as I'm calling the paper, after the leading two authors) is
> interesting but not without fault. The first sentence in their abstract
> has a claim the field cannot quite support. They claim, "[t]he security
> of RSA is generally understood to be based on the complexity of factoring."
>
> Well, that's just not true, the security of RSA has never been proven
> equivalent to factoring. More to the point, there are good reasons to
> think it can't be.
>
> Cryptographers call the task of breaking RSA "the RSA problem," or RSAP.
> The problem of factoring large composites is "the integer factorization
> problem," or IFP. The RSA conjecture — and be sure to call it that — is
> RSAP = IFP.[2] We'll call this conjecture RSAC.
>
> We've had strong hints as far back as 1998 that RSAC was not strictly
> true. At EUROCRYPT '98 Dan Boneh, one of the smartest cryppies of his
> generation, presented with Ram Venkatesan a fairly strong bit of
> evidence[3] RSAC was false.
>
> Unfortunately, the Boneh-Venkatesan result didn't really lend itself
> well to follow-up papers. It took a few years to see more published
> results related to RSAC, such as a 2007 paper by Joux, Naccache, and
> Thomé[4].
>
> The Shea-Haller paper builds on the Joux, Naccache, and Thomé paper.
> It's legitimately good work: it's going to have cryppies the world over
> talking.
>
> At the same time, it's not something working nerds need to worry about.
> The overwhelming majority of computer systems that use RSA add a little
> special seasoning[5] to the mix that foils this kind of attack.
>
> Neither LibrePGP nor OpenPGP are susceptible to this attack.
>
> Don't panic. You're probably not at risk. RSAC is probably false, but
> that's okay.
>
>
>      1 https://eprint.iacr.org/2026/2131.pdf
>      2 Sigh, okay, fine: "polynomial-time reductions exist between
> instances of RSAP and IFP."
>      3 https://crypto.stanford.edu/~dabo/papers/no_rsa_red.pdf
>      4 https://eprint.iacr.org/2007/424
>      5 Okay, fine: it's a mix of cayenne pepper, salt, and MSG. Happy?

Dear Mr. Hansen,

As a working nerd who also deals with other uses of the RSA algorithm, it
would be nice to know which seasonings counteract this new poison and the
old results that it builds upon.

I happen to be the designer of at least one non-public protocol that
touches RSA, and thus had to do my own seasoning back in the day, thus
this is not just curiousity.


Enjoy

Jakob
-- 
Jakob Bohm, CIO, Partner, WiseMo A/S.  https://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark.  Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded