THE QUANTUM INTELLIGENCER

The week past brought two reminders that cryptographic certainties are not eternal. On September 20, a team from UC San Diego and INRIA Nancy posted to the IACR ePrint archive a paper describing how to forge 1024-bit RSA signatures without factoring the modulus. The method, an implementation of a 2007 algorithm by Antoine Joux, David Naccache and Emmanuel Thomé, requires an attacker to query a raw RSA signing oracle roughly four billion times. After an initial outlay of 1,380 CPU core-years, forgery proceeds offline at about 180 core-years per signature. The authors estimate effective security falls to 65 bits for RSA-1024, 90 bits for RSA-2048 and 119 bits for RSA-4096, below the 128-bit floor. Ordinary signing is not the victim: PKCS#1 v1.5 and RSA-PSS padding usually block the needed oracle, and the paper names blind-signature schemes such as Privacy Pass and certain PKCS#11 interfaces instead. Four days later, on September 24, the European Banking Authority, the European Securities and Markets Authority and the European Insurance and Occupational Pensions Authority warned in their Autumn 2026 Risk and Vulnerabilities report that quantum computers could break cryptography securing transactions, databases and blockchains, possibly before such machines are otherwise commercially useful. Neither threat is here today. Both press toward the same deadline. —Dr. Octavia Blythe Dispatch from The Prepared E0