The practical risk is limited, but still significant. Applying the attack against the deprecated use of 1024-bit keys took a handful of months on an academic CPU cluster, significantly less than the current estimates for 1024-bit factoring that would require resources that only nations or companies with massive resources could achieve. Widely used RSA implementations are also safe.
Nonetheless, the research has taken cryptographers by surprise because it introduces signature forgery, a new way to break RSA keys without factoring. Equally important, this novel method reduces the required computing resources by orders of magnitude.
Soooo, alternatives? Age?
ECDSA has already pretty much replaced RSA anyway.
This’ll help convince the last stragglers though, at least until a PQ solution gets widely adopted.Doesn’t it use elliptic curve that might be compromised by the NSA?
Nah, there’s a wide selection of curves you can choose from.
Curve 25519 is a very popular one with much less suspicious properties.
