Hal Finney's writeup (Bleichenbacher's RSA signature forgery based on implementation error) shows a formula for RSA3072. I tried to replicate the attack for RSA1024 and failed, since the first term of the equation 2^1009 is not a perfect cube. I ended up forging a signature by simply constructing a desired number and taking cube root of it. But I'm curious, is it possible to come up with a clean formula, as in the case of RSA3072?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.