Researchers forge RSA signatures inside a hardware vault without stealing its key

What happened

Researchers from UC San Diego demonstrated that a 1024-bit RSA signature can be forged by sending multiple queries to a hardware security module, a device that stores cryptographic keys, without extracting the private key from the device.

Confirmed

Global impact / market context

Crypto custodians rely on hardware security modules to keep private keys safe, which means the assumption that keys stay protected inside tamper-proof hardware may be insufficient. This could push custodians to add monitoring or change how signature requests are approved.

Analyst inference

The article does not name specific assets or quantify exposure. It implies added operational and security risk for businesses that hold crypto for clients, which could raise their costs, affect investor confidence in custodial services, and influence how such firms are valued.

Analyst inference

What to watch

1. The article states the private key was never extracted from the device, so the forgery happened through repeated queries rather than by stealing the key itself. Confirmed
2. Crypto custodians could review how many signing queries a hardware security module allows, add limits, and require extra human approval before large transactions are signed. Proposed
3. If custodians tighten query limits or add approvals, signing may become slower or costlier, which could affect trading speed, fees, and client willingness to keep assets at such firms. Analyst inference

Evidence

• cryptopolitan.com