The practical risk is limited, but still significant. Applying the attack against the deprecated use of 1024-bit keys took a handful of months on an academic CPU cluster, significantly less than the current estimates for 1024-bit factoring that would require resources that only nations or companies with massive resources could achieve. Widely used RSA implementations are also safe.
Bold emphasis is mine. It’s a nothing Burger article.
This is interesting but it’s essentially a protocol attack against a certain type of RSA signature. It talks about PKCS5 not being affected. Says nothing about OAEP which I’d hope also holds up.
Oh good, more bad news
tell me again why people still use RSA?
Modern crypto systems don’t. They’re still available for legacy interoperation, but modern stuff uses ed25519 and the like.
