! Educational demonstration only. Keys, moduli, and RSA sizes here are intentionally tiny so classical/quantum attacks finish in seconds — today's classical hardware cannot run Shor's algorithm against real production RSA keys. See Security & Limitations.
Shor's Lab

$ Every attack on this site, in one place

Eight real attacks against RSA, demonstrated live elsewhere on this site, mapped against what each one actually compromises, what an attacker needs to pull it off, and what stops it in real-world RSA. Not a wishlist -- every node links to a real, running demo.

Attacks demonstrated4
Break the key entirely2p, q, or d recovered
Need the private key?Nonot one row does
Mocked or hardcoded0every row is real code

Attack topology

RSA-2048core target
Key recovery

Classical factoring

Trial division, Fermat, Pollard's rho, and Pollard's p-1 all just try to factor N directly. Every one of them is exponential in N's bit length -- fast enough to break this site's tiny teaching keys in milliseconds, hopeless against a real key.

Compromises
Full private key (p, q, d)
Attacker needs
Public key only (N)
Real RSA's defense
N large enough that factoring is computationally infeasible (2048+ bits)
Run this attack

The full picture, one attack at a time

Classical factoring

Trial division, Fermat, Pollard's rho, and Pollard's p-1 all just try to factor N directly. Every one of them is exponential in N's bit length -- fast enough to break this site's tiny teaching keys in milliseconds, hopeless against a real key.

Shor's algorithm

The whole reason this project exists: a quantum computer can find N's factors in polynomial time via period-finding, not exponential. Today's real hardware can run this exact algorithm on toy numbers like 15 -- see Resource Estimation for how far that is from a real 2048-bit key.

Wiener's attack

Continued-fraction convergents of e/N leak d outright whenever d was chosen too small (roughly d < N^0.25 / 3) -- pure number theory against the public key alone, reusing the exact same math Shor's algorithm uses to turn a measurement into a period.

RSA-CRT fault injection

Boneh-DeMillo-Lipton (1997): CRT-optimized signing computes mod p and mod q separately for speed. A single physical fault (voltage glitch, laser pulse) in just one branch, and gcd(s'^e - m mod n, n) hands over a full factor. No weak key needed -- this works against a completely ordinary one.

Parity/LSB oracle attack

RSA's multiplicative homomorphism plus any single-bit leak per query -- a timing gap, a distinct error page, anything that collapses to one bit -- is enough to binary-search out an entire message in ceil(log2(N)) queries, using only the public key.

Multiplicative malleability

Textbook RSA has no ciphertext integrity: c' = c * s^e mod n decrypts to m*s mod n for any attacker-chosen s. The attacker never sees the plaintext or the key, yet fully controls the multiplicative relationship of what comes out the other end.

Block substitution (splicing)

Textbook RSA encrypts each block independently, like ECB mode in a block cipher -- no chaining between blocks. An attacker can encrypt a block of their own choosing with just the public key and swap it into a non-final position, completely undetected.

PKCS7 padding timing side-channel

PKCS7 unpadding's early-exit branching leaks whether padding was valid through response time (>200 sigma, measured live) -- the exact building block a Bleichenbacher-style oracle attack chains into full decryption. OAEP's always-run-every-check design shows <1 sigma: no measurable leak.

Go deeper: Security & Limitations