Google DeepMind AI agents expose two weaknesses in legacy 1024 bit RSA

RSA encryption has anchored secure web traffic, software signing and identity systems for decades, and its security rests on the assumed difficulty of factoring very large integers. The 1024-bit key size was once common, but standards bodies including NIST have treated it as too weak for new use for more than a decade. Yet 1024-bit keys survive in embedded devices, industrial controllers, legacy VPN appliances, archived documents and firmware signing systems.

Digital signatures add another layer. Padding schemes such as PKCS#1 v1.5 are meant to make raw RSA signing safer, but their guarantees depend on how much of the signed block an attacker can influence. The IACR Cryptology ePrint Archive reported on September 22 that a team from UC San Diego and Inria had forged 1024-bit RSA signatures after temporary access to a raw signing or decryption oracle, using 1,380 CPU core-years over five months and about 4.3 billion oracle queries. The attack did not factor the key.

That result became a benchmark for a different experiment. Google DeepMind announced on November 6 that two cooperating AI agents, directed by human researchers, had found two weaknesses in legacy 1024-bit RSA-based systems. One concerns signature forgery and padding. The other concerns batch factoring, where an attacker who has already paid a large shared cost tries to break many old keys. Pushmeet Kohli, vice president of science at Google DeepMind, framed the work as evidence that AI can test cryptographic hardness assumptions faster than before.

The scope matters as much as the numbers. Google DeepMind said the findings affect obsolete 1024-bit RSA systems, while modern protocols using 2048-bit or larger keys remain secure. Tech AI Latest reported on November 7 that the company describes the most dramatic forgery improvement as a theoretical estimate, not a measured break. The measured result is narrower: a reproduction of an already-solved benchmark with 3.5 times less CPU time.

Key Facts

According to Google DeepMind, one AI model supervised design and audits while a second wrote and ran code, with human researchers supplying direction. SecurityProNews reported on November 7 that the agents needed about 20 short human messages, many of them simple approvals, and finished in under four days. They produced about 33,500 lines of new code and launched 336 distributed experiments, peaking near 300,000 CPU cores and 16 GPUs.

The benchmark came from a paper by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé. That team spent 1,380 CPU core-years over five calendar months and used a hardware security module as the signing oracle. DeepMind's agents, using the same algorithm, polynomials and bounds, computed the first root in 391 CPU core-years. The paper credits the savings mainly to code rather than hardware and says the shorter calendar time reflects mainly parallelism.

On signatures, the analysis examines PKCS#1 v1.5 padding through the PKCS#11 mechanism. SecurityProNews reported on November 7 that a caller who can supply 65 of the 128 bytes in a 1024-bit block faces a problem no harder than raw, unpadded signing. A 64-byte digest such as SHA-512 behaves about the same, while a 32-byte SHA-256 digest leaves a harder problem. In that setting, Google DeepMind estimates a new algorithm improves on the previous best method by roughly 1,600 times for 1024-bit keys, a theoretical figure. The attack needs direct signing interface calls, about 4 billion in the reproduction.

The second result is a batch factoring method that DeepMind calls fan factories. Google DeepMind said the algorithm has better asymptotic complexity than prior methods and cuts the average cost of factoring each additional 1024-bit key by about 30 times compared with previous batch methods. SecurityProNews reported on November 7 that, after a shared precomputation costing about one factorization, each further 1024-bit integer would cost about 1/58 of a standard number field sieve run, 30 times less than Coppersmith's method from 1993. The identities passed Lean 4 checks, but no fan factory has been implemented.

The earlier IACR paper supplies scale. The IACR Cryptology ePrint Archive reported on September 22 that factoring the same 1024-bit modulus directly would take 500,000 to 1,000,000 CPU core-years. It estimated that RSA's concrete security with a signing oracle should be 15 to 30 bits lower than factoring-based estimates for 1024-bit to 4096-bit parameters, and that even 4096-bit RSA does not appear to meet a 128-bit security level in that attack model.

Analysis

What this really means is that the headline number is a productivity story before it is a cryptography story. DeepMind's agents did not invent a new way to factor 1024-bit RSA, and they did not break a key that was still considered safe. They took a published attack, reproduced it, and did so with 3.5 times less CPU time. The change is that a small human team, using about 20 messages, could direct software that wrote 33,500 lines of code, ran 336 experiments and found a 32-bit overflow.

That is still significant. Cryptanalytic estimates often treat implementation and tuning as fixed overhead, separate from the core computation. If AI agents can compress that overhead, the practical cost of testing a hardness assumption falls even when the mathematics does not change. The 3.5 times saving came mainly from code rather than hardware, and the shorter calendar time reflected mainly parallelism. That is what turns a paper into a tool.

The theoretical claims need caution. Tech AI Latest reported on November 7 that the 1,600 times forgery improvement applies to a 32-byte digest and is an estimate, not a demonstration. A 30 times reduction per additional key is serious because it changes the economics of attacking many keys at once, yet it remains a claim about asymptotic behavior and shared precomputation, not a live campaign.

The bigger picture here is that cryptographic hardness is becoming cheaper to audit, and that changes how standards should be maintained. The security of RSA at a given size has always been a moving estimate, shaped by factoring records, implementation bugs and attack models. DeepMind's work suggests that AI agents can stress-test those estimates faster, including in overlooked settings such as padding oracles and batch attacks. The result does not make 2048-bit RSA unsafe, but it weakens the habit of treating old key sizes as settled.

Why It Matters

The practical risk is concentrated in old systems that never moved. Tech AI Latest reported on November 7 that 1024-bit keys survive in embedded devices, industrial controllers, legacy VPN appliances, archived signed documents and firmware signing infrastructure. Many are hard to inventory and harder to patch. The batch result is especially relevant: an attacker who collects many old public keys, for example by scanning the internet, would pay less for each additional key if the method worked.

The signature result matters where a 1024-bit key still signs data whose authenticity matters, but the conditions are narrow. The attacker needs direct calls into a raw signing or decryption interface, and the reproduced attack needed about 4 billion such calls. Most ordinary PKCS#1 v1.5 or PSS deployments do not expose that oracle. The IACR paper showed that a hardware security module can be impersonated through black-box API interactions without exfiltrating the key, so interface design can matter as much as key length.

The response is not to abandon RSA everywhere. Google DeepMind said modern encryption protocols using 2048-bit or larger keys remain secure, and Tech AI Latest reported on November 7 that NIST has treated 1024-bit RSA as too weak for new use for more than a decade. The sensible work is to find remaining 1024-bit keys and replace them with 2048-bit or larger RSA, elliptic curve keys or post-quantum schemes. That is an inventory problem more than a research problem, and most organizations can act on it now.

Next Up

The immediate test is implementation. A fan factory has not been built, and the 1,600 times forgery improvement remains a theoretical estimate for the 32-byte digest setting. Independent researchers will want to reproduce the 391 CPU core-year result, inspect the 33,500 lines of code and check whether the savings hold beyond the benchmark. DeepMind's broader argument, that standards need continuous stress testing, will be judged by reuse.

For operators, next steps are less exotic. Inventory 1024-bit keys, restrict raw signing and decryption interfaces, and plan replacements with 2048-bit or larger RSA, elliptic curve cryptography or post-quantum schemes. The 2048-bit and larger estate is not affected by these results, but finding and retiring old keys is now easier to justify. The story is not that RSA fell. It is that the cost of checking where it is weak has dropped.