Google DeepMind says AI agents working under human supervision have found two ways to reduce the cost of attacking 1024-bit RSA cryptosystems — a result that reshapes assumptions about legacy encryption, even as the company stresses that modern 2048-bit-and-larger keys remain secure.
The research, conducted with cryptographers from UC San Diego and Inria, indicates that attacks on legacy RSA-1024 require less computation than previously assumed, according to SecurityWeek's report on the findings. "In practice, these results only affect obsolete 1024-bit RSA systems, and modern encryption protocols, which almost universally use 2048-bit or larger keys, remain secure," said Pushmeet Kohli, VP at Google DeepMind and chief scientist at Google Cloud. For more context on this story, see our ongoing breaking AI news.
Finding One: Padding Protects Less Than We Thought
The first finding concerns digital signatures and padding — the preset data that many signature standards add to a message to bring it to a fixed block size. Padding has long been understood to make forgery harder, but its value against an attacker who can choose what gets signed was unclear.
DeepMind determined that the answer depends on how much of the signed block the attacker controls. "Once they control roughly half of the block or more, padding adds no protection at all," Kohli explained. According to the accompanying paper, this applies to the PKCS#1 v1.5 format used by the PKCS#11 signing interface of cryptographic devices such as hardware security modules — the devices enterprises rely on to keep signing keys out of reach.
The team didn't stop at theory. In a sandboxed test, DeepMind's agents re-ran an earlier academic forgery attack on the same 1024-bit key and cut the required CPU time 3.5-fold: the first forgery took 391 CPU core-years, versus 1,380 in the original study. Perhaps most notable is how the work got done — two AI agents designed, ran, and debugged the forgery computation in under four days, with roughly 20 messages from the human researcher, most of them approvals.
Even in the conservative case, where the attacker controls less of the block — such as a 32-byte hash — DeepMind found an algorithm that, by its theoretical estimates, is roughly 1,600 times better than the previous best method against 1024-bit keys.
Finding Two: Batch Factoring Gets 30x Cheaper
The second finding concerns factoring many RSA keys of the same size. When an attacker targets many keys at once, the cost of one large upfront computation can be shared across all of them. DeepMind's agents came up with an algorithm that makes factoring each additional 1024-bit key roughly 30 times cheaper on average than the best previous approach.
Google is careful about the limits here: the estimate is theoretical, the method has not been implemented, and it assumes an initial computation as costly as factoring a single key.
Why This Is Not an Immediate Threat
The caveats matter as much as the headline numbers. The signature attack does not recover the private key. It requires roughly 4 billion signing queries made in advance, and it does not work against devices that hash messages internally — which rules out many modern deployments. Full factoring of a single 1024-bit key remains an enormous undertaking, with estimates ranging from 500,000 to 1 million CPU core-years.
So the practical risk concentrates where it usually does in cryptography: old systems that should have been retired. RSA-1024 lingers in legacy hardware security modules, aging PKI infrastructure, and embedded systems that no one has budgeted to migrate. This research doesn't make those systems breakable tomorrow — but it narrows the margin between "attack is infeasible" and "attack is expensive but plausible" for well-resourced adversaries.
For organizations still running 1024-bit RSA anywhere in their stack, the findings strengthen the case for accelerating migration to 2048-bit or larger keys — and for reviewing whether their signing devices hash messages internally before assuming signature-forgery attacks don't apply.
AI Agents as Cryptography's Adversarial Testers
The deeper significance of the work may be methodological. Rather than a human team spending years refining attack techniques, DeepMind's agents explored the attack space, implemented computations, and debugged them largely autonomously — with a researcher supplying guidance and approvals.
"Together, these results show that in a new era of AI-enabled mathematics and computation, we cannot treat cryptographic hardness as a fixed assumption," Kohli said. "Using AI to rigorously test our previously held assumptions will ensure that modern encryption stays secure."
That framing suggests a coming pattern in security research: AI systems stress-testing the assumptions that underpin critical infrastructure, finding the weak spots before adversaries do. The same agent capabilities that reduce the cost of attacking legacy systems can, in principle, be pointed at hardening the replacements. Cryptographers have spent decades assuming the wall would hold until quantum computing arrives; DeepMind's results are a reminder that classical attacks can get cheaper too, and that the floor of "infeasible" is higher than it used to be.
Stay Ahead of AI
AI systems are now probing the foundations of digital security itself. Stay ahead of AI with AI Buzz Wire — research breakthroughs, security developments, and model news as they happen.
Read more AI news →
