Google DeepMind's AI agents find two cheaper ways to attack legacy 1024-bit RSA

The first result concerns padding, the preset data many signature standards add to a message. DeepMind found that once an attacker controls roughly half of the signed block or more, padding adds no protection at all. That applies to the PKCS#1 v1.5 format used by the signing interface of hardware security modules[3].

In a sandboxed test, two AI agents re-ran an earlier academic forgery attack on the same 1024-bit key. They designed, ran and debugged the computation in under four days with about 20 messages from the human researcher, mostly approvals. The first forgery took 391 CPU core-years against 1,380 in the original study[3]. The key itself was not factored, which would take an estimated 500,000 to 1 million core-years.

Where the attacker controls less, such as a 32-byte hash, DeepMind found an algorithm it estimates is roughly 1,600 times better than the previous best against 1024-bit keys. That figure is theoretical. The attack also needs around 4 billion signing queries made in advance, does not recover the private key and fails against devices that hash messages internally[3].

The second paper tackles factoring many RSA keys of the same size, where one large precomputation can be shared across all of them. It gives each target key its own "fan" of number fields fed by that shared work. With a precomputation budget of about one ordinary factorisation, each further 1024-bit key costs about 1/58 of a normal number field sieve run, roughly 30 times less than the previous best method, which had not improved since 1993[1].

The authors are clear about the limits. No fan factory has been implemented, the figures are leading-order estimates rather than running-time predictions, and the results do not threaten 2048-bit RSA. The analysis was developed with a two-agent AI harness, one model generating proofs and another verifying them, with the algebra machine-checked in the Lean 4 proof assistant[1].

Neither result breaks anything in modern use, but both chip at assumptions about how hard old RSA keys are to attack, and the agents did most of the heavy lifting. "We cannot treat cryptographic hardness as a fixed assumption," Kohli said[3]. For anyone still running 1024-bit keys in signing hardware or older systems, it is another push to migrate.