Google DeepMind AI Agents Cut Cost to Factor 1024-Bit RSA Keys

AI agents developed by Google DeepMind, collaborating with cryptographers from UC San Diego and Inria, have identified methods to reduce the computational cost of attacking obsolete 1024-bit RSA cryptosystems. The research demonstrated that forging digital signatures on legacy PKCS#1 v1.5 implementations can be completed significantly faster than previously documented, while theoretical batch-factoring costs for additional keys can also be reduced. Pushmeet Kohli, Vice President at Google DeepMind and chief scientist at Google Cloud, confirmed that modern encryption protocols relying on 2048-bit or larger keys remain secure and are unaffected by the findings.

Key Facts

Does This Research Threaten Modern Encryption?

No, modern encryption remains secure because modern protocols almost universally deploy 2048-bit or larger keys. Google DeepMind confirmed that these findings strictly impact obsolete 1024-bit RSA implementations. The mathematical reductions discovered by the researchers do not scale to compromise modern key sizes currently protecting enterprise infrastructure and communications.

Pushmeet Kohli stated,

“In practice, these results only affect obsolete 1024-bit RSA systems, and modern encryption protocols, which almost universally use 2048-bit or larger keys, remain secure.”

Modern encryption protocols that deploy 2048-bit or larger RSA keys remain secure against these computational attacks.

How Did the AI Agents Reduce Attack Costs?

The AI agents lowered attack costs by optimising signature forgery computations and designing theoretical batch-factoring algorithms. Working under human supervision, two agents replicated an academic forgery attack in 391 CPU core-years rather than the previously required 1,380 core-years, delivering a 3.5-fold reduction in processing time within four days.

DeepMind evaluated padding—preset data added to messages to achieve fixed block sizes—and determined that its protective value depends on how much of the signed block an adversary controls. Kohli explained that once an attacker controls roughly half of the block or more, padding provides no protection. When an attacker controls less, such as a 32-byte hash, DeepMind formulated an algorithm theoretically estimated to be roughly 1,600 times better than prior methods against 1024-bit keys. The agents also produced an algorithm making the factoring of each additional 1024-bit key approximately 30 times cheaper across shared computations, though this theoretical method remains unimplemented and factoring an initial key still demands an estimated 500,000 to 1 million core-years.

Two supervised AI agents designed, executed, and debugged the signature forgery computation in under four days with approximately 20 human approvals.

What Should You Do?

• Ensure all cryptographic implementations, certificates, and hardware security modules have phased out obsolete 1024-bit RSA keys in favour of 2048-bit or larger keys.
• Verify that cryptographic hardware devices hash messages internally rather than accepting externally controlled raw blocks.
• Deprecate vulnerable PKCS#1 v1.5 padding configurations across PKCS#11 cryptographic signing interfaces.
• Malaysian organisations encountering legacy security incidents or suspected compromises can report them directly to Cyber999 (MyCERT).

Common Questions

Can the signature attack recover the private RSA key?

No, the signature forgery attack does not recover the underlying private key. It enables an adversary to forge signatures under specific conditions, requiring approximately 4 billion advance signing queries, and it fails entirely against cryptographic hardware that performs message hashing internally.

Was the 1024-bit RSA key factored during the experiment?

No, the researchers did not factor the RSA key. Factoring a 1024-bit key remains computationally prohibitive, requiring an estimated 500,000 to 1 million CPU core-years. DeepMind's agents focused on optimising signature forgery rather than direct private key factorisation.

Are batch-factoring attacks currently being carried out?

No, the multi-key factoring method remains a theoretical algorithm and has not been implemented. While it suggests factoring subsequent keys could be 30 times cheaper, it requires an initial upfront computation equivalent to factoring a complete 1024-bit key.

Sources and Methodology

This dispatch is based solely on reporting from SecurityWeek. No publication date was specified in the source text. This dispatch is based only on the source text above; no other documents, vendor advisories, or external pages were reviewed or verified.