DeepMind Says AI Agents Found Two New Weaknesses in Legacy RSA-1024 in Weeks, With 1,600x Faster Signature Forgeries

Google DeepMind announced on November 6 that AI agents, working under the supervision of human cryptographers, uncovered two previously unreported weaknesses in legacy 1024-bit RSA cryptosystems — compressing a discovery process that historically took years into a matter of weeks. Pushmeet Kohli, DeepMind's VP and Chief Scientist, published the results alongside two full technical papers.

The first result concerns digital signatures. Signature schemes typically add structured filler data, known as padding, before signing, and padding has long been assumed to make forgery substantially harder. The AI agents found a sharp boundary: once an attacker controls roughly half of the signed block or more, padding offers virtually no additional protection — forging a signature becomes no harder mathematically than attacking an unpadded system. Even when the attacker controls only a small portion, such as a 32-byte digital fingerprint, the agents identified a new algorithm that in theory improves on the best known attack by roughly 1,600 times for 1024-bit keys.

The second result targets batch factoring. Because RSA keys come in standardized sizes, an attacker can amortize one expensive computation across many keys of the same length. The AI-discovered algorithm improves the asymptotic efficiency of that process, cutting the average cost of factoring each additional 1024-bit key by about 30 times compared with previous batch techniques.

DeepMind was careful to frame the validation. The signature-forging implementation reproduced an earlier academic result on an already-solved 1024-bit benchmark key in a sandboxed environment, using 3.5 times less CPU time — and a small fraction of the compute needed to factor the benchmark key itself. No live production system was touched, no real-world key was broken, and the company said modern RSA-2048 and larger keys are unaffected. The 1,600x figure is a theoretical improvement over prior methods, not a demonstrated end-to-end attack, and the results await independent review by the cryptography community.

The research was led by DeepMind's Dj Dvijotham and Abhradeep Thakurta in collaboration with cryptographers Nadia Heninger of UC San Diego and Inria, and Emmanuel Thomé of Inria. That human-expert-in-the-loop design matters: the agents were not freelancing across the attack space but probing directions that cryptographers identified as worth testing, then doing the exhaustive mathematical exploration far faster than manual work could.

Why it matters: RSA-1024 has been retired from mainstream use, but it still lingers in embedded devices, legacy certificate chains, code-signing setups, and long-lived infrastructure nobody remembers provisioning. The deeper message is about tempo. Cryptographic hardness assumptions have historically moved on decade timescales, giving defenders years to retire weak standards. If AI-assisted cryptanalysis compresses that to weeks for legacy systems, standards bodies and operators need to treat hardness as a variable to re-test continuously rather than a fact to trust indefinitely.

The near-term practical takeaway is mundane: inventory any remaining 1024-bit RSA keys — old VPNs, embedded devices, signed firmware — and replace them with 2048-bit or larger keys or modern alternatives. The same AI tools that can stress-test future standards, DeepMind notes, will eventually be pointed at current ones by someone less careful about sandboxes.