Google DeepMind said AI agents working under human supervision found two ways to reduce the cost of attacking 1024-bit RSA cryptosystems, a key size that standards bodies have already retired for new signatures1,2. The research was conducted with cryptographers Nadia Heninger, affiliated with the University of California at San Diego and Inria, and Emmanuel Thomé of Inria.
Signature forgery at 3.5× lower cost
The first result targets digital signatures on devices such as hardware security modules that sign data through the PKCS#11 interface. In a sandboxed test, two AI agents reran an earlier academic forgery attack on the same 1024-bit key, cutting CPU time 3.5-fold: the forgery took 391 CPU core-years, versus 1,380 in the original study. The agents designed, ran, and debugged the computation in under four days with approximately 20 messages from the human researcher.
Google DeepMind determined that the protective value of padding — preset data that signature standards add to a message — depends on the share of the signed block an attacker controls. "Once they control roughly half of the block or more, padding adds no protection at all," Pushmeet Kohli, VP at Google DeepMind and chief scientist at Google Cloud, said. The padding result applies to the PKCS#1 v1.5 format used by the PKCS#11 signing interface. The attack does not recover the private key and requires roughly 4 billion signing queries made in advance. It does not work against devices that hash messages internally.
Batch factoring, not yet implemented
A second paper estimates that, after a shared precomputation as costly as factoring one key, each further 1024-bit key can be factored about 30 times more cheaply than with the best previous batch method. By its theoretical estimates, the algorithm is roughly 1,600 times better than the previous best method against 1024-bit keys. The method has not been implemented, and factoring the key used in the signature experiment would take an estimated 500,000 to 1 million core-years.
Modern keys unaffected
"In practice, these results only affect obsolete 1024-bit RSA systems, and modern encryption protocols, which almost universally use 2048-bit or larger keys, remain secure," Kohli said. He added that "we cannot treat cryptographic hardness as a fixed assumption".
ANALYSIS The work is a concrete case of AI agents accelerating cryptanalytic research rather than breaking production cryptography — the 3.5× cost reduction and the 30× batch-factoring estimate both apply to a key size already deprecated by standards bodies, and the factoring method remains unimplemented.