Google DeepMind says its AI agents have found two new ways to weaken 1024-bit RSA, an encryption standard the industry retired years ago. The agents, working under human supervision, showed that padding adds almost no protection against signature forgery once an attacker controls about half of the signed block, and that factoring many keys at once can be done about 30 times more cheaply per key. DeepMind stresses that modern 2048-bit encryption is untouched.
The first crack: signatures
Digital signatures let computers check that a software update, document or message comes from its claimed sender. Most schemes add preset data, called padding, to fill the message out before signing. Padding has long been assumed to make forgery harder, but no one had measured how much protection it offers when an attacker can influence part of the signed message.
DeepMind’s answer is that it depends on how much of the block the attacker controls. Once that share reaches half, padding stops adding protection, and forging a signature becomes nearly as easy as attacking an unpadded system. The team checked the finding in a sandbox against a solved 1024-bit benchmark key, reproducing the forgery with 3.5 times less CPU time.
For harder cases, where the attacker controls only a small slice of the block, such as a 32-byte fingerprint, the agents produced a new algorithm that DeepMind estimates improves on the previous best method by about 1,600 times. That figure is a theoretical estimate, not a measured result: the measured number remains the 3.5-fold CPU saving on the benchmark key.
The second crack: factoring in bulk
The second result attacks a different problem: factoring many RSA keys at once. RSA keys almost always come in standard sizes, so an attacker going after many keys of the same size can, in theory, spread one large upfront computation across all of them. DeepMind’s agents found a new algorithm with better asymptotic complexity than any previously known batch method.
The gain is about 30 times: the new method cuts the cost of factoring each additional 1024-bit key by about 30 times. The point is not that one key got cheaper to break. It is that the hundredth key got cheaper than the first, so anyone holding a pile of legacy keys faces a discount that grows with the haul.
What it does not mean
DeepMind is explicit about the limits, and they matter more than the headlines. The results apply only to obsolete 1024-bit RSA, while modern deployments almost universally use 2048-bit keys or larger, and those are unaffected by these specific findings. Online banking, messaging apps, software updates and digital currencies are not threatened, and no live keys were broken.
The experiments ran in a sandbox, on a standard that the US standards body NIST stopped accepting for generating new signatures back in 2013. That is also why the research was publishable at all: RSA-1024 is a safe proving ground, complex enough to be a meaningful test of AI-assisted cryptanalysis, but retired enough that attacking it endangers nobody.
Our Read
The headline numbers are less important than the method. DeepMind’s agents did not just run known attacks faster; they helped develop, implement and debug new procedures, and arrived at results human cryptographers had not reached. That is AI as a research accelerator, not a chatbot, and it compresses a field where major advances historically took years or decades into weeks.
The timing matters too. This is the same week the industry agreed on a shared way to rate how dangerous a jailbreak is, and days after an OpenAI model spent 14 hours trying to escape its sandbox. The labs are measuring, in public, what their models can do to security assumptions — and the measurements keep pointing the same way.
There is also a defensive read. Google built Gemini 4 Carbon with cyber defense first, and DeepMind frames this work as stress-testing: sharing the results so the security community can measure cryptographic strength rather than assume it. As DeepMind put it, “we cannot treat cryptographic hardness as a fixed assumption.”
The dual-use tension is real, and DeepMind does not hide it. Every technique that helps defenders audit old cryptography also lowers the bar for attackers, and open publication puts the knowledge in the wild for both sides. That is the standard bargain of open security research, and it has usually favoured defenders — but only when defenders actually patch.
Why It Matters
Retired does not mean gone. Old devices, signed firmware and legacy certificate chains still carry 1024-bit keys, and every one of them just got weaker. The practical takeaway is an audit: find any 1024-bit RSA still in use, especially in signatures, and plan the move to 2048-bit or larger keys — or to post-quantum schemes — now rather than later.
The wider signal is about capability, not keys. The same week OpenAI’s GPT-6 Cyber was priced as a commercial security product, DeepMind showed agents doing original cryptanalysis research. The tools that find flaws are becoming as capable as the models that need guarding, and the gap between finding a weakness and exploiting it keeps narrowing.
Background
DeepMind, which Google acquired in 2014, is the company’s London-based AI research division. In September, UC San Diego and Inria researchers — including Nadia Heninger, a co-author here — forged 1024-bit RSA signatures without factoring the key, using 1,380 CPU core-years over five months. DeepMind’s agents reproduced that forgery with 3.5 times less CPU time.
Source: Pushmeet Kohli’s announcement and Interesting Engineering’s report.
0 Comments