Google DeepMind AI agents cut cost of attacking 1024-bit RSA keys

Google DeepMind researchers working with cryptographers from UC San Diego and Inria revealed on November 6, 2026, that human-supervised AI agents discovered two methods to lower attack costs against 1024-bit RSA cryptosystems. Dj Dvijotham and Abhradeep Thakurta of DeepMind led the research effort, and cryptographers Nadia Heninger and Emmanuel Thomé collaborated on the work. One method targets digital signatures and padding, while the other addresses batch factoring of multiple keys (factoring many keys at once by sharing one costly computation across every target).

The first result concerns digital signatures and padding, the preset data added to messages to reach a fixed block size. DeepMind found that padding strength varies with the portion of the signed block an attacker controls. Once an attacker controls roughly half or more of the signed block, padding adds no protection at all. For a smaller portion, such as a 32-byte hash, the forgery task becomes harder.

DeepMind described an algorithm with theoretical estimates about 1,600 times stronger than the prior best method for 1024-bit keys, though the company characterizes the improvement as asymptotic and says it was not executed at 1024-bit scale. Sandbox tests showed agents repeating a prior academic forgery on an identical 1024-bit key reduced CPU usage by a factor of 3.5.

Researchers measured the first forgery at 391 CPU core-years compared with 1,380 in the earlier work. The signing key itself was not factored, with full factoring estimated at 500,000 to one million CPU core-years. The signature forgery does not reveal the private key, and it demands about four billion signing queries completed before the target is known. Devices that hash messages internally are not vulnerable to this signature attack.

The PKCS#1 v1.5 format used by PKCS#11 signing interfaces on cryptographic devices including HSMs is affected. Under CKM_RSA_PKCS, a caller controlling 65 of the 128 bytes in a block faces a problem as easy as raw unpadded signing. Measurements showed a 64-byte digest like SHA-512 behaves similarly. Signing methods that hash internally, including CKM_SHA256_RSA_PKCS, are outside both attack models because callers cannot pick the block.

The paper notes current guidance does not approve 1024-bit RSA for creating signatures. Online banking, messaging, software updates and digital currencies that use 2048-bit or larger keys fall outside the attack scope.

A pair of AI agents handled design, execution and debugging of the forgery in under four days, receiving roughly 20 human messages that were mainly approvals. One model supervised the design and audited outcomes while another authored and executed the code and repaired errors. One model produced proofs while another verified them, and Lean 4 (a proof-assistant language that machine-checks mathematical proofs) machine-checked the algebraic identities. The agents generated roughly 33,500 lines of code and started 336 distributed experiments peaking near 300,000 CPU cores and 16 GPUs.

Mid-run, the agents found a 32-bit index overflow that produced an incorrect initial root. The paper credits the savings mainly to better code rather than hardware, and says the shorter calendar time reflects mainly parallelism. DeepMind’s run required 3.2 days from the initial full-scale sieving job versus roughly five months for the earlier effort, mainly due to parallelism. For the 32-byte digest scenario, the paper reduces the asymptotic cost exponent from 1.8171 down to 1.5803.

The second result addresses batch factoring of multiple same-size RSA keys, letting an attacker divide one costly initial computation across every target. According to DeepMind, the agent-created algorithm lowers the average cost of factoring each extra 1024-bit key by about 30 times compared with earlier batch methods. The estimate presumes an initial computation costing about one factorization, and nobody has built the method. Since 1993, Coppersmith’s multiple number field sieve has defined the leading cost for each additional integer in batch factoring.

The fan factory assigns every target a distinct family of number fields supplied by shared work. In leading-order terms, every additional 1024-bit integer costs roughly 1/58 of one standard sieve run. According to the authors, the fan factory remains unimplemented. The September paper concluded that with a signing oracle, RSA concrete security falls 15 to 30 bits below factoring-based estimates for 1024-bit to 4096-bit keys.

The authors stated that even 4096-bit RSA appears to fall short of 128-bit security under this attack model.

Current systems using 2048-bit or larger RSA keys are not affected by this threat. Pushmeet Kohli of Google DeepMind said these results affect only outdated 1024-bit RSA systems, and stronger modern protocols remain safe. Kohli stated that AI-driven mathematics means experts should not assume cryptographic hardness stays fixed. “we cannot treat cryptographic hardness as a fixed assumption,” Kohli said.

Older hardware and embedded devices still relying on 1024-bit signature keys have a smaller safety margin than earlier estimates suggested. Modern standards have already discarded 1024 bits as a viable key length. Groups maintaining older RSA-1024 keys now confront a significantly reduced attack cost, which squeezes migration schedules compliance teams once viewed as low priority. Compliance programs commonly require minimum key lengths yet do not track where older keys reside.

Security teams should include AI-powered cryptanalysis in threat models for any system where encryption guards access, identity or payments. Research using AI has shown it can recreate and enhance existing attack techniques quickly. AI agents shorten the time required to test encryption assumptions from years of human work to far less.

Kohli announced that the team produced both advances in only a few weeks. Google DeepMind characterized the research as demonstrating how AI agents accelerate encryption stress-testing. The public announcements did not identify which AI models powered the agents.

The two working papers from November 5 and 6 remain without peer review. Earlier academic work on a solved 1024-bit benchmark came from Laura Shea, Miro Haller, Adam Suhl, Heninger and Thomé in a September IACR ePrint paper. The original team used 1,380 CPU core-years across five months with an HSM serving as the signing oracle. With identical algorithms, polynomials and bounds, the agents obtained the first root in 391 core-years.