- Google DeepMind reports that AI agents, supervised by humans, found cheaper attacks on 1024-bit RSA keys. The researchers say modern 2048-bit and larger keys remain secure.
- The forgery attack does not recover the private key. It needs about 4 billion signing queries made in advance, and it fails against devices that hash messages internally.
- Check whether any systems still use 1024-bit RSA keys, and set a retirement date for each one you find.
Encryption strength is a price, and prices get revised
Every encryption key rests on an estimate. The estimate says how much computing an attacker would need to break it. Google DeepMind now reports that AI agents, working under human supervision, have lowered that estimate for one older key size.
The project included cryptographers from UC San Diego and Inria. It covers 1024-bit RSA, a legacy standard. SecurityWeek reports that the team found two ways to make attacks on it cheaper.
Scope matters. Pushmeet Kohli, a VP at Google DeepMind, says the results touch only "obsolete 1024-bit RSA systems." In his words, current protocols, which in nearly every case use keys of 2,048 bits or more, stay secure.
What the researchers found
The first finding concerns digital signatures. Many signature schemes pad a message with fixed filler so it reaches a set block length. Researchers knew the filler made forgery harder. Whether it still helps when the attacker picks what gets signed had been unclear.
DeepMind found the answer depends on how much of the block the attacker controls. Kohli says that at about half the block or more, the filler gives no protection.
The accompanying paper ties this to the PKCS#1 v1.5 signature format. That format is used through the PKCS#11 interface on devices such as hardware security modules, which are tamper-resistant units that store signing keys.
To test the idea, the agents ran a forgery attack that academics had already published, against a 1024-bit key in an isolated environment. They needed 3.5 times less processor time. The first forged signature cost 391 core-years of computing, where the original study had needed 1,380.
This is forgery, not key recovery. The researchers say the attack needs about 4 billion signing queries made in advance. The private key was not recovered.
The picture changes when the attacker controls only a small slice of the block, such as a 32-byte hash. Forgery is harder there. Even so, DeepMind says it found an algorithm that, on its own theoretical estimates, beats the previous best method against 1024-bit keys by a factor of roughly 1,600.
The second finding concerns attackers who target many keys of the same size. Here the cost of one big preparatory calculation is spread over every key attacked. DeepMind's agents devised an algorithm that makes each additional 1024-bit key about 30 times cheaper to factor, on average, than the best earlier approach.
The limits are real
The signature attack does not reveal the private key, the researchers say. In the test, the key was left unfactored. DeepMind estimates that factoring it would cost 500,000 to 1 million core-years of computing.
Devices that hash messages internally are out of reach for this signature attack, according to the researchers.
The 30-fold figure is a theoretical estimate. It also depends on a first calculation that costs as much as factoring a single key. The method has not been implemented.
The idea behind the numbers
The process matters as much as the numbers. DeepMind says two AI agents took under four days to design, run and debug the forgery computation. The human researcher sent about 20 messages, mostly approvals.
The lesson here is that cryptographic strength is a standing estimate, and it can be revised.
Think of a bridge's load rating. It is a claim made at one moment, with the methods of that moment. Responsible owners re-inspect it when better methods arrive. Kohli puts it this way: "we cannot treat cryptographic hardness as a fixed assumption."
Keep the evidence in proportion. This is one DeepMind project, with human researchers and the team's own agents. In it, supervised agents lowered attack cost estimates. The report does not say whether others could repeat the work.
What to ask your team
Start with an inventory. Do any systems still use 1024-bit RSA keys? Check signing services, older devices and certificates that outlived the project that created them.
Then ask about the conditions the research names. Do your hardware security modules sign data in the PKCS#1 v1.5 format? Can outside parties influence what gets signed? Do the devices hash messages internally, which the researchers say blocks the signature attack?
Finally, set a retirement date for every 1024-bit key you find. These results show that attacks on 1024-bit RSA cost less than previously assumed. They do not show that such attacks are cheap today.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: SecurityWeek.
