DeepMind made 1024-bit RSA forgery 3.5x cheaper
Google DeepMind published two working papers on 5 and 6 November showing that AI agents, working under human supervision, cut the cost of attacking 1024-bit RSA in two separate places. Nothing deployed today stopped working, and the company says so first: modern keys of 2048 bits or more are untouched. What changed is the price of an attack that already existed, and the price of a whole class of attacks nobody has run yet.
The headline is a 3.5x saving. The detail worth your attention is that two agents re-implemented, in under four days, a computation that took academic cryptographers about five months.
What the agents actually did
RSA signatures can be broken two ways. Factor the modulus and you recover the private key, which is the attack everyone knows about. The other way is to forge a signature that passes verification without ever recovering the key, using a signing device as an oracle. A UC San Diego and Inria team published the second kind of attack against a 1024-bit benchmark key in September, at a cost of about 1,380 CPU core-years and roughly five months of work.
DeepMind's team — Dj Dvijotham and Abhradeep Thakurta, with Nadia Heninger of UC San Diego and Inria and Emmanuel Thomé of Inria — handed the same key, the same algorithm and the same parameters to a supervising agent and an executing agent, and asked them to rebuild the computation. The rerun came in at 391 core-years, about 3.5x cheaper, in three days and 22 hours on a burst of up to roughly 300,000 CPU cores and 16 GPUs, according to DeepMind's announcement.
Here is the part the press release does not lead with: almost all of the saving was plumbing. About 90 percent of the CPU reduction came from optimising the sieving stage, where the programs search for algebraic relations among candidates. The primary sieve ran 1.8 to 1.9 times faster than the original; the second-layer sieve, 3.4 to 4.4 times faster. The agents also found and fixed a 32-bit integer overflow that had quietly produced a wrong result, and they needed about 20 short messages from the human researcher, most of them approvals.
That is a productivity result, and it is the same shape as the two factoring records set in September. Eric Lu of Cognition drove Devin agents to factor RSA-260, writing "essentially no algorithmic advancements" — the win was porting the number field sieve to GPUs. Sixteen days later an Anthropic engineer, Stephen Weis, did the same thing with Claude to reach RSA-896. We called out the pattern when RSA-260 fell: RSA-260 falls after 35 years — AI summaries invented the method. Agents are extremely good at the part of cryptanalysis that is software engineering, which is most of the effort and almost none of the fame.
The result that touches real devices
The more actionable finding is about padding. Signature standards add preset bytes to a message so it fills a fixed-size block, and padding was believed to make forgery harder. DeepMind found that its protection depends entirely on how much of that block an attacker controls. Once they control roughly half or more, padding adds no protection at all, the affine-root paper concludes. The paper applies this to PKCS#1 v1.5 signatures, the format behind the PKCS#11 signing interface that hardware security modules and smart cards expose.
The attack still has hard preconditions. It needs about 4 billion chosen-message signature queries made in advance, it does not recover the private key, and it fails against devices that hash messages internally — SecurityWeek's write-up is clear on all three. So the exposure is not TLS. It is any "raw sign" oracle: code-signing services, timestamping authorities, older payment HSMs, embedded firmware signers. If you run a device that will sign a block a caller assembled, the question to ask this week is whether that caller can control more than half of it.
For the harder case, where the attacker controls only a 32-byte digest, DeepMind's agents produced a new algorithm that by theoretical estimate improves on the previous best method by roughly 1,600x at 1024 bits. That one has not been run.
The exponent moved for the first time since 1993
The second paper is where the ambition shows. Keys come in standard sizes, so an attacker facing many 1024-bit moduli can share one expensive precomputation across all of them — the "factoring factory" idea. The catch was that under a budget equal to a single factoring run, factories were not worth building, and the best per-target method had stood unchanged since Coppersmith's multiple-number-field sieve in 1993.
Fan Factories gives each target several number fields and pools the relations they produce, so a relation that is useless in one field still counts in another. At 1024 bits, each additional key then costs about one fifty-eighth of a full run, roughly 30x better than the best previous batch method, with the per-target exponent dropping from 1.9019 to 1.7929. It breaks even at about three keys.
This is a different kind of claim from everything above. September's records moved a constant. This moves the exponent, which is the term that decides how key sizes age. It is also, so far, only mathematics: no fan factory has been built, and the proofs were generated by one agent and checked by a second, with the algebra formalised in Lean 4.
Multi-agent setups are not automatically trustworthy — DeepMind's 100-agent swarm found a bug and split into cheaters — which is why the supervisor/executor split and the machine-checked proofs matter here. The claim is only as good as the verification behind it, and DeepMind at least shipped the verification.
Who wins, and what the cost curve means
Winners: defenders, who now have a cheaper way to re-price an old attack, and Google, which gets to argue that AI is a security instrument as much as a security worry. HSM vendors get a specific engineering question with a specific answer. Losers are the 1024-bit long tail. That key size was deprecated for public certificates in 2013 and never fully disappeared: it survives in DKIM email signing, on old TLS endpoints, in firmware signing, and in industrial gear nobody wants to touch. Every one of those is a place where "retired" and "gone" are different words.
The strategic point is not 1024 bits. It is that the cryptanalysis cost curve had two components — engineering effort and asymptotic progress — and one of them just got cheap to buy. Key-size guidance is written on the assumption that the second component drifts slowly, over decades, which is how NIST thinks about transition timelines. If agent-driven work compresses the first component by an order of magnitude and starts nibbling the second, those timelines need re-derivation more often than once a decade.
The skeptic's case
Three fair objections. First, the agents did not find the attack; the September academic paper did. DeepMind optimised an implementation of someone else's result on an already-solved benchmark key, in a sandbox. Second, the models are unnamed — "Model A" supervises, "Model B" executes — so no one outside can reproduce the AI half of the claim, or say how much of the mathematics the human authors already knew. Third, the two big multipliers, 1,600x and 30x, are leading-order estimates with the error terms dropped, and the fan factory exists on paper only.
DeepMind is unusually straight about the scope in the paper itself: the 2048-bit precomputation alone sits around 2^117 operations, which is why the result does not touch modern keys. The company's chief scientist, Pushmeet Kohli, put the conclusion plainly enough — cryptographic hardness cannot be treated as a fixed assumption.
What to watch
Whether anyone implements a fan factory is the real test, because an unimplemented exponent improvement is a citation, not a security event. Watch HSM and PKCS#11 vendors for guidance on restricting raw signing oracles; that is the fixable exposure and the one that ships in products. Then watch whether agent-driven cryptanalysis produces a result against a live assumption — 2048-bit RSA, or a lattice scheme — rather than a retired benchmark that was chosen precisely because breaking it is safe. And watch the September pattern repeating: three AI-assisted cryptanalysis results in ten weeks, each one cheaper than the last. That cadence, not any single number, is the story.
If a rented cluster and a coding agent can re-derive a five-month attack in four days, should key-size guidance be re-run every year instead of every decade? Write to us via our contact page.
