Google DeepMind researchers, working with cryptographers from UC San Diego and Inria, say supervised AI agents cut the price of attacking 1024-bit RSA systems in two ways. Pushmeet Kohli, a DeepMind vice president and chief scientist at Google Cloud, stressed scope: only obsolete 1024-bit deployments are affected, while 2048-bit keys and above stay secure.
Factoring was never attempted. Estimates put that at 500,000 to 1 million core-years, far beyond what the agents spent re-running an earlier academic signature forgery on the same 1024-bit key. Their bill dropped from 1,380 CPU core-years in the original paper to 391, a 3.5-fold cut. Design, execution and debugging of that computation took under four days, aided by about 20 supervisor messages.
Where the margin came from
Signature standards pad a message to a fixed block, long assumed to blunt forgery. The agents found protection hinges on how much of that block an attacker controls. Should an attacker dictate roughly half the block or more, Kohli explained, padding buys nothing. That paper points at PKCS#1 v1.5, which PKCS#11 signing interfaces on hardware security modules rely on.
Attacks stay constrained elsewhere. Roughly 4 billion advance signing queries are needed, no private key is recovered, and devices hashing messages internally are immune. With only a 32-byte hash under attacker influence, the agents still produced an algorithm estimated near 1,600 times better than the prior best against 1024-bit keys. A second result targets many same-size keys, making each additional one roughly 30 times cheaper on average, though that is theoretical and never implemented.
What to actually change
Exposure sits in legacy kit: embedded devices, code-signing roots and certificate authorities still issuing 1024-bit material. Inventory where those keys authenticate anything and retire them on a calendar, not after an incident. Hardness is no longer fixed, so test it first.
