Google DeepMind says its AI models, working under the direction of human cryptanalysts, have found two new weaknesses in 1024-bit RSA, the legacy key size that still lingers in old hardware, smart cards and long-lived certificates. The DeepMind RSA-1024 results target signature forgery and the cost of cracking many keys at once. DeepMind is explicit that modern RSA-2048 and larger keys are not affected.
Key takeaways
- Google DeepMind announced on November 6 that its models, guided by cryptanalysts including Nadia Heninger (UC San Diego) and Emmanuel Thomé (Inria), found two weaknesses in legacy 1024-bit RSA.
- One result concerns forging RSA signatures when an attacker controls part of the signed data; the other cuts the cost of factoring 1024-bit keys in bulk.
- Reported figures: roughly a 1,600x improvement in a theoretical forgery case, and about a 30x lower marginal cost per extra key in batch factoring. Neither has been independently reproduced yet.
- RSA-2048 and larger keys are not threatened, according to DeepMind. The practical risk sits in forgotten 1024-bit keys.
- The real story is speed: DeepMind’s VP of science says the team got these results “in just weeks.”
What happened
In a post on its official X account, Google DeepMind wrote that, “guided by humans, our models uncovered two major weaknesses in legacy 1024-bit RSA cryptosystems.” Pushmeet Kohli, DeepMind’s VP of science, added that the team worked with leading cryptanalysis experts and reached the results in a matter of weeks, and that they do not affect modern schemes such as RSA-2048.
DeepMind frames this as AI-assisted research, not an autonomous discovery. Human cryptanalysts set the direction; AI agents explored the maths, wrote and checked proofs, and produced implementations. According to reporting by Data Studios, the batch-factoring work used a two-agent setup in which one model generated proofs and another verified them, with key algebraic steps machine-checked in the Lean 4 proof assistant. DeepMind has not said which models it used.
Weakness 1: forging signatures
The first result builds on a paper published in September by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé, “Forging 1024-bit RSA signatures in nearly SNFS time”. That team showed it is possible to forge 1024-bit RSA signatures without ever factoring the key, if an attacker gets temporary access to a raw signing “oracle”, such as a hardware security module exposed through an API. Their real-world run took 1,380 CPU core-years over five months and 232 oracle queries.
DeepMind’s work extends this to cases where padding is supposed to protect the signature. The reported finding: when an attacker controls roughly half the signed block or more, padding adds little real protection. In a sandboxed test against the same kind of 1024-bit target, an AI-generated implementation reportedly reproduced the earlier attack using about 3.5 times less CPU time. For a harder case, where the attacker controls only a small slice such as a 32-byte digest, DeepMind estimates its new algorithm is about 1,600 times better than the previous best method. That figure is a theoretical estimate, and DeepMind has not yet named the specific padding schemes involved.
Weakness 2: factoring keys in bulk
The second result is about economics at scale. Classic “factorization factory” ideas, going back to Don Coppersmith in the 1990s, pay a large one-time precomputation so that every later key is cheaper to break. DeepMind’s working paper, titled “Fan Factories”, proposes a new design that, as reported, lowers the marginal cost of factoring each additional 1024-bit key by about 30x compared with the best earlier batch method. No one has built this factory yet, and memory requirements remain a serious practical hurdle.
Why it matters
Nobody should panic about HTTPS. RSA-1024 has been disallowed for new signatures by US standards body NIST since the end of 2013, and public certificate authorities stopped issuing 1024-bit certificates years ago. Your bank’s website is not suddenly broken.
But “deprecated” is not the same as “gone.” 1024-bit keys still live inside embedded devices, older smart cards, industrial equipment, archived certificates and long-lived code-signing roots that nobody got around to rotating. The batch result matters most here: if each extra key gets much cheaper once a factory exists, the risk is no longer about one high-value key but about entire fleets of old devices.
The bigger signal is about pace. Kohli argued that we “must not assume the mathematical ‘hardness’ of cryptographic schemes.” Cryptanalysis has traditionally moved over years. Here, a team using AI agents produced new results in weeks. That fits a wider pattern: AI labs are now pointing frontier models at security problems, as we covered with OpenAI’s gated GPT-6 Cyber model. Attack research that used to need rare human expertise is getting faster and cheaper.
What it means for developers and businesses
If you run anything with keys, this is a good week for a cryptographic inventory. Practical steps:
- Find your 1024-bit RSA keys. Check SSH host and user keys, TLS certificates on internal services, VPN appliances, IoT and embedded firmware, smart cards, and code-signing roots. Retire any you find.
- Lock down signing services. If an outside party can influence what your HSM or signing API signs, treat that as a forgery risk. Avoid raw or low-padding RSA signing, and restrict who can call signing endpoints.
- Prefer modern algorithms for new work. Ed25519 for SSH, ECDSA P-256 or RSA-3072+ for TLS, and larger RSA keys or elliptic-curve schemes for long-lived signing keys.
- Plan for post-quantum. The Shea et al. paper itself argues its results support moving away from RSA during the post-quantum transition. Put that migration on your roadmap rather than treating it as someday work.
Teams that sell into regulated industries should expect auditors to ask about legacy key sizes sooner. Security incidents tied to forgotten infrastructure, like the supermarket freezer cyberattack we reported earlier this month, show how often old, unmanaged systems become the weak point.
What is still uncertain
A few caveats are worth keeping in mind. The signature-forgery figures come from DeepMind’s announcement; a full public paper describing the threat model and the affected padding schemes was not available at the time of writing. The batch-factoring estimates are asymptotic, rely on standard heuristics, and have not been implemented. Neither result has been independently reproduced. This is a research announcement, not a report of any real-world attack, and no affected systems have been identified.
What to watch next
- A full write-up of the signature result, including which padding schemes are weakened.
- Independent cryptographers testing or reproducing the claims, and any first implementation of a “fan factory.”
- Responses from HSM vendors and standards bodies on raw-signing interfaces.
- Whether AI-assisted cryptanalysis starts to change estimates for RSA-2048 and post-quantum timelines.
The short version: your modern keys are fine, your forgotten keys are not, and the speed at which AI is now helping find cracks in old cryptography is the part to take seriously.