AI Security

DeepMind AI agents find two new weaknesses in legacy RSA-1024

DeepMind AI agents found cheaper attacks on legacy 1024-bit RSA. RSA-2048 is safe, but UK firms should hunt down old keys and DKIM records now.

Padlock graphic illustrating AI agents finding weaknesses in legacy 1024-bit RSA encryption

Google DeepMind says AI agents, steered by its researchers and two leading cryptographers, have found two cheaper ways to attack legacy 1024-bit RSA. Modern 2048-bit keys are safe, but the speed of the work matters more than the target, and it should push every UK organisation to finish finding its old cryptography.

What happened

On Friday 6 November 2026, Pushmeet Kohli, Google DeepMind’s vice-president for science, announced two working papers in cryptanalysis produced with heavy help from AI agents. Dj Dvijotham and Abhradeep Thakurta led the research. Inria’s Emmanuel Thomé and Nadia Heninger, who holds posts at UC San Diego and Inria, are co-authors and well known for practical factoring work.

Both papers target 1024-bit RSA, a key size long since retired. One covers signature forgery through signing interfaces that apply a fixed format; the other covers factoring many same-size keys more cheaply. DeepMind and its co-authors are clear that neither result threatens RSA-2048 or larger keys.

Caveats first. These are working papers, not peer reviewed, and by 7 November nobody outside had reported reproducing either result. Several headline numbers are estimates rather than measurements, so it pays to separate what was run from what was calculated.

The technical picture

Start with what was run. The signature paper revisits a 1024-bit forgery experiment by Laura Shea, Miro Haller, Adam Suhl, Heninger and Thomé. That earlier effort needed about 1,380 CPU core-years. Using the same algorithm, polynomials and parameters, a pair of AI agents working together built and debugged a reproduction that used 391 core-years, roughly 3.5 times less. The paper credits better engineering, not a new algorithm. The paper says the agents produced around 33,500 lines of new code and ran on up to 300,000 cores and 16 GPUs for 3.2 days, with roughly twenty brief prompts from the supervising researcher. Factoring that key directly would need between half a million and a million core-years.

The paper also makes a theoretical point about PKCS#1 v1.5 padding in the PKCS#11 mechanism CKM_RSA_PKCS. Once the caller controls more than about half the signed block (64 of 128 bytes at 1024 bits), the fixed padding offers no real extra protection, and the known attack then needs only twice as many signing requests. The attack model is demanding: the adversary needs direct access to a raw signing interface and must make billions of chosen requests before knowing which signature they want to forge. Devices that hash internally before signing fall outside it.

Now the estimates. When the attacker governs a smaller slice, for example a 32-byte SHA-256 digest, the paper proposes a fresh algorithm. Kohli’s announcement describes it as roughly 1,600 times better than the previous best for 1024-bit keys, by DeepMind’s theoretical estimates. The paper presents that gain only as a change in an asymptotic cost formula, noting it was never executed at 1024 bits. Treat the 1,600x figure as a projection, not a demonstration.

The batch-factoring paper is likewise on paper only. After up-front work equal to roughly one full factoring, every further 1024-bit key would need roughly 1/58 of the usual effort, around 30 times better than the best comparable method, dating from 1993. No implementation exists, and skipping the up-front spend caps the improvement at 1.75 times. An agent wrote the proofs, a second checked them, and the Lean 4 proof assistant verified the algebra.

Panel comparing the measured results of DeepMind's RSA-1024 research with its theoretical estimates

Why it matters for UK organisations

RSA is not broken. The useful story is speed: agents finished in days a computation that originally took about five months (mostly thanks to far more parallel hardware, the paper admits) and found algorithmic gains in weeks. DeepMind argues hardness should not be assumed to be a constant that wears away gradually, which changes how much time defenders can count on.

1024-bit RSA is still out there. NIST no longer accepts RSA keys under 2048 bits for new signatures, yet the DKIM email-signing standard (RFC 8301) still permits 1024-bit keys while recommending 2048. Older HSM configurations, code-signing and firmware-signing keys on embedded kit, internal PKI built a decade ago and bespoke applications that call PKCS#11 directly can all carry short keys. The batch result shows that an adversary with many same-size targets gets economies of scale.

The NCSC’s post-quantum migration guidance already gives UK organisations a timeline: complete discovery and assessment by 2028, finish the highest-priority migrations by 2031 and complete the move by 2035. Discovery is exactly what surfaces legacy RSA. This research has nothing to do with quantum computing, but the lesson is the same: know where your public-key cryptography lives and be able to change it.

Expert view

In my experience, weak cryptography rarely shows up in the systems people worry about. It hides in the DNS record nobody has touched since the mail platform was migrated, in an appliance’s management certificate, or in a signing service a developer wired straight into an HSM years ago. When we test, a 1024-bit DKIM key or a short-keyed internal CA is still not unusual, and it is nearly always forgotten configuration rather than a choice.

I would be careful with the hype. The forgery attack needs an exposed raw signing oracle and billions of queries, which is a narrow and noisy scenario. The 1,600x number is a formula, and the 30x batch gain has never been built. The 3.5x saving is real but came from better engineering of a known method.

What genuinely concerns me is the trajectory. Two agents and twenty messages from a human reproduced, faster, work that took specialists months. If that holds, comfortable margins can shrink with little warning, and organisations without crypto agility will be replacing keys under pressure. Peer review and independent replication should come before anyone revises key-size policy, but they are no reason to delay housekeeping.

What to do now

  1. Inventory RSA key sizes. Scan certificates, SSH host and user keys, code-signing keys, HSM objects and internal CAs for anything under 2048 bits. This sits naturally inside the NCSC’s 2028 discovery phase.
  2. Check your DKIM records. Look up the selectors for every sending domain, including third-party mail services, and rotate any 1024-bit keys to 2048-bit.
  3. Lock down signing interfaces. Make sure no application or user can submit arbitrary data to raw RSA signing mechanisms such as CKM_RSA_X_509 or CKM_RSA_PKCS. Prefer mechanisms that hash internally, and rate-limit and monitor signing services. This maps to the Cyber Essentials secure configuration and user access control themes.
  4. Replace legacy devices. Kit that can only use 1024-bit keys is effectively unsupported for cryptographic purposes; plan replacement in line with the Cyber Essentials security update management principle.
  5. Build crypto agility. Record where algorithms and key sizes are configured so you can change them quickly, which also prepares you for post-quantum migration.

Bottom line

DeepMind has not broken modern RSA, and its boldest numbers are unreplicated estimates in papers that have not been peer reviewed. What it has shown is that AI agents can speed up serious cryptanalysis dramatically. For UK organisations the response is unglamorous: find and retire 1024-bit keys, close raw signing interfaces and treat the NCSC’s discovery deadline as a floor, not a target.

Sources

Related Posts