Google DeepMind says AI agents working under human supervision, with cryptographers affiliated with UC San Diego and Inria, found two ways to make attacks on 1024-bit RSA keys cheaper, SecurityWeek reported Monday. No key was broken and DeepMind says larger keys remain secure, but the work shows AI agents carrying out real code-breaking research, and it gives organizations still using 1024-bit keys in older hardware another reason to retire them.
What Happened
RSA is a widely used public-key system for encrypting data and creating digital signatures; its security rests on how hard it is to split a very large number into its prime factors. The work was led by DeepMind's Dj Dvijotham and Abhradeep Thakurta with Nadia Heninger of UC San Diego and Inria and Emmanuel Thomé of Inria, Kohli wrote Nov. 6, and is detailed in two technical papers.
The first finding concerns the PKCS#1 v1.5 signature format used through PKCS#11, the standard signing interface to hardware security modules (HSMs), the tamper-resistant devices that hold signing keys. The format's padding stops adding protection once an attacker controls roughly half of the signed block or more, Kohli said.
The team also repeated a 1024-bit signature forgery that UC San Diego and Inria researchers carried out earlier this year, which The Primary Wire reported in September, citing Tom's Hardware. The first forged result took 391 CPU core-years, a core-year being one processor core running for a year, against 1,380 originally, a 3.5-fold cut. Two AI agents designed, ran and debugged the computation in under four days, with about 20 messages from the supervising researcher, mostly approvals, SecurityWeek reported.
The second finding is a way to factor many keys of the same size by sharing one large upfront computation. On paper, each additional 1024-bit key would cost about 30 times less than the best earlier method. It has not been implemented.
Why It Matters
The practical limits are significant. According to SecurityWeek, the signature attack does not recover the private key, needs roughly 4 billion signing requests made in advance, and fails against devices that hash messages internally. "In practice, these results only affect obsolete 1024-bit RSA systems, and modern encryption protocols, which almost universally use 2048-bit or larger keys, remain secure," said Pushmeet Kohli, a vice president at Google DeepMind.
NIST's transition guidance, SP 800-131A Rev. 2, already lists RSA keys shorter than 2048 bits as disallowed for creating signatures, and The Primary Wire reported Oct. 27 that NIST will phase out RSA entirely by 2035. Owners of HSMs, PKCS#11 setups and older signing systems should confirm none still sign with 1024-bit keys.
The bigger shift is speed. "We cannot treat cryptographic hardness as a fixed assumption," Kohli said, according to SecurityWeek. Risk teams that plan encryption upgrades around fixed timelines may need to revisit them more often.
What to Watch
Watch for independent review of the findings, any attempt to implement the batch-factoring method, and whether NIST or other standards bodies comment on remaining 1024-bit deployments.
