THE CRUNCH
Google DeepMind says AI agents working under human supervision, alongside cryptographers from UC San Diego and Inria, have identified two techniques that lower the expense of breaking 1024-bit RSA cryptosystems, the legacy encryption standard still found in older systems. In a sandboxed test, the agents re-ran an earlier forgery attack on the same 1024-bit key and cut the computing cost 3.5-fold: the first forged signature took 391 CPU core-years, versus 1,380 in the original academic study. The agents designed, ran and debugged the computation in under four days with roughly 20 messages from a human researcher, mostly approvals.
The signature finding turns on padding, the preset data that many signing standards add to a message to fill a fixed block size. Padding was known to make forgery harder, but DeepMind determined that its protection depends on how much of the block the attacker controls. Once an attacker controls roughly half of the block or more, padding adds no protection at all, according to Pushmeet Kohli, VP at Google DeepMind. The accompanying paper says the weakness covers the PKCS#1 v1.5 padding scheme as implemented through the PKCS#11 signing interface of devices such as hardware security modules. Even when the attacker controls less, such as a 32-byte hash, DeepMind reports an algorithm that its theoretical estimates put about 1,600 times ahead of the previous best method against 1024-bit keys.
The attack has real limits. It does not recover the private key, needs about 4 billion signing queries collected ahead of time, and fails against devices that hash messages internally. The key itself was not factored, which DeepMind estimates would take 500,000 to 1 million core-years.
The second finding concerns factoring many RSA keys of the same size, where one large upfront computation can be shared across all of them. DeepMind's agents produced an algorithm that, on paper, would make each extra 1024-bit key around 30 times less expensive to factor on average than the best previous approach. That estimate rests on an upfront computation priced like factoring a single key, and the technique has yet to be implemented.
Kohli said the results only affect obsolete 1024-bit systems, and that modern protocols, which almost universally use 2048-bit or larger keys, remain secure. He argued that in an era of AI-enabled mathematics, cryptographic hardness can no longer be treated as a fixed assumption, and that using AI to stress-test old assumptions will help keep modern encryption secure.