Google's AI agents find 2 weak spots in old 1024-bit encryption

Weak spot 1, forged signatures: The first paper looks at signing devices, such as the hardware security modules companies use to guard private keys, that sign data sent to them by outside callers. DeepMind says that once an attacker controls about half of the 128-byte block being signed, the standard padding adds no protection, and forging a signature is no harder than attacking unpadded RSA. When the attacker controls less, such as a 32-byte SHA-256 fingerprint, DeepMind says a new algorithm improves on the previous best method by roughly 1,600 times at 1024 bits, by its own theoretical estimate. That figure was not run at full size.

The agents did the engineering: To test the first finding, two AI models reran a 1024-bit attack that an academic team (Laura Shea, Miro Haller, Adam Suhl, Heninger and Thomé) published in September. That team used 1,380 CPU core-years over five months; DeepMind's agents did it in 391 core-years, about 3.5 times less, according to WebProNews and AI Tamer. One model wrote the plan and audited results while the other wrote and ran the code. Together they produced about 33,500 lines of code and ran 336 experiments, peaking near 300,000 CPU cores, with about 20 short messages from a human, mostly approvals such as "continue." The attack also needed about 4 billion requests to the signing device.

Weak spot 2, cracking keys in bulk: The second paper targets attackers who want to break many keys of the same size. DeepMind says its new "fan factory" method would cut the cost of factoring each additional 1024-bit key by about 30 times compared with the best method known since 1993. The authors say it has not been built yet; the math was checked with the Lean proof software.

Measured vs. estimated: Only one of the headline numbers comes from an actual run. The 3.5x speedup was measured on a key that had already been broken. The 1,600x and 30x gains are theoretical estimates on paper. DeepMind's own post says it is the trend that matters: "we can no longer rely on historical hardness assumptions and must continuously stress-test cryptographic standards."

Should you worry? Not about your bank or messaging apps, according to DeepMind and every outlet that covered the papers, since those use 2048-bit or larger keys. The risk is in old equipment and signing services still running 1024-bit RSA, such as legacy devices, VPNs or code-signing setups that were never upgraded. The paper notes that current guidance already no longer approves 1024-bit RSA for creating new signatures; the U.S. standards agency NIST covers that phase-out in its SP 800-131A guidance. Devices that hash the message themselves before signing fall outside both attack models, the authors say.

What's still unknown: how much 1024-bit RSA is still in real use; whether DeepMind will release the agents' code; and how well the theoretical gains hold up when actually run. The September academic paper went further than DeepMind's results, concluding that with access to a signing device, "Even 4096-bit RSA does not appear to meet a 128-bit security level in this attack model," as WebProNews reported.

The 3.5x figure is a measured run on an already-solved benchmark key. The roughly 1,600x and 30x figures are DeepMind's theoretical estimates from two working papers and have not been run at full size. Both papers are working papers, not peer-reviewed publications.