Google DeepMind turned its AI agents loose on one of the oldest locks in internet security, and the agents came back with two new ways to pick it. The lock is 1024-bit RSA, an encryption standard the industry retired years ago. Your bank account is not in danger.
DeepMind AI RSA encryption research was announced Friday, November 6, by Pushmeet Kohli, DeepMind’s vice president of science, in a post on X. Two technical papers back it up. The work was led by Dj Dvijotham and Abhradeep Thakurta, working with outside cryptographers Nadia Heninger of UC San Diego and Inria and Emmanuel Thomé of Inria. Everything ran in a sandbox, against a retired standard chosen precisely because attacking it harms nobody.
And the headline number is a big one. For the hardest forgery cases, where an attacker controls only a small slice of the signed data, the agents produced a new algorithm that DeepMind estimates improves on the best previously known method by roughly 1,600 times for 1024-bit keys. That figure is a theoretical estimate, not a measured result. The measured number is smaller but still real: 3.5 times less CPU time to reproduce a known attack.
What the DeepMind AI RSA encryption research actually found
The first result is about faking digital signatures. RSA signatures rely on padding, extra structured data wrapped around a message before it gets signed. Padding is supposed to make forgery hard. DeepMind’s agents found a sharper answer to an old question: how much padding protects you depends on how much of the signed block the attacker controls.
Once an attacker controls roughly half of the 128-byte block in a 1024-bit key — 65 bytes or more, through the PKCS#11 mechanism called CKM_RSA_PKCS — padding stops adding meaningful protection. Forging a signature becomes nearly as easy as if there were no padding at all.
The agents didn’t just theorize about it. Two agents, guided by about 20 short messages from a human researcher, reran a recent forgery attack in under four days. The original attack came from a September paper by Laura Shea, Miro Haller, Adam Suhl, Heninger and Thomé, published on the IACR ePrint archive. DeepMind’s version used 3.5 times less CPU time than the academic team’s run, and less than a thousandth of the computing power it would take to factor the underlying key itself.
It wasn’t a clean run, either. Midway through, the agents had to track down a 32-bit index overflow that made the first computed root wrong. They found it, fixed it, and finished the job. That’s the kind of detail that matters here: the agents did real debugging on real math, not just pattern-matching through a textbook.
For the harder cases — where the attacker controls only a small slice of the block, such as a 32-byte digital fingerprint — the new algorithm is the 1,600x figure. DeepMind is careful about the caveat: the paper says that result is asymptotic and was not run at this size. Treat it as a bound on what’s possible, not a demo.
The second crack: factoring keys in bulk
The second paper attacks a different angle. Instead of forging one signature, it asks how cheaply an attacker could factor many RSA keys at once.
DeepMind’s agents found a new algorithm with better asymptotic complexity than any previously known batch method. It cuts the average cost of factoring each additional 1024-bit key by about 30 times. Batch factoring matters because real attackers rarely want one key. They want fleets of them: every device in a product line, every certificate on a server farm.
Same limits apply. The result targets 1024-bit keys only, and it’s a theoretical advance backed by the paper’s analysis, not a warehouse full of cracked keys. DeepMind published full technical papers on both results so the wider security community can check the work and build on it.
Why RSA-1024 was the right target
Picking a retired standard wasn’t a cop-out. It was the point.
RSA-1024 is old enough to be safe to attack and complex enough to be a meaningful test. The US National Institute of Standards and Technology stopped accepting 1024-bit RSA for generating new signatures back in 2013. Modern protocols use 2048-bit keys or larger, and those sit outside these findings.
“In practice, these results only affect obsolete 1024-bit RSA systems, and modern encryption protocols, which almost universally use 2048-bit or larger keys, remain secure,” Kohli wrote in the announcement.
That doesn’t mean RSA-1024 is gone from the world. Old hardware, legacy software and embedded systems still carry it, and that’s exactly why researchers keep probing it. The September ePrint paper had already pushed the point further than 1024 bits: with a signing oracle, its authors concluded, RSA’s concrete security should be 15 to 30 bits lower than factoring-based estimates for keys from 1024 to 4096 bits. They wrote that even 4096-bit RSA “does not appear to meet a 128-bit security level in this attack model.” DeepMind’s work doesn’t make that claim about modern keys. It sharpens the picture for the old ones.
Why this matters
Forget the scary headlines. Nobody’s passwords are about to spill because of this paper.
What matters is who did the research. A year ago, AI agents writing cryptanalysis papers would have sounded like a demo. Now they’re producing new algorithms, reproducing published attacks faster than the humans who found them, and debugging their own code along the way, all under human supervision, but with the humans mostly steering, not driving.
That changes the pace of security research itself. Cryptanalysis used to move at the speed of a small community of specialists. If agents can grind through the implementation work — reproducing attacks, testing variants, hunting bugs in their own code — the specialists spend their time on the ideas that actually need a human. The result is more attacks found, faster, against more targets.
For the rest of us, the practical lesson is boring and old: retire old crypto on schedule. RSA-1024 was supposed to be dead a decade ago. It lingers in places nobody looks. DeepMind just showed that AI agents are now good enough to find the cracks in it, and the next retired standard on the list won’t stay safe by being forgotten either.
FAQ
Did Google DeepMind’s AI break RSA encryption?
No. The findings apply only to obsolete 1024-bit RSA. Modern systems almost universally use 2048-bit keys or larger, and DeepMind says those are unaffected by these specific results.
Is my bank account or phone at risk from the DeepMind RSA findings?
No. DeepMind says the findings do not threaten online banking, messaging apps, software updates or digital currencies, and no live keys were broken. The experiments ran in a sandbox against a retired standard.
How much faster were the AI agents at attacking RSA-1024?
On a solved 1024-bit benchmark key, the agents’ implementation reproduced a known forgery using 3.5 times less CPU time than the academic team that first pulled it off, and less than a thousandth of the computing power needed to factor the key itself.
What is 1024-bit RSA and why does it still matter?
RSA-1024 is an older key size that the US standards body NIST stopped accepting for generating new signatures in 2013. It still shows up in old hardware, legacy software and embedded systems, which is why researchers keep probing it — and why DeepMind picked it as a safe test target.
Sources: CryptoBriefing, The Decoder, Interesting Engineering, WebProNews.