DeepMind’s AI cuts the cost of attacking RSA-1024

Google DeepMind’s human-guided AI agents have helped cryptographers lower the cost of attacks on legacy 1024-bit RSA. Two working papers describe improvements to signature forgery and batch factoring, including a reproduced computation that used 391 CPU core-years, about 3.5 times less CPU work than the earlier result.

RSA is a public-key cryptographic system used for digital signatures and encryption. Its security depends on difficult mathematical problems involving a large composite number. The new work examines specific attack models for older key sizes, with researchers from DeepMind, UC San Diego, Inria and other academic collaborators.

One computation used 391 core-years

The first working paper reproduces an earlier 1024-bit modular-root computation with the same algorithm, polynomials and bounds. Its result reduces the reported CPU work from roughly 1,380 core-years to 391.

A CPU core-year measures the work one processor core would perform running continuously for a year. Large numbers of cores can share that work, so a core-year count and elapsed calendar time measure different things. The paper says two cooperating AI agents designed, ran and debugged the computation in under four days, using up to 300,000 CPU cores and 16 GPUs. The 391 core-years measure CPU work; GPU linear algebra is accounted for separately, at about 330 reserved GPU-hours.

The experiment concerns an attack with temporary access to a signing oracle: an interface that signs chosen inputs. After that preparation, the attacker tries to produce signatures for fresh targets. This particular experiment reproduces a previously studied instance and measures how efficiently the computation can be performed.

Signature formatting changes the attack conditions

The first paper also analyses signing interfaces that constrain the format of their inputs. For the PKCS#1 v1.5 format, the authors show that sufficiently large attacker-controlled input regions can make the problem as easy as the unrestricted-oracle case.

For signing interfaces that accept a caller-supplied digest, the paper identifies a 64-byte digest at 1024 bits as falling into that easier regime. A 32-byte digest leaves a harder mathematical problem, for which the researchers develop a faster algorithm. Interfaces that hash the message internally have a different attack model. The study combines proofs, heuristic cost analysis and the separate completed reproduction.

These conditions are essential to understanding the result: the attack model includes access to chosen-input signatures during preparation, a specified input format and a legacy key size.

Batch factoring could share more of the expensive work

The second working paper, Fan Factories, estimates a cheaper way to factor many integers of the same size. Factoring an RSA modulus means recovering the prime numbers whose product forms that modulus, which can expose the corresponding private key.

The proposed method shares a large precomputation across targets and uses several number fields per integer. Its estimates suggest that, after preparation costing about one conventional factorisation, each additional 1024-bit target could cost roughly one fifty-eighth of a standard number-field-sieve run.

Those are leading-order estimates under standard number-field-sieve heuristics. The authors describe practical implementation and memory requirements as research questions. Lean 4 machine-checks the algebraic identities used in the analysis.

Legacy key retirement remains the practical priority

Both papers place deployed RSA systems using 2048-bit and larger keys outside the practical threat described by these results. Their immediate relevance is the shrinking margin around legacy 1024-bit deployments and older signing interfaces.

NIST’s key-length transition guidance already requires stronger RSA parameters for modern signature generation. Security teams can use the research to prioritise inventories of older signing keys, cryptographic devices and retained legacy verification paths. The papers also show how human-supervised agents can help design, execute and check substantial cryptographic research.