DeepMind reveals two flaws in 1024-bit RSA, 2048-bit keys stay safe - Pasquale Pillitteri

The announcement comes from DeepMind, Google’s AI research lab based in London, which is part of the Alphabet group. The team, led by researchers Dj Dvijotham and Abhradeep Thakurta, collaborated with cryptographers Nadia Heninger and Emmanuel Thomé to stress-test the aging 1024-bit RSA standard.

RSA is the public-key encryption algorithm that protects software signatures, website certificates, and key exchanges in connections like HTTPS and SSH. The number of bits in a key determines its strength; a longer key makes it more computationally expensive to break.

AI agents speed up cryptanalysis

The work was completed in a few weeks, a timescale that in cryptanalysis usually runs to years. Pushmeet Kohli, DeepMind’s vice president of science, explained that the models worked "guided by humans," meaning cryptographers set the parameters while the AI agents explored the mathematical space.

The first weakness concerns digital signatures. An RSA signature is not computed on the raw fingerprint of a message but on a number wrapped in a fixed padding. The agents measured how much protection this padding really gives and found that it fails when an attacker controls about half or more of the signed block.

The test was run against a 1024-bit test key that had already been attacked in an academic study. In that study, researchers forged signatures by impersonating a hardware security module without extracting the key, using 1,380 years of single-core computing spread over five months. The AI agents repeated the feat with 3.5 times less CPU time, using less than a thousandth of the computation needed to factor the key.

In the hardest case, where the attacker controls only a small part of the block, the agents found an algorithm that improves on the best known method for 1024-bit keys by about 1,600 times, according to DeepMind's theoretical estimates.

Breaking many keys at once

The second weakness targets the cost of factoring many keys together. The idea, dating back to 1993, is that if an attacker needs to break many numbers of the same size, they can pay once for a big preliminary computation and then each number costs less.

DeepMind’s working paper, titled "Fan Factories," gives each number a fan of number fields fed by one shared computation. With a precomputation equal to one GNFS factorization of a single 1024-bit key, each additional key costs about a fifty-eighth of that price, or about 30 times less than the best earlier batch method.

The advantage grows with the size of the batch. From three keys onward, the fan already beats the earlier method, and the benefit increases for larger archives. This makes the attack more practical for fleets of devices shipped with 1024-bit keys or stashes of old certificates.

For a single target, however, there is no advantage. The paper also admits that with unlimited precomputation, the original "factorization factory" method remains optimal, so the fan does not lower the theoretical floor.

2048-bit keys remain safe

Neither result touches RSA at 2048 bits or more. DeepMind explicitly states this in its announcement and the working paper. The gains concern 1024-bit keys, which the US standards body NIST has not allowed for generating new digital signatures since 2013.

The practical question is how many of the 1024-bit keys hiding in firmware someone will update before an attacker does the math. Analyses generally point to systems that were never updated, such as embedded devices with old firmware, first-generation smart cards, long-lived code-signing roots, and archived certificates.

DeepMind names no device categories, and no figure for the installed base has been published. Routers and smart-home modules may fall into that group, but the announcement does not name them.

The broader threat from AI

DeepMind’s numbers are theoretical estimates calculated by the team, with no complete implementation behind them, so they indicate an order of magnitude rather than an attack time. No independent group has replicated them yet.

The threat to encryption no longer comes only from quantum computers, because algorithmic research is now running faster than before. On July 28, Anthropic reported that its AI model had found weaknesses in a post-quantum signature scheme and a reduced version of AES-128, with an attack 200 to 800 times faster than the best previous method.

Kohli argues that the agents compressed into a few weeks work that takes cryptanalysis years, and in the official thread DeepMind concludes that the historical assumptions about how hard the underlying math problems are can no longer be taken for granted.