Google DeepMind said on Friday that AI agents working under human supervision found two weaknesses in legacy 1024-bit RSA, an older public-key encryption standard. One finding makes certain signature forgeries far cheaper. The other lowers the cost of factoring many keys at once. Pushmeet Kohli, who leads DeepMind's science work, announced the results in a post on X and said the team made the two advances in just weeks.
The research was led by Dj Dvijotham and Abhradeep Thakurta, working with cryptographers Nadia Heninger of UC San Diego and Inria and Emmanuel Thomé of Inria. In its own post on X, Google DeepMind described the work as showing how AI agents can speed up the science of stress-testing encryption.
The first weakness concerns RSA digital signatures and padding, the extra structured data added to a message before it is signed to block forgery. The agents found that once an attacker controls roughly half of the signed block or more, padding stops adding meaningful protection, and forging a signature becomes nearly as easy as if there were no padding at all.
Key facts
- 01Google DeepMind said on Nov. 6 that human-guided AI agents found two weaknesses in legacy 1024-bit RSA.
- 02A new forgery algorithm improves on the best prior method by roughly 1,600x for 1024-bit keys, by DeepMind's theoretical estimate.
- 03A sandbox test reproduced a known RSA-1024 forgery with 3.5x less CPU time than earlier academic work.
- 04A new batch method cuts the average cost of factoring each additional 1024-bit key by about 30x.
- 05DeepMind says RSA keys of 2048 bits or larger, the modern standard, are not affected.
To check the finding, the agents ran a sandboxed simulation against an RSA-1024 benchmark key that earlier academic work had already solved. Their implementation reproduced that result using 3.5 times less CPU time, and with less than one-thousandth of the computing power needed to factor the key itself.
The agents also tackled the harder case, where an attacker controls only a small part of the signed data, such as a 32-byte digital fingerprint. There they produced a new algorithm that, by DeepMind's theoretical estimates, improves on the best previously known method by about 1,600 times for 1024-bit keys. That figure is an estimate, not a measured attack.
The second weakness involves batch factoring, where an attacker targets many RSA keys of the same size at once. Google DeepMind says the agents found a method with better asymptotic complexity than any earlier batch technique, cutting the average cost of factoring each additional 1024-bit key by about 30 times.
Both findings are limited to 1024-bit RSA, which is considered obsolete. DeepMind says modern deployments, which almost all use keys of 2048 bits or larger, are not affected. That covers the encryption behind online banking, messaging, software updates and digital currencies. The announcements did not name the AI models behind the agents.
DeepMind framed the results as a contribution to the cryptanalysis community, meant to give defenders better tools to measure how strong their cryptography really is. Kohli said the work reinforces the need to keep reassessing cryptographic assumptions rather than treating the hardness of a scheme as fixed.
The RSA results add to a run of AI-assisted math results from DeepMind's science team. Its AI co-mathematician recently set a high score on FrontierMath Tier 4, and its AlphaEvolve system found an algorithm that multiplies 4x4 complex matrices using 48 multiplications.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
