AI Agents Made Old 1024-Bit RSA Keys Cheaper to Attack: The Spec Sheet, Plus a Key-Size Checklist for Your Systems
Google DeepMind says human-supervised AI agents, working with UC San Diego and Inria cryptographers, cut the cost of two attacks on legacy 1024-bit RSA. Keys of 2048 bits and up are not affected, but it is a good reason to hunt down the 1024-bit keys still in use.
Encryption strength is usually treated as a fixed fact. New research from Google DeepMind is a reminder that it is really an estimate, and that estimates can move. The company says AI agents working under human supervision found two ways to make attacks on legacy 1024-bit RSA cheaper than experts had assumed. Modern 2048-bit and larger keys are not affected.
The figures here come from SecurityWeek’s report on the DeepMind RSA research, which quotes Pushmeet Kohli, a DeepMind vice president and chief scientist at Google Cloud. The work was done together with cryptographers from UC San Diego and Inria.
Spec sheet: finding one, signature forgery
- Target: 1024-bit RSA signatures using PKCS#1 v1.5 padding, the format used by the PKCS#11 signing interface on cryptographic devices such as hardware security modules (HSMs).
- Key insight: padding stops helping once an attacker controls about half of the signed block. In Kohli’s words, “Once they control roughly half of the block or more, padding adds no protection at all.”
- Measured result: re-running an earlier academic forgery attack on the same key, the agents cut CPU time 3.5-fold, to 391 CPU core-years versus 1,380 in the original study.
- Effort: two AI agents designed, ran and debugged the computation in under four days, with about 20 messages from the human researcher, mostly approvals.
- Harder case: when the attacker controls less of the block, such as a 32-byte hash, DeepMind describes an algorithm that by theoretical estimate is about 1,600 times better than the previous best against 1024-bit keys.
- Limits: the attack does not recover the private key, needs roughly 4 billion signing requests made in advance, and does not work against devices that hash messages internally. The key was not factored; doing that is estimated at 500,000 to 1 million core-years.
Spec sheet: finding two, factoring many keys at once
- Scenario: an attacker who wants to factor many RSA keys of the same size and can share one large upfront computation across all of them.
- Result: an algorithm that makes factoring each additional 1024-bit key about 30 times cheaper on average than the best previous approach.
- Caveats: the estimate is theoretical, assumes an initial computation as expensive as factoring one key, and the method has not been implemented.
The official bottom line
“In practice, these results only affect obsolete 1024-bit RSA systems, and modern encryption protocols, which almost universally use 2048-bit or larger keys, remain secure,” Kohli said. The larger point, he added, is that cryptographic hardness cannot be treated as a fixed assumption in an era of AI-assisted mathematics.
Checklist: where 1024-bit keys tend to hide
- Email signing (DKIM) keys published years ago and never rotated.
- SSH host and user keys on older servers, network gear and appliances.
- Self-signed or internal certificates on printers, cameras, UPS cards, storage and management interfaces.
- Legacy VPN, Wi-Fi (802.1X) or code-signing certificates issued by an internal certificate authority.
- HSMs or smart-card setups that still sign with old keys or accept raw, unhashed signing requests.
What this means for your company
Nobody is going to spend hundreds of core-years attacking a typical small business, so this is not an emergency. It is, however, a useful nudge to retire weak keys while it is cheap and boring to do. Ask your IT team or provider to inventory key sizes across email, remote access, internal certificates and devices, replace anything at 1024 bits with 2048-bit RSA or a modern elliptic-curve option, and add key size to the checklist used when new equipment is installed. If you run an HSM or signing service, confirm that it hashes messages itself rather than signing arbitrary raw input from callers.
Want a quick inventory of the keys and certificates your business still depends on, and which ones are overdue for replacement? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
