Google DeepMind AI agents find two weaknesses in legacy 1024-bit RSA
Updated: 7 minutes ago
Google DeepMind said on November 6 that AI agents, guided by human cryptanalysts, uncovered two weaknesses in legacy 1024-bit RSA: one in how padding protects RSA digital signatures, and one in the cost of factoring many 1024-bit keys at once. The company announced the work in posts on its official X account and on the account of Pushmeet Kohli, its vice president of science, and published a working paper on the batch-factoring result, titled "Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS" and dated November 5, 2026.
Both results concern 1024-bit keys, a size that standards bodies retired for new signatures more than a decade ago but that still survives in older hardware, long-lived certificates and embedded systems. DeepMind says modern deployments based on 2048-bit and larger RSA are not threatened, and the paper repeats that statement in its abstract.
The batch-factoring paper puts a number on the second weakness. With a one-time precomputation equal to the cost of factoring a single 1024-bit number, each further 1024-bit key can be factored at about 1/58 of the cost, which the authors describe as roughly 30 times less than with the best previous batch method. They stress that this is a leading-order theoretical estimate and that no implementation of the new method exists yet.
··········
WHAT GOOGLE DEEPMIND ANNOUNCED ABOUT RSA-1024.
DeepMind described the project as AI-assisted research rather than autonomous discovery. Its official post said that, guided by humans, its models uncovered two major weaknesses in legacy 1024-bit RSA cryptosystems, and Kohli said in his own post that the team worked with leading cryptanalysis experts and reached the results in a matter of weeks. The research was led at DeepMind by Krishnamurthy (Dj) Dvijotham and Abhradeep Thakurta, with Nadia Heninger of UC San Diego and Emmanuel Thomé of Inria among the collaborators. Heninger and Thomé are well known in public-key cryptanalysis, and both appear as authors of the batch-factoring paper.
The two results are of different kinds. The signature result is about forging RSA signatures without recovering the private key, in settings where an attacker can influence part of the data being signed. The factoring result is about economics: how much it costs to break many keys of the same size once a large shared computation has been paid for. Neither result breaks a single 1024-bit key faster than the general number field sieve, which remains the standard measure of RSA strength.
........
Result | What it targets | Headline figure | Status |
Signature padding | RSA signatures where the attacker controls part of the signed block | 3.5x less CPU time on a solved benchmark; about 1,600x better for a 32-byte fingerprint | Sandbox reproduction plus theoretical estimate, per DeepMind |
Fan factories | Factoring many same-size RSA keys after a shared precomputation | About 1/58 of a GNFS run per extra 1024-bit key, about 30x below MNFS | Working paper, leading-order estimate, not implemented |
Scope | Legacy 1024-bit RSA | 2048-bit and larger RSA not threatened | Stated by DeepMind and in the paper |
........
··········
THE RSA SIGNATURE PADDING WEAKNESS FOUND BY THE DEEPMIND AGENTS.
RSA signatures are not computed over a raw hash. Signing schemes first wrap the message digest in fixed padding so that the number being signed has a rigid structure, and that structure has long been treated as a defense against forgery. According to DeepMind's description of the work, the agents found that this protection fades quickly once an attacker controls a large share of the signed block. When the attacker controls roughly half of the block or more, the padding adds no meaningful protection, and forging a signature becomes about as hard as attacking an unpadded system.
DeepMind said it tested this in a sandboxed simulation against a 1024-bit benchmark key that had already been attacked in an earlier academic study, and that the AI-generated implementation reproduced the result with 3.5 times less CPU time, using less than a thousandth of the computation needed to factor the key itself. The earlier study matches the 1024-bit forgery published in September by Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé, who forged signatures from a hardware security module through black-box API calls. That attack took 1,380 CPU core-years over five calendar months and 2^32 queries to a raw signing oracle, so a 3.5-fold reduction would bring the same job to roughly 390 core-years.
For the harder case, where the attacker controls only a small part of the block such as a 32-byte digest, DeepMind said the agents found a new algorithm that it estimates is about 1,600 times better than the best previously known method for 1024-bit keys. The company presents that figure as a theoretical estimate. It has not named the specific padding schemes covered, and a full paper on the signature result was not publicly available when this report was prepared, so the 3.5x and 1,600x figures rest on DeepMind's own statements.
··········
HOW THE FAN FACTORY CUTS THE COST OF FACTORING MANY 1024-BIT KEYS.
The second result builds on the factorization factory, an idea Don Coppersmith published in 1993. A factory makes sense when many integers of the same size must be factored: an attacker pays once for a large precomputation and then spends less on each target. The DeepMind paper gives each target integer its own "fan" of number fields, all fed by a shared precomputed rational side, and derives a closed-form minimum cost per integer for each precomputation budget.
The paper writes costs as L[c], the usual sub-exponential notation for number field sieve algorithms, where a smaller constant c means a faster method. With a precomputation budget equal to one GNFS factorization, the fan factory brings the cost of each further integer to about L[1.793], against L[1.902] for the multiple number field sieve (MNFS), the best batch method since 1993. The authors report that the fan design improves on earlier methods for budget exponents between about 1.902 and 1.950, and that a single number field per integer becomes optimal above that range.
........
Method | Precomputation | Cost per integer (exponent c in L[c]) |
GNFS, one key at a time | None | about 1.923 |
MNFS (Coppersmith) | None | about 1.902 |
Coppersmith factory | about 2.007 | about 1.639 |
DeepMind fan factory | One GNFS run | about 1.793 |
Batch fan, no precomputation | None | at most 0.018 below MNFS |
........
The paper is careful about its limits. The estimates drop lower-order terms, rest on standard heuristics about how often numbers are smooth, and assume a simple unit-cost computing model. Memory is a second obstacle: at a budget of one GNFS run, the stored table holds on the order of L[1.66] pairs. No fan factory has been built, and the paper says the key size at which it would beat a well-tuned number field sieve in practice is still an open empirical question. With unlimited precomputation, Coppersmith's original factory remains the optimal design, so the fan does not lower the theoretical floor.
··········
[[ADPLUS_300x250_1]]
WHAT A BATCH OF 1024-BIT KEYS COSTS UNDER THE FAN FACTORY ESTIMATE.
The paper's two figures for 1024-bit keys, 1/58 of a GNFS run per extra key and a 30-fold gap to MNFS, are enough to sketch how the economics change with the number of targets. The table below expresses cost in units of one GNFS factorization of a 1024-bit number, counts the fan factory's one-run precomputation in its total, and puts MNFS at 30/58 of a GNFS run per key, which matches the ratio implied by the paper's exponents at this size. These are leading-order illustrations computed from the paper's figures, not predicted running times.
........
Keys factored | MNFS total (GNFS units) | Fan factory total incl. precomputation | Fan factory advantage |
1 | 0.52 | 1.02 | none |
3 | 1.55 | 1.05 | 1.5x |
10 | 5.17 | 1.17 | 4.4x |
100 | 51.72 | 2.72 | 19x |
........
The pattern agrees with the paper's own statement that, once the precomputation is counted, three or more integers already cost less with the fan factory than with MNFS. Beyond that point the advantage grows with the size of the batch and approaches the 30-fold per-key gap. The economics favor an attacker who wants to break a large population of legacy keys, such as an archive of old certificates or a fleet of devices that shipped with 1024-bit keys, rather than one carefully chosen target.
··········
WHAT CHANGES FOR ORGANIZATIONS STILL USING 1024-BIT RSA.
For anyone running current RSA keys of 2048 bits or more, DeepMind's results change nothing in practice, and the company and the paper both say so plainly. US federal guidance from NIST has disallowed RSA keys shorter than 2048 bits for generating new digital signatures since the end of 2013, and the major web PKI stopped issuing 1024-bit certificates years ago.
The exposure sits in systems that were never upgraded. Three groups have concrete reasons to act on this research:
Owners of signing services and HSMs. The signature result is most relevant where a system signs data that an outside party can partly choose. The September HSM attack that DeepMind used as its benchmark depended on access to a raw signing interface, and the Shea et al. paper names blind RSA schemes as another setting that offers such an interface. Teams that still expose 1024-bit signing through an API should treat partial attacker control over the signed block as a forgery risk, restrict raw or low-padding signing operations, and rotate those keys.
Operators of large fleets of legacy keys. The batch result lowers the cost per key when many keys share the same size, so inventories matter more than any single key. Embedded devices, older smart cards, long-lived code-signing roots and archived certificates that still use 1024-bit RSA are the obvious candidates for an audit.
Teams planning post-quantum migration. The Shea et al. paper concludes that its signing-oracle results give classical cryptanalytic support for moving away from RSA during the post-quantum transition, and DeepMind framed its own work as evidence that the hardness of cryptographic problems should be reassessed continuously. For security teams, the practical effect is a stronger case for retiring 1024-bit keys now and for scheduling RSA-2048 replacements on the post-quantum timeline rather than treating them as permanent.
The research also continues a run of AI-assisted cryptanalysis results this year, after Claude was used in the factoring of a new public RSA record, covered in our report on how Claude helped factor RSA-896. Frontier labs have also been building AI systems for offensive security research, including the restricted model described in our coverage of OpenAI's GPT-6 Cyber for Daybreak Red.
··········
HOW THE DEEPMIND AI AGENTS WERE USED IN THE CRYPTANALYSIS.
The batch-factoring paper is specific about the role of AI. Its results were obtained with a two-agent harness in which one model generated the proofs and a second model verified them. The algebraic identities and exact feasibility witnesses behind the main theorems are machine-checked in the Lean 4 proof assistant, while the calculus arguments that complete the optimization were checked numerically rather than formally. The paper's author list combines DeepMind researchers, including Pushmeet Kohli, Dvijotham and Thakurta, with Heninger and Thomé.
That division of labor fits DeepMind's description of the project as human-guided. Experts chose the problems and judged which results were significant, and the agents produced and checked candidate algorithms and proofs at a pace the company describes in weeks. The formal verification in Lean gives outside cryptographers a way to check the algebra independently, which carries particular weight for claims produced with machine assistance.
··········
GOOGLE DEEPMIND RSA-1024 RESEARCH: CONFIRMED FACTS AND OPEN QUESTIONS.
The batch-factoring result is documented. A dated working paper on DeepMind's own site sets out the fan factory construction, its cost exponents, its assumptions and its 1024-bit estimate of about 1/58 of a GNFS run per additional key, roughly 30 times below MNFS, with three or more keys already cheaper than MNFS once the precomputation is counted. The same paper states that 2048-bit and larger RSA is not threatened and that no implementation exists.
The signature result is documented less fully. The 3.5-fold CPU reduction on an already-solved 1024-bit benchmark and the estimated 1,600-fold improvement for a 32-byte controlled region come from DeepMind's announcement, and the padding schemes affected, the exact threat model and the full method were not described in a public paper when this report was prepared. Independent reproduction of either result has not yet been reported.
What can be concluded now is narrow and concrete: 1024-bit RSA signatures are weaker than previously quantified when an attacker controls part of the signed block, breaking 1024-bit keys in bulk is cheaper than previously estimated, and organizations that still depend on 1024-bit RSA have one more documented reason to retire it.
··········
FOLLOW US FOR MORE.
·····
DATA STUDIOS
·····
datastudios.org
