Organizations still using 1024-bit RSA face lower computational barriers to some attacks, Google DeepMind says in research covered by SecurityWeek on November 9. Human-supervised AI agents helped develop improvements to signature forgery and key factoring, although the findings have substantial prerequisites and include algorithms assessed only theoretically.
The work involved cryptographers from UC San Diego and Inria. Its scope is obsolete RSA-1024 systems, said Pushmeet Kohli, vice president at Google DeepMind and chief scientist at Google Cloud. He said modern encryption protocols, which almost universally use keys of at least 2048 bits, remain secure.
Two routes to reducing computation
One result addresses the cost of factoring multiple RSA keys of equal size—finding the mathematical factors underlying those keys. The proposed algorithm spreads an expensive initial computation across subsequent targets. DeepMind estimates that each additional 1024-bit key would then cost roughly 30 times less to factor, on average, than under the previous best approach.
That estimate assumes upfront work equivalent to factoring one key. The algorithm has yet to be implemented.
The other result concerns forging digital signatures. It examines padding: preset data used to fill a message out to a fixed block size. Researchers already knew padding could impede forgery; the unresolved question was how much it helped when attackers could choose material to be signed.
DeepMind’s answer hinges on the portion of the block under attacker control. Kohli said padding provides no protection when that portion reaches approximately half the block or more. SecurityWeek reported that the accompanying paper applies the finding to PKCS#1 v1.5, a format used through the PKCS#11 signing interface on cryptographic devices, including hardware security modules (HSMs).
A demonstrated forgery, with demanding prerequisites
To test the forgery approach in an isolated environment, the agents revisited an earlier academic attack using the same 1024-bit key. Producing the first forgery consumed 391 CPU core-years, compared with 1,380 in the earlier study, a 3.5-fold reduction. A core-year represents one processor core’s work over a year; it is not the elapsed duration of the experiment.
Two agents planned, executed and debugged the computation in less than four days. A human researcher sent approximately 20 messages, chiefly approvals. The experiment did not factor the key, a task estimated to require 500,000 to 1 million core-years.
With control over a smaller portion of the block—for example, a 32-byte hash, a fixed-length representation of a message—forgery becomes harder. DeepMind nevertheless estimates that another algorithm offers a roughly 1,600-fold theoretical improvement over the previous best method for 1024-bit keys.
Kohli framed the research as a reason to use AI to challenge assumptions about the difficulty of cryptographic attacks. For operators assessing the signature finding, the researchers’ prerequisites determine its relevance: the attack requires roughly 4 billion signing queries in advance and does not recover the private key. Devices that hash messages internally are outside this signature attack’s scope.
