DeepMind AI agents find two RSA-1024 weaknesses — 3.5x cheaper signature forgery, 2048-bit keys safe
Google DeepMind announced on November 6, 2026 that AI agents working under human direction found two weaknesses in legacy 1024-bit RSA. The first speeds up forging RSA signatures when an attacker controls part of the signed data: reproducing a recent academic attack on a 1024-bit key in a sandbox took about 3.5 times less CPU time, and DeepMind estimates a theoretical gain of about 1,600 times for a 32-byte controlled digest. The second, called 'fan factories', cuts the per-key cost of factoring many 1024-bit keys to about 1/58 of a standard factorization after one large precomputation, roughly 30 times cheaper than the best prior batch method. Keys of 2048 bits or more are not affected.
The three lines
- Findings — 3.5x less CPU for partial-control forgery; batch factoring about 30x cheaper per key
- Method — one AI agent writes proofs, another checks them, human cryptographers steer
- Scope — 2048-bit+ unaffected; old smart cards, HSMs and embedded devices need checking
Key questions
- deepmind rsa 1024 weaknesses
- **Signature forgery and batch factoring. Both concern 1024-bit keys; 2048-bit and above are not affected.** | Finding | What it does | Numbers | |---|---|---| | Signature forgery | Faster forging when the attacker controls part of the signed block | About 3.5x less CPU in a sandbox reproduction; theoretical ~1,600x for a 32-byte digest | | Fan factories | Factor many keys at once | Per key about 1/58 of a GNFS run after precomputation; about 30x cheaper than MNFS |
- is rsa 2048 still safe
- **Against these results, yes. DeepMind and both papers say 2048-bit and larger RSA is not threatened. Quantum-transition deadlines are a separate issue.** | Key size | Affected here | NIST status | |---|---|---| | 1024-bit | Yes | Barred for new signatures since end of 2013 | | 2048-bit | No | Deprecated after 2030, disallowed after 2035 (quantum transition) | | 3072-bit+ | No | Same schedule |
- where is rsa 1024 still used
- **It is gone from the web PKI but may linger in older equipment.** | Possible location | Why it matters | |---|---| | Old smart cards and embedded devices | Keys are hard to replace | | Long-lived code-signing roots | Forged signatures make malware look legitimate | | HSMs and signing APIs | The exact 'signing oracle' the forgery attack targets | | Archived certificates | Trust in past signatures |
AI pushed a decades-old line of cryptographic attack forward in a matter of weeks. Fortunately, the target is a key length that has already been retired. Google DeepMind said on November 6, 2026 that AI agents directed by researchers found two weaknesses in legacy 1024-bit RSA. Pushmeet Kohli, DeepMind's VP of science, said the team worked with leading cryptanalysts and "reached the results in a matter of weeks."
RSA rests on the fact that multiplying two large primes is easy but factoring the product back is extremely hard. It still underpins certificates, software signing and smart cards.
1. What they found — one forgery, one batch attack
| Signature forgery | Fan factories (batch factoring) | |
|---|---|---|
| Setting | Attacker controls part of the signed data and can query a signing interface | Many 1024-bit keys attacked together |
| Core result | Padding gives little protection once the attacker controls roughly half the block | After one big precomputation, each extra key costs about 1/58 of a standard factorization |
| Measured or estimated | About 3.5x less CPU time reproducing a known attack; under 1/1000 of the work to factor the key | About 30x cheaper than the best prior batch method (MNFS), theoretical |
| Best case | ~1,600x better for a 32-byte controlled digest (theoretical) | About 19x advantage at 100 keys |
| Implementation | Reproduced in a sandbox | None |
The baseline for the forgery work is a September paper by Shea, Haller, Suhl, Heninger and Thomé (UC San Diego and Inria), which forged signatures from a hardware security module by repeatedly calling its 1024-bit signing API — 1,380 CPU core-years over five months and 2^32 signing queries. DeepMind's agents reproduced that attack in a sandbox with about 3.5 times less CPU time, roughly 390 core-years by simple division.
Fan factories extends Don Coppersmith's 1993 "factorization factory." For a single key it is worse than standard methods, but at three keys it is 1.5 times better, at ten 4.4 times and at a hundred about 19 times.
2. How — an agent that proves, an agent that checks, humans who steer
| Role | Who or what |
|---|---|
| Problem framing and direction | DeepMind researchers plus outside cryptographers |
| Proof generation | AI agent 1 |
| Proof checking | AI agent 2 |
| Algebraic identities | Machine-checked in the Lean 4 proof assistant |
| Calculus steps | Checked numerically, not formally |
The DeepMind work was led by Krishnamurthy (Dj) Dvijotham and Abhradeep Thakurta, with Nadia Heninger (UC San Diego) and Emmanuel Thomé (Inria), authors of the September forgery paper. The significance is that AI moved beyond finding bugs in code to improving cryptanalytic algorithms themselves.
3. What remains — 2048 is fine; check the old corners
DeepMind and both papers say 2048-bit and larger RSA is not threatened by these results. 1024-bit RSA offers roughly 80 bits of security, and NIST has barred keys under 2048 bits for new signatures since the end of 2013.
| Where to look | Why |
|---|---|
| Legacy hardware and embedded devices | Keys baked into firmware |
| Older smart cards | Keep their original key length |
| Long-lived code-signing roots | A forgery makes malware look legitimate |
| HSMs or signing services exposing 1024-bit signing | The forgery attack's exact target |
| Blind RSA schemes | Expose a raw signing interface (flagged in the September paper) |
That does not make 2048-bit RSA permanent. On October 27, NIST finalized a schedule to deprecate RSA of any size after 2030 and disallow it after 2035 because of the quantum threat — see our explainer on post-quantum cryptography. DeepMind's full papers had reportedly not appeared in public archives on announcement day; independent replication will follow once they do.
Sources
- Crypto Briefing — Google DeepMind's AI agents expose two weaknesses in legacy 1024-bit RSA (2026-11-06)
- DataStudios — Google DeepMind AI agents find two weaknesses in legacy 1024-bit RSA (2026-11)
- IACR ePrint 2026/2131 — Forging 1024-bit RSA signatures in nearly SNFS time
- FourWeekMBA — DeepMind AI Agents Find 2 Weaknesses in Legacy 1024-Bit RSA (2026-11)
- RuntimeWire — Google DeepMind says AI agents found two weaknesses in legacy 1024-bit RSA (2026-11)