RSA-1024 has been on its way out for years, and two new working papers from Google DeepMind add fresh reasons to retire the remaining keys. A team including cryptographers Nadia Heninger (UC San Diego, Inria) and Emmanuel Thomé (Inria) alongside DeepMind researchers used AI agents to describe two weaknesses around 1024-bit RSA: one in how the PKCS#1 v1.5 padding format protects signatures, and one in the cost of factoring many 1024-bit keys at once. Both papers state up front that deployed systems using RSA keys of 2048 bits or more are not threatened.
The most striking part is less any single result than the way the work was done. According to DeepMind, a demanding computation at 1024 bits was designed, run and debugged by two cooperating AI agents in under four days, with about 20 short messages from a human researcher.
RSA-1024 and the signing oracle: what this is about
The first paper, “Modular Roots from a Restricted Oracle: Faster Affine Roots and a 1024-bit Computation”, studies what cryptographers call an oracle model. An attacker may call a signing device, such as a hardware security module (HSM), with inputs of their choice for a while and collect the outputs. Access is then withdrawn, and the attacker must compute signatures for arbitrary new values without knowing the private key. The attack explicitly does not recover the key itself.
In practice, signing interfaces do not apply the key to arbitrary data. They embed the input in a fixed format such as PKCS#1 v1.5, which has been seen as an extra hurdle. The researchers now show that once the caller controls more than roughly half of the 128-byte block, meaning 65 bytes or more at 1024 bits, the format adds no further protection. The problem is then no harder than for an interface with no format at all. In their measurements this already held at exactly half, for example when the caller supplies a 64-byte digest such as SHA-512. With 32-byte digests such as SHA-256 the problem remains harder; for that case the paper describes an asymptotically faster algorithm, which the authors did not run at this size.
3.5 times less CPU time than the original
The practical part is a rerun of a previously published experiment. Shea, Haller, Suhl, Heninger and Thomé had shown that, for a 1024-bit key and an interface without any format, signatures can be computed after an offline phase. Their computation took about 1,380 CPU core-years in total. Using the same algorithm, polynomials and parameters, DeepMind’s agents needed 391 CPU core-years for the first root, 318 offline and 73 online. That is a factor of 3.5.
According to the paper, the savings come mainly from better code rather than faster hardware: on the same machine, the optimized siever ran 1.8 to 4.4 times faster than the widely used open-source CADO-NFS. For scale, the paper also gives the comparison point: actually factoring the 1024-bit modulus is estimated to cost 500,000 to 1,000,000 core-years. Computing signatures this way is therefore much cheaper, but it is not key recovery.
How the AI agents worked
The paper describes its setup in unusual detail. Two language-model agents split the work:
- Model A (supervisor) wrote the design, set budgets and checks for every stage, audited all results and made the go/no-go decisions.
- Model B (executor) wrote and tested the code, launched and monitored the distributed jobs and fixed failures.
- The human researcher set the goal and approved the gates, mostly with replies such as “follow your recommendation” or “continue”.
The agents wrote about 33,500 lines of new code for the 1024-bit run, launched 336 distributed experiments on up to 300,000 CPU cores and 16 GPUs, and made 16,292 tool calls in total. The computation took 3.2 days from the first full-scale job, compared with about five months for the original, a difference the authors attribute mainly to parallelism. Along the way the agents had to solve real problems, including a 32-bit index overflow that made the first computed root wrong. The published version of the paper does not say which models served as Model A and Model B.
Fan factories: cheaper factoring in bulk
The second paper, “Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS”, dated November 5, 2026, is purely theoretical. It considers an attacker who wants to break not one but many RSA keys of the same size. Don Coppersmith proposed ideas for this in 1993, including a “factorization factory” that precomputes part of the work once and reuses it for every key.
The new “fan factory” gives every target key its own family of number fields, all fed by the same precomputation. The result: if the precomputation costs about as much as one factorization, each further 1024-bit key could be factored, at leading order, for about 1/58 of the cost of the number field sieve, roughly 30 times cheaper than with Coppersmith’s previous best method for that budget. The algebraic identities were machine-checked in the Lean 4 proof assistant; one model generated the proofs and a second verified them.
The authors spell out the limits themselves: this is an asymptotic estimate with lower-order terms set to zero, and no fan factory has been implemented yet.
Who should act now
For the vast majority of websites, messengers and banking apps there is nothing to do, provided they use RSA with at least 2048 bits or elliptic curves. The results matter for environments where 1024-bit RSA is still in use, such as old HSM configurations, embedded devices, smart cards or legacy signing services. Three points follow from the paper:
- Retire 1024-bit keys. According to the paper, current guidance no longer approves 1024-bit RSA for generating signatures anyway.
- Avoid raw signing interfaces. The attack requires a caller who can directly and very often have chosen data signed, about four billion times in the reproduced computation. Mechanisms that compute the hash inside the device (such as
CKM_SHA256_RSA_PKCSin PKCS#11) fall outside both attack models, the paper says. - Restrict and monitor HSM access. Unusually high signing volumes are a warning sign.
Context
The papers are working papers and have not yet been peer reviewed. They do not break any current encryption scheme, and headlines about “AI cracking RSA” are misleading. The more interesting aspect is the one DeepMind itself emphasizes: how quickly AI-assisted research can move a field that usually advances slowly. A computation that had taken an experienced team five months was reproduced and improved with very little human input. That ties into debates we have covered before, such as whether AI math could break ECDSA before quantum computers do, and Ethereum’s plans for quantum-safe backup keys in EIP-8450. For operators, the lesson is the same sober one as with the OpenSSH 10.6p2 emergency release: old configurations that “still somehow work” are the real risk.
