Google DeepMind's AI Agents Reportedly Cut an RSA-1024 Forgery Attack From 1,380 CPU Core-Years to 391

Google DeepMind and cryptographers at UC San Diego and Inria cut the cost of forging obsolete 1024-bit RSA signatures 3.5-fold, according to a published report, though only where a device does not hash messages itself.

RSA keys of 1024 bits are the legacy size. A team deciding when to retire those keys, or the hardware security modules (HSMs) that sign with them, now has a cheaper attack to plan against. Keys of 2048 bits or more, which modern protocols almost universally use, are outside the finding, DeepMind said.

What did the agents do?

Two AI agents designed, ran and debugged the forgery computation in under four days, with about 20 messages from the human researcher, mostly approvals. The agents re-ran an earlier academic attack on the same 1024-bit key in a sandboxed test. The first forgery took 391 core-years of processor time, against 1,380 in the original study, the report said.

Forging a signature is not the same as breaking the key. The key was not factored, which would take an estimated 500,000 to 1 million core-years, so the attacker still does not hold the private key.

When does the forgery work?

It depends on how much of the signed block the attacker controls. Signature standards add padding, preset data that brings a message to a fixed block size, and padding was known to make forgery harder. “Once they control roughly half of the block or more, padding adds no protection at all,” said Pushmeet Kohli, a DeepMind vice president who is also Google Cloud’s chief scientist. The accompanying paper applies this to a signature format used through the signing interface of devices such as HSMs.

Three conditions narrow the attack. It needs about 4 billion signing queries made in advance, it does not recover the private key, and it does not work against devices that hash messages internally.

What if the attacker controls less?

Forgery gets harder when the attacker controls less of the block, such as a 32-byte hash. For that case DeepMind’s theoretical estimate describes an algorithm about 1,600 times better than the previous best method against 1024-bit keys. That is a projection, not a run like the 391-core-year forgery.

A second finding is also theoretical. For an attacker going after many keys of the same size, DeepMind’s agents found a method that makes each additional key about 30 times cheaper to factor on average than the best earlier approach. The figure assumes one large upfront computation as costly as factoring a single key, and the method has not been implemented. Kohli said the work shows cryptographic hardness cannot be treated as a fixed assumption.

Which signing devices in the company’s own estate still hold 1024-bit keys, and what date retires them?