On 6 November 2026, Google DeepMind said that AI agents, working under human supervision, found two weaknesses in legacy 1024-bit RSA. One cuts the cost of forging signatures by roughly 1,600x, according to Pushmeet Kohli's announcement. The other cuts the average cost of factoring each extra 1024-bit key in a large batch by about 30x (DeepMind). The verdict in the 1024-bit versus 2048-bit comparison is clear: 2048-bit and larger keys remain safe today, and any 1024-bit RSA key you still run should be retired this quarter.
TL;DR
- DeepMind reports two improvements against 1024-bit RSA: a signature forgery method about 1,600x better than the previous best, and a batch factoring method about 30x cheaper per additional key (DeepMind announcement).
- The 1,600x figure comes from DeepMind's own theoretical estimates, not from an attack on live keys. No production key was broken and no keys were factored.
- 2048-bit and larger RSA, which modern protocols almost universally use, is not affected.
- Old 1024-bit keys still sit in SSH hosts, certificates, firmware signing setups and PGP keyrings.
- Action: inventory your keys, then replace 1024-bit RSA with 2048-bit or larger RSA, ECDSA or Ed25519.
What did DeepMind AI agents find in 1024-bit RSA?
The work was led by DJ Dvijotham and Abhradeep Thakurta at DeepMind with cryptographers Nadia Heninger (UC San Diego and Inria) and Emmanuel Thome (Inria), building on a September 2026 IACR eprint on forging 1024-bit RSA signatures. Two working papers include "Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS" (IACR-report coverage; Interesting Engineering).
There are two separate results:
- Signature forgery. If an attacker controls about half of the signed block or more, which is around a 64-byte digest at 1024 bits, PKCS#1 v1.5 padding adds little real protection. The new algorithm improves on the previous best method by roughly 1,600x for 1024-bit keys, per DeepMind's estimates.
- Batch factoring. The agents found an algorithm with better asymptotic complexity than earlier batch methods. It cuts the average cost of factoring each additional 1024-bit key by about 30x. After a precomputation costing one standard factoring run, each further key would cost about 1/58 of a run at leading order (source).
How was the result tested in practice?
The team did not attack live keys. Instead, two cooperating agents reproduced a known 1024-bit forgery from an earlier academic study. They used about 3.5x less CPU time: 391 CPU core-years instead of 1,380 (test details). The run took 3.2 days on up to 300,000 CPU cores and 16 GPUs. A human researcher sent about twenty short messages and wrote no code (source).
Those numbers show that the attack remains expensive. Hundreds of thousands of cores for several days is far beyond a casual attacker. The point is the direction of travel and the speed: according to the announcement, the team reached both results in weeks.
Is 1024-bit RSA vs 2048-bit RSA still a fair fight?
No. Kohli's statement says the results only affect obsolete 1024-bit RSA, and that modern encryption protocols, which almost universally use 2048-bit or larger keys, remain secure (source). NIST no longer approves 1024-bit RSA for creating signatures, yet old keys linger (source).
| 1024-bit RSA | 2048-bit RSA or larger | |
|---|---|---|
| Status | Obsolete, weakened by this work | Not affected by these results |
| Signature creation (NIST) | No longer approved | Acceptable |
| Risk from batch factoring | Higher, as precomputation is shared across many keys | Not shown by this research |
| Recommended action | Retire this quarter | Keep, and plan for ECDSA or Ed25519 where possible |
The batch result matters for operators with many old keys: an attacker who pays the precomputation once spreads it across the whole fleet, so a large set of forgotten 1024-bit keys is a worse target than one.
Where are legacy 1024-bit RSA keys hiding?
Typical places include servers that were never re-keyed, appliance firmware, code-signing setups and old PGP keyrings. The same neglect behind unpatched devices applies here, as in our coverage of Synology ransomware hitting outdated DSM and the Ivanti Connect Secure zero-days. Old infrastructure rarely gets audited until something forces the issue.
To check an SSH key, print its size:
ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub
ssh-keygen -l -f ~/.ssh/id_rsa.pub
The first number in the output is the key size in bits. For a TLS certificate:
openssl x509 -in cert.pem -noout -text | grep "Public-Key"
Look for Public-Key: (1024 bit). For a remote server, pipe the output of openssl s_client -connect host:443 into openssl x509 -noout -text. For PGP, gpg --list-keys shows the algorithm and size of each key.
How do I migrate away from 1024-bit RSA?
- Build an inventory of SSH host keys, user keys, TLS certificates, code-signing keys and PGP keys, with an owner for each.
- Generate replacements: RSA at 2048 bits or more, ECDSA, or Ed25519.
- Re-issue certificates from your certificate authority using the new keys.
- Rotate SSH host keys and update
authorized_keysandknown_hostsfiles. - For firmware or code signing, check whether devices in the field still verify with an old key before revoking it.
- Keep the inventory current. The authors expect AI to keep speeding up this kind of research, so assume key sizes will be reassessed again.
There is a tradeoff. Some embedded devices and old appliances cannot accept Ed25519 or larger RSA keys, so replacement may mean a firmware update or hardware refresh. Plan for that rather than discovering it during an incident.
Why does it matter that AI agents did this?
Kohli framed the results as an illustration of how quickly AI agent systems can evaluate the mathematical hardness of the problems that underpin digital security, and presented the work as a contribution to the cryptanalysis community (source). Risk assessments that once took years of specialist effort may now take weeks, so deprecation schedules should be treated as deadlines, not suggestions.
This fits a wider pattern of agent systems doing real security work, from computer-use agents to vendors paying more for serious findings, as in OpenAI's quadrupled critical bug bounty payouts. Defenders and attackers both gain from the same tools.
FAQ
Q: Is 1024-bit RSA broken?
A: No live key was broken and no keys were factored. Two attack-cost improvements were shown, 2048-bit keys are unaffected, and 1024-bit RSA remains obsolete.
Q: Do I need to replace my SSH keys?
A: Only if any are 1024-bit RSA. Check with ssh-keygen -l -f <keyfile>, and replace anything reporting 1024 bits with Ed25519 or RSA of 2048 bits or more.
Q: What did the AI agents actually do?
A: Guided by human researchers, they rediscovered and improved attack algorithms. They then reproduced a known 1024-bit forgery using about 3.5x less CPU time than the earlier study (DeepMind).
Q: Does this affect HTTPS and modern TLS?
A: Not directly. Modern protocols almost universally use 2048-bit or larger keys, which these results do not touch. Only old certificates with 1024-bit keys are exposed.
Q: Why does batch factoring make migration more urgent?
A: Because an attacker can pay the precomputation cost once and reuse it across many keys. Each additional 1024-bit key becomes cheaper to factor, so leaving many old keys in place raises the risk.
Q: How soon should I act?
A: Retire any 1024-bit RSA key this quarter. Start with an inventory, since you cannot replace keys you have not found.
Top comments (0)