Did AI Break RSA? What DeepMind Actually Found

Last verified: 8 November 2026. Both papers are unreviewed working papers, and no outside group has reproduced the results yet.

No, AI did not break modern RSA encryption. Google DeepMind reported two new weaknesses in legacy RSA-1024, found by AI agents working under human supervision, and its researchers say the results don’t threaten 2048-bit and larger RSA.

That’s less dramatic than the headlines quoting “1,600 times faster”. It’s still a real result, arriving days after OpenAI reported AI-assisted vulnerability discovery at scale in the Linux kernel. AI agents helped produce new mathematics against a cryptosystem that has been studied for decades, and 1024-bit keys are still in use in places many organisations have stopped looking.

Key Takeaways

• AI didn’t break modern RSA. DeepMind’s findings concern legacy RSA-1024, and its researchers say 2048-bit and larger RSA isn’t threatened by them.
• Two different problems were solved. One forges signatures without the key; the other cuts the cost of factoring many keys in a batch.
• The 1,600× figure is theoretical. It applies to forging when an attacker controls a 32-byte part of the signed block.
• The 3.5× figure was measured, by reproducing an earlier attack on an already-broken benchmark key, not a fresh one.
• The 30× figure is an asymptotic estimate for the average cost of additional keys in a batch, and no implementation exists.
• Humans stayed in charge. Agents generated and verified proofs and wrote code under human supervision, alongside experienced cryptographers.
• Inventory legacy keys now. Firmware signing, old certificates, SSH, VPNs and HSMs are the places to check first.

---

Quick Navigation

---

What DeepMind’s RSA-1024 research actually found

DeepMind announced the work on 6 November 2026, with Pushmeet Kohli presenting it as an advance in cryptanalysis, the science of breaking codes. It’s described in two working papers published on 5 and 6 November: “Modular Roots from a Restricted Oracle” and “Fan Factories”. Dj Dvijotham and Abhradeep Thakurta led the research. Their co-authors include the cryptographers Nadia Heninger of UC San Diego and Inria, and Emmanuel Thomé of Inria.

The two papers solve different problems. The first shows how to forge certain RSA signatures without ever recovering the private key. The second makes factoring cheaper when an attacker wants to break many RSA-1024 keys rather than one. Neither has been through peer review.

The AI agents did real work, but they didn’t work alone. The Fan Factories paper says its results came from “a two-agent AI harness: one model generated the proofs, and a second model verified them.” Its algebraic identities were checked in Lean 4, a formal proof language, while calculus steps were checked numerically. Coverage of the announcement describes the agents as working under human supervision, alongside the cryptographers on the team.

The first RSA-1024 weakness: forging signatures without the key

An RSA signature proves that a message was approved by whoever holds a private key. The signer hashes the message, wraps the hash in a fixed padding format and applies the private key. Anyone can check the result with the public key. The common padding format, PKCS#1 v1.5, is defined in RFC 8017: fixed bytes, then an identifier for the hash algorithm, then the hash itself.

Padding exists partly to stop attackers from exploiting RSA’s mathematical structure. The weakness DeepMind studied applies when an attacker can get a device to sign data they partly control. Think of a hardware security module (HSM) or signing service that will sign blocks where some bytes are chosen by whoever sends the request. The paper’s title refers to this as a “restricted oracle”: a signer the attacker can query, but only through a constrained format.

The line of research goes back to a 2007 paper by Joux, Naccache and Thomé, which showed that computing RSA roots with a signing oracle can be easier than factoring. In September, Laura Shea, Miro Haller, Adam Suhl, Heninger and Thomé turned that into a practical attack on 1024-bit RSA, using an HSM as the oracle. It took about 1,380 CPU core-years of precomputation and around 4 billion signing queries.

DeepMind’s work extends that line in two ways, according to reporting on the announcement.

1. When the attacker controls about half the block or more, PKCS#1 v1.5 padding adds almost no protection: forging is no harder than against unpadded RSA. A 1024-bit RSA block is 128 bytes, so a 64-byte field, the size of a SHA-512 hash, is half of it.
2. When the attacker controls much less, such as a 32-byte field the size of a SHA-256 hash, the agents produced a new algorithm. DeepMind estimates it is about 1,600 times better than the previous best method for 1024-bit keys.

That 1,600× is a theoretical estimate based on how the algorithm’s cost scales. It wasn’t demonstrated by running a full attack at that scale.

What was measured is narrower. The agents’ implementation reproduced the earlier September computation against the same, already-broken 1024-bit benchmark key. It reportedly found its first root in 391 CPU core-years, about 3.5 times less than the original, running for 3.2 days on up to 300,000 CPU cores and 16 GPUs. That’s an engineering improvement on a known result in a controlled research setting. It isn’t the cracking of a fresh key belonging to a real organisation.

Forgery and factoring are different outcomes. A forger can produce valid signatures on chosen messages but never learns the private key, and needs repeated access to the signer to do it. Factoring recovers the key itself, after which the attacker can sign and decrypt anything.

The second RSA-1024 weakness: factoring many keys at once

An RSA public key contains a modulus, a large number made by multiplying two secret primes. Anyone who can factor the modulus back into its primes can rebuild the private key. RSA’s security rests on factoring being impractically expensive at the key sizes in use.

The best general method is the number field sieve (NFS). Batch factoring asks a different question: if you want to factor many numbers of the same size, can you share work between them? Earlier techniques, including Coppersmith’s factorisation factory, Bernstein and Lange’s Batch NFS, and the multiple number field sieve (MNFS), showed that expensive precomputation can make each additional factorisation cheaper.

Fan Factories gives each target number its own family, or “fan”, of number fields, all fed by a shared part of the computation. The paper works out the cheapest cost per additional number for every possible precomputation budget.

The headline result: with a precomputation budget equal to one factorisation, each further 1024-bit number costs about 1/58 of a standard NFS run, which the paper says is roughly 30 times less than MNFS. The paper is careful about what that means. The figures are leading-order estimates with smaller terms set to zero, and it states that “no fan factory has been implemented”. It also notes that memory requirements and how it compares with a well-tuned NFS in practice are open questions.

So the 30× figure is about the average cost of additional keys in a batch, under asymptotic assumptions. It doesn’t mean any single RSA-1024 key can be factored 30 times faster, and it hasn’t been demonstrated against real keys. It matters for security teams because it changes the economics for an attacker targeting a large population of legacy keys. One expensive setup could then make each extra key far cheaper to break.

What the 1,600× and 30× RSA-1024 numbers really mean

The two figures describe different problems, different kinds of evidence and different attackers. Neither should be read as a general speed-up for breaking RSA.

Table: scroll sideways to view all columns when needed.

Figure	What it applies to	Kind of evidence	What it doesn’t mean
About 1,600×	Forging 1024-bit signatures when an attacker controls a small, 32-byte part of the signed block	Theoretical estimate	That RSA signatures can generally be forged 1,600 times faster
About 3.5×	Reproducing September’s attack on an already-broken 1024-bit benchmark key	Measured, in a research setting	That a fresh, deployed key was cracked
About 30×	Average cost of each additional 1024-bit key in a batch, against MNFS	Asymptotic estimate, no implementation	That one RSA-1024 key can be factored 30 times faster

Adding the two together, or describing them as “1,600 times faster at breaking RSA”, gets both wrong. The signature figure needs an attacker with ongoing access to a signer. The factoring figure needs a large precomputation and a batch of targets.

RSA-1024 vs RSA-2048: why bigger keys are a different story

The number in “RSA-1024” is the size of the modulus in bits. Each added bit makes factoring harder, but not in a straight line: the cost of the number field sieve grows sub-exponentially with key size. NIST’s key-management guidance, SP 800-57, puts RSA-2048 at about 112 bits of security, the current minimum for most uses. NIST’s transition guidance already disallows generating new RSA signatures with keys shorter than 2048 bits, and allows verifying 1024-bit signatures only for legacy use.

The Fan Factories authors state: “Our results do not threaten deployed cryptosystems today that are based on 2048-bit and larger RSA.” That’s a statement about these particular findings. It isn’t a statement that RSA-2048 is safe from everything, and several other risks deserve attention:

• Implementation flaws, such as weak padding checks, can break RSA at any key size.
• Poor key generation and weak randomness have produced real keys that share primes and can be factored instantly.
• Side-channel attacks extract keys from timing, power use or faults rather than from the maths.
• Protocol and configuration mistakes, such as a signer that accepts attacker-controlled raw input, create exactly the oracle these attacks need.
• Quantum computing threatens all RSA key sizes in the long run. NIST’s 2024 draft transition plan, IR 8547, proposed deprecating 112-bit RSA after 2030 and disallowing RSA after 2035. A final version was published in October 2026, so check it for current dates.

The September HSM paper adds a further warning. Its authors estimate that RSA with a signing oracle is 15 to 30 bits weaker than factoring-based estimates suggest, across 1024- to 4096-bit keys. That doesn’t break RSA-2048. It does mean that systems letting outsiders request raw RSA signatures deserve scrutiny at any key size.

Where RSA-1024 may still be hiding

RSA-1024 has been disallowed for new signatures under NIST guidance since the 2010s, yet it lingers in systems built when it was standard and rarely touched since. Not every old system uses it, so each one needs checking. Places worth looking include:

• Firmware and code signing. Devices that verify updates with a key burned into hardware can’t easily change it.
• Embedded and IoT devices, industrial controllers and network gear with long service lives.
• Old internal certificates and private certificate authorities that never went through public-CA key-size rules.
• SSH host and user keys generated years ago and carried between servers.
• Older VPN appliances and their management certificates.
• Hardware security modules, especially older models or partitions configured for raw RSA signing, which is the oracle these attacks exploit.
• DNS and email signing. In a Sectigo podcast discussion of the September HSM research, the hosts cited figures suggesting 1024-bit RSA is still common in DNSSEC zone-signing keys and in DKIM email-signing keys. Those are their estimates, not a formal survey.
• Archived applications and long-lived machine identities, such as service accounts and API clients, whose keys were never rotated.

To find them, start with certificate inventories and scanning tools, which report key length for every certificate they see. Server and device configurations, HSM key listings and code-signing setups need checking directly. Standard tools show key size: OpenSSL prints it for certificates and keys, and ssh-keygen -l shows it for SSH keys. Only test systems you own or are authorised to assess.

An RSA-1024 checklist for security teams

None of this needs panic. It needs an inventory and a plan. Follow your organisation’s cryptographic policy, applicable standards and vendor guidance throughout.

1. Inventory RSA key lengths across certificates, keys and cryptographic services.
2. Flag every 1024-bit RSA key and certificate, including expired ones still trusted somewhere.
3. Check firmware-signing and code-signing configurations, including keys embedded in shipped devices.
4. Review SSH and VPN configurations, host keys, user keys and appliance certificates.
5. Inspect HSM settings, especially any raw RSA signing modes and the applications that can reach them.
6. Identify dependent devices and applications that will break when a key changes.
7. Plan migration to approved configurations, such as RSA-2048 or larger, or elliptic-curve keys where supported, with post-quantum algorithms in mind.
8. Test replacement keys before retiring old ones.
9. Review certificate chains and trust stores, so legacy roots and intermediates are removed too.
10. Make cryptographic inventory a recurring review, not a one-off project.

For organisations already on RSA-2048 or larger, these findings alone aren’t a reason to replace every key. They are a reason to confirm that’s actually what you have.

AI is entering mathematical security research

The DeepMind papers arrive alongside other AI-assisted security results, but they aren’t the same kind of achievement.

OpenAI’s agents found 948 distinct Linux kernel privilege-escalation flaws in one run. That’s vulnerability discovery and exploit development: finding mistakes in code. VicOne reported 28 AI-assisted zero-day findings in robotics tooling, which we covered in our look at robotics security risks. Google says its Gemini 4 Carbon model scores strongly on finding, proving and fixing vulnerabilities. All three are about software that was written wrong.

Cryptanalysis is different. RSA-1024 wasn’t badly coded; the DeepMind work changes what’s mathematically possible against it, though the forgery attack still needs a signer that accepts attacker-shaped input. That’s closer to research mathematics than to bug-hunting, and it rests on proofs and complexity analysis rather than crash reports.

What connects them is speed. AI agents are compressing work that used to take specialists months, whether that’s auditing code or exploring number-field constructions. In each case, though, humans set the direction, checked the results and decided what to publish. The Fan Factories paper’s own framing is that its significance lies in how quickly AI-assisted research can advance a slow-moving field.

That’s the reason to pay attention. Cryptographic assumptions that held for years can now be tested faster. RSA-1024 was already obsolete; this research makes keeping it around harder to justify.

FAQ

Did Google DeepMind break RSA encryption?

No. DeepMind reported two weaknesses in legacy 1024-bit RSA, and its researchers say the results don’t threaten 2048-bit and larger RSA.

What is RSA-1024?

RSA-1024 is RSA public-key cryptography using a 1024-bit modulus. NIST disallows it for generating new signatures and treats it as legacy.

What did DeepMind’s AI agents discover about RSA-1024?

A faster way to forge some RSA-1024 signatures when an attacker can query a signer, and a cheaper way to factor many RSA-1024 keys in a batch.

What is the 1,600× RSA improvement?

It’s a theoretical estimate of how much better the new forgery algorithm is than the previous best method, when an attacker controls a 32-byte part of the signed data. It wasn’t demonstrated at that scale.

Does the 30× factoring improvement mean RSA keys can be cracked 30 times faster?

No. It’s an estimated reduction in the average cost of each additional 1024-bit key in a large batch, after a big shared precomputation.

Is RSA-2048 affected by DeepMind’s findings?

The researchers say their results don’t threaten 2048-bit and larger RSA. Other risks, such as implementation flaws and quantum computing, still apply.

What is the difference between RSA signature forgery and key factoring?

Forgery produces valid signatures without learning the private key and needs access to a signer. Factoring recovers the private key itself.

Where are RSA-1024 keys still used?

Mostly in legacy systems: firmware and code signing, embedded devices, old internal certificates, SSH and VPN setups, older HSMs, and some DNS and email signing keys.

Should organisations replace their RSA-2048 keys?

Not because of this research alone. Follow your migration plan and NIST’s post-quantum transition guidance.

How did AI agents contribute to the cryptography research?

They explored mathematical approaches, generated and checked proofs, and wrote the implementation used in the reproduction, under human supervision.

---

Keep reading

Here are the latest posts from the blog.