DeepMind’s AI Attack on 1024-bit RSA Explained: What It Is, How It Works, Limits and Risks

Last updated: 8 November 2026

On 6 November 2026, Google DeepMind announced that AI agents, working under the guidance of human cryptographers, had found two new weaknesses in 1024-bit RSA, the older key size that still lingers in some legacy systems. One result makes a certain kind of RSA signature forgery cheaper. The other makes factoring many 1024-bit keys, one after another, cheaper per key. DeepMind’s own post summed it up as: “Guided by humans, our models uncovered two major weaknesses in legacy 1024-bit RSA cryptosystems.”

Headlines quickly turned this into “AI breaks RSA”. That is not what happened. No one has factored a real 1024-bit key with these methods, the biggest numbers are theoretical estimates, and RSA-2048, which protects most of today’s HTTPS, is not affected. But something important did happen: AI agents helped produce publishable cryptanalysis, with machine-checked proofs, in a matter of weeks.

In this post I separate what DeepMind actually published from what was reported, explain the maths in plain language, and explain why I think every Indian CS, GATE and cybersecurity student should understand this story.

Quick summary

• What happened: Google DeepMind announced on 6 November 2026 that human-guided AI agents found two weaknesses in legacy 1024-bit RSA.
• Result 1, signature forgery: Reported as a theoretical improvement of about 1,600 times over the previous best method in a setting where an attacker controls part of the signed data, plus a measured run that used about 3.5 times less CPU time than a September 2026 record.
• Result 2, “Fan Factories”: A working paper showing that, after a one-off precomputation, each further 1024-bit number can in theory be factored about 30 times more cheaply than with the best previous factory-style method.
• Who: A DeepMind team (reports name Dj Dvijotham and Abhradeep Thakurta as leads) with well-known cryptanalysts Nadia Heninger (UC San Diego) and Emmanuel Thomé (Inria).
• Role of AI: The Fan Factories paper says one AI agent generated proofs and a second verified them, with key steps machine-checked in the Lean 4 proof assistant. No model name is given.
• What it does not mean: RSA-2048 and larger keys are not threatened. No real key was factored using the new factoring method.

First, a 60-second refresher on RSA

RSA is a public-key system. You pick two large secret primes p and q and publish their product n = p × q along with a public exponent e. Anyone can verify a signature using (n, e), but only the person who knows p and q can compute the private exponent d and create signatures. The security rests on one assumption: multiplying primes is easy, but recovering p and q from n is extremely hard when n is large.

“1024-bit RSA” means n is 1024 bits long, roughly 309 decimal digits. That size was standard in the 2000s. Standards bodies such as NIST stopped approving it for new digital signatures after 2013, and modern systems use 2048-bit or larger keys, or elliptic-curve schemes such as ECDSA and Ed25519. Still, old keys survive in embedded devices, firmware signing, old internal certificate authorities, hardware security modules (HSMs) and forgotten SSH keys.

The best known classical algorithm for factoring numbers of this size is the Number Field Sieve (NFS). Its running time is “sub-exponential”, written in L-notation as roughly L_N[1/3, 1.923]. You do not need the formula for exams, but you should know that a small change in that constant (1.923) changes the real-world cost by a big factor.

The background: a September 2026 record set without AI

To understand DeepMind’s first result you need an earlier paper. In September 2026, researchers Laura Shea, Miro Haller, Adam Suhl and Nadia Heninger (UC San Diego) with Emmanuel Thomé (Inria) published “Forging 1024-bit RSA signatures in nearly SNFS time” on the IACR ePrint archive.

They implemented a 2007 attack by Joux, Naccache and Thomé. The idea: if an attacker gets temporary access to a raw RSA signing oracle (a device that will sign any number you give it, without padding), they can collect enough signatures to later forge signatures on new messages, without ever factoring n. Their numbers, from the paper and its companion repository:

• About 1,380 CPU core-years of computation over roughly five months.
• About 2³² (around 4 billion) queries to the signing oracle.
• Roughly 180 core-years for each further forgery after the precomputation.
• A real HSM was used as the black-box signing oracle. Its vendor was not named.

Their repository’s FAQ says plainly that no AI or GPUs were used, and that AI or GPUs could “almost certainly” speed it up. Johns Hopkins cryptographer Matthew Green described the work as an implementation of the 2007 Joux, Naccache and Thomé attack. Crucially, the attack only works when a raw oracle is exposed, which standard padded signatures such as PKCS#1 v1.5 and PSS do not do. The practical victims are things like blind RSA signatures (used in privacy tokens) and some HSM interfaces.

DeepMind result 1: cheaper signature forgery when padding is weak

DeepMind’s agents picked up exactly where that record left off. According to coverage by Interesting Engineering, OfficeChai and others, the team made three claims:

• Padding helps less than assumed. If an attacker controls a large share of the block being signed (reports say roughly half or more), the padding gives almost no extra protection against this style of forgery.
• A theoretical 1,600x gain. For the case where the attacker controls only a hash-sized 32-byte portion, a new algorithm is estimated to be about 1,600 times better than the previous best method for 1024-bit keys. This is an estimate, not a completed attack.
• A measured 3.5x gain. In a sandbox, an AI-built implementation reproduced the UCSD and Inria result using about 3.5 times less CPU time. One detailed write-up reports 391 core-years, finished in about 3.2 days on up to 300,000 CPU cores and 16 GPUs, against roughly five months originally.

Verification note: the signature paper is reported under the title “Modular Roots from a Restricted Oracle”, but as of today I could not find a public copy, and one outlet noted the full paper was not available when it reported. The 1,600x and 3.5x figures are consistent across several independent reports, but please treat them as reported, not yet independently checked.

DeepMind result 2: “Fan Factories” for factoring many keys

The second result is published as a DeepMind working paper, “Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS”, dated 5 November 2026. It lists twelve authors, including Dvijotham, Thakurta, Pushmeet Kohli, Heninger and Thomé.

Here is the idea in plain language. In 1993, Don Coppersmith proposed a “factorization factory”: do a huge one-off precomputation, store the results, and then factor each new number of the same size much faster. Since then, the best known cost per number, when the precomputation is limited to about one normal factorisation, has been about L[1.902] (a variant called MNFS, the multiple number field sieve).

The DeepMind paper gives each target number its own “fan” of number fields, all fed by the same shared precomputed side. With a precomputation budget of one factorisation, each further number then costs about L[1.793]. That drop in the constant is what produces the headline figure:

One nuance that many reports blurred: the 30x figure belongs to the factory setting, where you pay for a large precomputation first. In plain batch mode with no precomputation, the paper’s gain is much smaller.

How the AI agents were used

This is the part I find most interesting as an educator. The Fan Factories paper says its results came from a two-agent setup: one model generated the proofs and a second model verified them, and the analysis and Lean formalisation were developed with AI agents. Human experts chose the problems, guided the work and checked the outcome. The paper does not name the AI model used.

DeepMind’s VP of Science Pushmeet Kohli said on X that the team made the advances in just weeks, and argued that “we must not assume the mathematical ‘hardness’ of cryptographic schemes”. That is the real message: AI is starting to speed up the slow, expert search for better algorithms, and cryptographic security margins were never a law of nature.

Limits, caveats and independent views

• Mostly theory. The Fan Factories paper says its leading-order figures are “not predictions”, because hidden lower-order terms are not known. It notes that at 1024 bits a change of 0.1 in the exponent shifts the estimate by a factor of about 23.
• Nothing implemented for factoring. The paper states that no fan factory has been built, and that the real break-even size against a well-tuned NFS is an open question.
• Memory is a wall. Factory methods need to store enormous tables. The paper flags memory as a second major obstacle.
• Working papers, not peer-reviewed. Both DeepMind results are early releases. The signature paper was not publicly available when I checked.
• RSA-2048 is out of reach. The paper states directly that its results do not threaten deployed systems based on 2048-bit and larger RSA. At 2048 bits even the precomputation alone is astronomically larger.
• Disclosure. I found no public description of a coordinated disclosure process with vendors. Given that the targets are deprecated key sizes and specific signing setups, that is less alarming than it sounds, but it is worth watching.

Risks and what to check (including in India)

The practical risk is narrow but real: systems that still use 1024-bit RSA, especially those that sign attacker-influenced data or expose raw signing APIs. Examples include ageing IoT and industrial devices, old VPN appliances, firmware signing keys, legacy internal PKI, and very old SSH keys. Banks, PSUs, colleges and companies in India that run long-lived hardware should inventory key sizes now rather than later.

Two simple commands help you check:

# Key size of a certificate (look for "Public-Key: (1024 bit)")
openssl x509 -in cert.pem -noout -text | grep "Public-Key"

# Key size and type of an SSH public key (first number is bits)
ssh-keygen -l -f ~/.ssh/id_rsa.pub

If you find 1024-bit RSA, plan a migration: Ed25519 for SSH, ECDSA P-256 or RSA-3072/4096 for TLS and code signing, and start tracking post-quantum algorithms such as ML-KEM and ML-DSA for long-term systems.

General information, not legal advice: only test systems you own or are authorised to test. Probing someone else’s servers or devices without permission can fall under the Information Technology Act, 2000 (for example Sections 43 and 66). Organisations that suffer a security incident should also be aware of CERT-In’s incident reporting directions.

Why this matters for Indian students and educators

This story is a perfect bridge between textbook theory and front-page news:

• Discrete Mathematics: modular arithmetic, groups and the number theory behind RSA (Euler’s theorem, modular inverses).
• Algorithms: asymptotic complexity. L-notation sits between polynomial and exponential time, and this news shows why constants in exponents matter.
• Computer Networks and security courses: digital signatures, certificates, padding schemes and why “textbook RSA” without padding is unsafe.
• GATE DA and data science learners: a case study in AI agents doing research, with one model checking another and a formal proof assistant as the final judge.
• Careers: security engineering, PKI and HSM operations, cryptography research and the coming post-quantum migration will all need people who understand both the maths and the AI tools.

My advice: solve a small RSA example by hand (p = 61, q = 53 is the classic), then read the abstract of the Fan Factories paper and try to explain the precomputation idea to a friend. If you can do both, you understand more than most headlines did this week.

Frequently asked questions

Did Google DeepMind break RSA?

No. It found ways to make specific attacks on legacy 1024-bit RSA cheaper, mostly in theory. RSA-2048 and larger keys remain safe against these methods.

Was any 1024-bit RSA key actually factored?

Not with the new factoring method. The Fan Factories paper says no implementation exists yet. The measured 3.5x result reproduced an existing signature-forgery computation, which works without factoring the key.

Is this a quantum computing breakthrough?

No. Both results are classical algorithms running on normal CPUs and GPUs. Quantum threats to RSA are a separate issue, which is why post-quantum cryptography migration is already under way.

Which AI model did DeepMind use?

DeepMind has not named it in the material I could check. The paper describes a two-agent setup, one generating proofs and one verifying them, with checks in Lean 4.

Should I worry about my bank or UPI app?

Mainstream banking and payment services use modern key sizes and protocols, so this result does not directly affect them. The concern is old, forgotten systems, which is why organisations should audit for 1024-bit keys.

What should students learn from this?

That cryptographic “hardness” is an assumption that improves or erodes as algorithms improve, and that AI is now part of that process. Strong fundamentals in number theory and complexity are what let you judge such claims.

The bottom line

DeepMind’s announcement is not the end of RSA, and it is not even the end of 1024-bit RSA, which was already deprecated. It is a signal. Human experts plus AI agents produced new cryptanalysis, with machine-checked proofs, in weeks. The practical lesson is simple: retire 1024-bit keys wherever they still exist, and plan for the post-quantum transition. The educational lesson is bigger: the people who will make sense of AI-driven research are those who understand the maths underneath.

Sources and further reading

• Google DeepMind working paper: Fan Factories, Multiple Number Fields in Factorization Factories and Batch NFS
• Google DeepMind announcement on X
• Pushmeet Kohli (VP of Science, Google DeepMind) on X
• IACR ePrint 2026/2131: Forging 1024-bit RSA signatures in nearly SNFS time (UC San Diego and Inria)
• UCSD companion repository and FAQ for the signature forgery work
• Interesting Engineering: Google DeepMind agents expose older encryption flaws
• OfficeChai: DeepMind uses AI agents on legacy RSA-1024
• DEV Community: detailed summary of both DeepMind results
• Hardware Busters: the 1,380 core-year HSM signature forgery
• Startup Fortune: reaction to the September RSA forgery paper
• byteiota: practical audit advice for 1024-bit keys

Written by Piyush Wairale (M.Tech, IIT Madras), founder of PiyushAI Edtech. Figures are as reported on or before 8 November 2026; the DeepMind papers are early working versions and numbers may change after review.