DeepMind's Agents Reran a 1024-Bit RSA Computation in Under Four Days, and Neither Paper Touches 2048-Bit Keys

The measured result: a signing attack, rerun by agents

The first paper, "Modular Roots from a Restricted Oracle", starts from a September attack by Shea, Haller, Suhl, Heninger and Thomé. In that setting an attacker gets temporary access to a signing interface and can later produce signatures without ever recovering the key. Using the same algorithm, polynomials and bounds, DeepMind's agents computed the first root in 391 CPU core-years, 3.5 times less than the original. That figure leaves out the linear algebra, which ran on GPUs.

The working arrangement is the more interesting part. A supervisor model wrote the design, set checkpoints and audited results, while an executor model wrote the code, ran distributed jobs and fixed failures. The paper reports:

• about twenty short human messages, "most of them approvals";
• about 33,500 lines of new code and 336 distributed experiments;
• up to 300,000 CPU cores and 16 GPUs, and 3.2 days from the first full-scale sieving job, against about five months originally;
• problems found during the run, including a 32-bit index overflow that made the first computed root wrong.

The shorter calendar time mostly reflects how many machines were available. The 3.5 times saving is the figure that speaks to the quality of the work.

The paper also shows that the PKCS#1 v1.5 format stops helping once a caller controls slightly more than half of the block, 65 of 128 bytes at 1024 bits, through an interface such as CKM_RSA_PKCS that pads but does not hash the caller's data. For a 32-byte digest it lowers the asymptotic exponent from L[1.8171] to L[1.5803], and says plainly "we did not run it at this size". DeepMind's roughly 1,600 times figure for that case comes from Pushmeet Kohli's post as reported by WebProNews, and we could not read the post itself.

The theoretical result: cheaper factoring in bulk

"Fan Factories", dated November 5, addresses attackers who want many keys of one size. With a precomputation costing about one factorization, the best known cost of each further integer has been L[1.902] since 1993. Giving every target its own family of number fields brings that to L[1.793]. At leading order, each further 1024-bit integer costs about 1/58 of a standard number field sieve run, 30 times less than the earlier method. One model generated the proofs, a second verified them, and the algebraic identities are machine-checked in Lean 4. The figures set lower-order terms to zero, and the authors state that "no fan factory has been implemented".

What remains uncertain. These are working papers without peer review. The forgery model needs direct calls to the signing interface, about four billion of them in the reproduced computation, made before the target is known. Interfaces that hash inside the device, such as CKM_SHA256_RSA_PKCS, fall outside it. Neither paper recovers a single key faster than the number field sieve.

Analysis: This is an inventory task, not an emergency. Tanishka's team at Belgavi's Book Store should list any 1024-bit keys still signing gift-card receipts or supplier files, and check whether any application can reach mechanisms that sign caller-supplied blocks, such as CKM_RSA_X_509 or CKM_RSA_PKCS, on the hardware module. Restricting that mechanism costs little. The wider lesson is about timing: long-range estimates of when a retired key becomes cheap to attack may need revisiting more often.

Sources and evidence

• Modular Roots from a Restricted Oracle: Faster Affine Roots and a 1024-bit Computation (Google DeepMind working paper)
• Fan Factories: Multiple Number Fields in Factorization Factories and Batch NFS (Google DeepMind working paper, November 5)
• Google DeepMind's AI Agents Find Two Weak Spots in Legacy 1024-Bit RSA (WebProNews, November 7)
• Forging 1024-bit RSA signatures in nearly SNFS time (IACR ePrint 2026/2131)