Defender Impact
Google DeepMind’s AI agent research delivers something defenders have long lacked: empirical, AI-accelerated quantification of residual attack costs against legacy cryptographic deployments. By cutting the ambiguity around RSA-1024 risk, this work gives cryptographic and PKI teams the evidence base they need to prioritise migration decisively rather than relying on conservative theoretical estimates that may understate urgency.
Capability Overview
Working with cryptographers from UC San Diego and Inria, Google DeepMind deployed supervised AI agents to investigate two classes of attack against 1024-bit RSA systems. The research was not a theoretical exercise — agents actively designed, executed, and debugged live cryptographic computations, completing the work in under four days with roughly 20 interactions from a human researcher, mostly approvals.
The first finding addresses digital signature forgery under the PKCS#1 v1.5 padding scheme, widely used in the PKCS#11 signing interface of cryptographic hardware such as HSMs. DeepMind’s agents re-ran a known academic forgery attack on a 1024-bit key, reducing CPU time 3.5-fold — from 1,380 CPU core-years in the original study to 391. Critically, the research established a concrete threshold: once an attacker controls roughly half or more of the signed block, padding provides no additional forgery resistance. This gives HSM operators and PKI engineers a measurable boundary rather than a vague caveat.
The second finding concerns batch RSA key factoring — the efficiency gains available when an attacker targets many same-size keys simultaneously. DeepMind found an algorithm estimated to be approximately 1,600 times more efficient than previous best-known methods against 1024-bit keys.
Both findings are explicitly scoped to legacy RSA-1024. Modern deployments using 2048-bit or larger keys are unaffected, and outright factoring of a 1024-bit key would still require an estimated 500,000 to 1 million CPU core-years.
Defensive Advances
This research provides defenders with three concrete advances:
Quantified migration urgency. For years, RSA-1024 has been formally deprecated but inconsistently retired. These empirical cost reductions give security teams documented, peer-reviewed evidence to accelerate decommissioning conversations with hardware vendors, compliance teams, and business stakeholders.
PKCS#1 v1.5 risk threshold. The finding that padding protection collapses once an attacker controls roughly half the block gives HSM and signing-service operators a specific, actionable boundary to assess whether their signing workflows are exposed.
AI-assisted cryptographic research as a defensive instrument. The agent workflow — four days, human-supervised, low interaction overhead — demonstrates a replicable model for applying AI to accelerate cryptographic hardness analysis. This is a template defenders and standards bodies can build on.
Residual Gaps
Several maturity considerations limit immediate operationalisation of these findings:
Cryptographic inventory gaps. Many organisations lack a comprehensive, current inventory of where RSA-1024 keys remain in use — particularly in embedded systems, HSMs, legacy VPN appliances, and third-party integrations. Without that inventory, the research findings cannot be mapped to specific remediation targets.
Vendor migration timelines. Hardware cryptographic devices often have multi-year replacement cycles. Even with clear evidence of elevated risk, migration may be constrained by procurement and vendor support windows rather than technical readiness.
Post-quantum intersection. This research reinforces the case for cryptographic agility investment, but organisations mid-way through post-quantum migration planning will need to decide whether to prioritise RSA-1024 remediation or absorb it within a broader PQC migration programme.
Scope limited to 1024-bit. The methodology and agent workflow are not yet published for replication against other key sizes or algorithm families, limiting generalisation of the defensive research model.
Framework Mapping
This capability primarily informs defensive posture rather than mapping cleanly to offensive ATLAS techniques. Where relevant: AML.T0047 (AI-Enabled Product or Service) captures the deployment of AI agents as a research instrument. LLM09 (Overreliance) is a downstream concern — organisations should not rely solely on AI-generated cryptographic assessments without expert cryptographer validation, as demonstrated by DeepMind’s human-supervised workflow model.
Deployment Considerations
Organisations should treat this research as an external trigger event rather than a capability to deploy directly. The immediate action is to use the empirical findings as evidence in internal risk governance processes. Teams should sequence: (1) cryptographic asset inventory, (2) identification of PKCS#1 v1.5 usage in HSMs and signing services, (3) risk-tiering of RSA-1024 deployments by exposure profile, and (4) accelerated migration roadmap aligned to existing PQC planning.
Defender Checklist
- Initiate or update a cryptographic inventory scan to identify all active RSA-1024 key usages across infrastructure, HSMs, and third-party integrations
- Review HSM and PKI signing configurations for PKCS#1 v1.5 padding, particularly where external parties influence signed content
- Use DeepMind’s published cost estimates in risk documentation to support escalation of RSA-1024 migration timelines
- Assess whether RSA-1024 remediation should be a standalone sprint or absorbed into existing post-quantum cryptography migration planning
- Brief cryptographic and PKI owners on the PKCS#1 v1.5 block-control threshold as a concrete exposure criterion
- Monitor NIST and vendor guidance for updated formal deprecation timelines informed by this and related research