Google DeepMind says AI agents found two new weaknesses in 1024-bit RSA, an older encryption key size. Your 2048-bit keys, and the HTTPS, banking and messaging apps that use them, are not threatened. But if you run old servers, devices or certificates, it’s worth checking what key size they use.
Here’s the short version before the details.
- Announced Nov. 6, 2026, by DeepMind’s Pushmeet Kohli.
- Two findings: cheaper signature forgery and cheaper bulk key factoring.
- Both target 1024-bit RSA only, which is already considered outdated.
- No real-world attack has been shown, and the work is a preprint.
The takeaway: this is a nudge to retire old keys, not a reason to panic.
What DeepMind actually announced
According to Interesting Engineering, the work was done by AI agents under human supervision, with collaborators at UC San Diego and France’s Inria. The team aimed the agents at RSA, one of the most studied algorithms in cryptography.
Standards bodies moved away from 1024-bit keys years ago, so this isn’t a surprise attack on something people rely on today. What’s new is how fast AI-guided research got here. Kohli said the results “reinforce the need to continuously reassess cryptographic assumptions.”
The research appears as a paper on the IACR ePrint server, titled “Forging 1024-bit RSA signatures in nearly SNFS time,” per a summary on ByteIota. ePrint is a preprint site, so it hasn’t been confirmed by formal peer review as far as reports say.
Weakness one: signature padding that protects less than expected
When you sign data with RSA, the data is first wrapped in “padding” to make forgery harder. DeepMind’s agents found that if an attacker controls about half or more of the signed block, padding adds almost no extra protection.
The bigger headline number is 1,600x. Even when an attacker controls only a small slice, such as a 32-byte fingerprint, the agents found an algorithm that is theoretically about 1,600 times better than the previous best attack on 1024-bit keys.
Keep in mind that “theoretically” matters here. It’s a faster method on paper for one specific scenario, not a forged signature on a live system.
Weakness two: cheaper factoring when attackers target many keys
Many systems use the same standard key sizes. That lets an attacker share work across a pile of keys instead of cracking them one by one.
The second algorithm cuts the average cost of factoring each extra 1024-bit key by roughly 30 times compared with earlier batch methods. Reports don’t say how many keys that takes or what hardware it needs, so the real-world cost is still unclear.
It’s a quiet reminder of what we covered in OpenAI’s AI-found Linux kernel bugs: AI is getting good at finding flaws that humans missed for years.
Who still needs to worry about 1024-bit RSA keys
Most people never touch a 1024-bit key. The risk sits with older infrastructure, listed below based on the ByteIota summary.
| Where it shows up | Why it matters | What to do |
|---|---|---|
| Embedded and IoT firmware signing | Keys were often never updated | Ask the vendor for newer firmware signing |
| Internal certificates issued before 2014 | Long validity periods can keep old keys alive | Reissue with 2048-bit or larger keys |
| Old SSH keys | Unrotated keys can sit untouched for years | Generate Ed25519 keys and retire old ones |
| Legacy VPNs and firewalls | Old appliances may default to 1024-bit | Update firmware or replace the device |
| Hardware security modules | Some were set up with 1024-bit signing keys | Rotate to RSA-3072 or larger |
The batch result matters most for big fleets, because a large pool of 1024-bit keys becomes a cheaper target in bulk.
How to check your own keys in five minutes
You don’t need special tools. These standard commands print the key size, and a result of “1024 bit” means that key should be replaced.
- For a certificate file:
openssl x509 -in cert.pem -noout -text | grep "Public-Key" - For an SSH key:
ssh-keygen -l -f ~/.ssh/id_rsa.pub - For a live site: run
openssl s_client -connect example.com:443and check the certificate details.
Once you find a 1024-bit key, don’t just swap it and move on. Note where it’s used and what trusts it, because replacing a signing key can break older clients. Test the new key in a staging setup first.
If you manage servers, also keep an eye on patches like the one in our OpenSSH 10.6p2 guide, since old keys and old software often travel together.
Frequently Asked Questions
Is my HTTPS or online banking at risk?
No. Modern sites use 2048-bit or larger keys, and DeepMind’s findings are described as not threatening modern encryption.
Is RSA-2048 affected by these new attacks?
Reports say RSA-2048 is unaffected. The findings are about 1024-bit keys, which are older and weaker by design.
Has anyone actually forged a signature with this method?
Not that has been reported. The 1,600x figure is a theoretical improvement, and no production forgery has been shown.
What should I replace a 1024-bit key with?
The ByteIota summary suggests Ed25519 for SSH, RSA-4096 or ECDSA P-256 for TLS, and RSA-3072 or larger for long-lived code-signing or CA keys.
Does this mean AI can now break encryption?
Not in general. It shows AI can help researchers find better attacks on weak, old setups, which is useful for stress-testing newer systems too.
My take: if you can’t say for sure what key sizes your old devices and certificates use, spend ten minutes checking this week. Retiring a 1024-bit key is cheap and boring, and that’s exactly why it’s worth doing before someone makes it urgent. Everyone else can relax and keep updating as usual.
Leave a Reply