Google DeepMind AI Agents Cut RSA-1024 Attack Cost 3.5x, Forcing Cryptographic Inventory Action
What happened
Researchers at Google DeepMind, working with cryptographers from UC San Diego and Inria, published new findings. AI agents under human supervision identified two techniques that reduce the cost of breaking legacy 1024-bit RSA encryption. As reported by SecurityWeek, the agents reproduced a known forgery attack and cut the processing time required by 3.5 times, completing the task in under four days. RSA-1024 is an encryption key type used in older digital signing systems. A known forgery attack lets an attacker impersonate a legitimate certificate or signature without the original private key. The finding does not break modern 2048-bit or larger keys. It narrows the safety margin for systems still relying on the legacy standard, including older hardware security modules used for document signing and payment authorization.
Why it matters
- ·Organizations with legacy RSA-1024 keys in hardware signing systems, older certificate authorities, or stored encrypted documents now face a meaningfully lower attack cost. This compresses the timeline for completing migrations that compliance programs have often treated as low-urgency.
- ·Many compliance programs set minimum key-length requirements but lack a live inventory of where legacy keys actually exist. This research exposes that gap: a standard that permits RSA-1024 'in limited legacy use' may be covering more attack surface than governance teams realize.
- ·AI-assisted cryptographic research has now demonstrated it can reproduce and improve on known attack methods at speed. That capability is not restricted to researchers, and risk teams should factor it into threat modeling for systems where cryptographic integrity underpins access, identity, or payment controls.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Commission an inventory of all systems, certificates, hardware security modules, and stored files that use RSA-1024 keys, and confirm whether any compliance policy still permits their use.
- ☐Ask your IT or security team to confirm that all active transport layer security certificates, code-signing certificates, and document-signing keys meet a minimum of 2048-bit RSA or equivalent strength, and produce evidence of that check.
- ☐Review any vendor or partner agreements that involve digital signature verification to determine whether counterparties may be sending or accepting RSA-1024 signed documents, and require written confirmation of their key-length standards.
- ☐Update your cryptographic risk assessment to treat AI-accelerated research as a factor that shortens the practical lifespan of legacy key standards, and document the revised risk rationale for board or audit committee reporting.
- ☐If your organization operates in a regulated sector with explicit key-length requirements, check whether recent or upcoming regulatory guidance has updated minimum standards and confirm your systems are already compliant.
What to watch next
Regulators in financial services, healthcare, and government contracting have historically updated cryptographic minimum standards after research milestones lower the attack cost on legacy systems. Compliance teams should monitor guidance updates from relevant sector regulators and standards bodies, particularly any revisions to approved algorithm lists or key-length floors. AI-assisted cryptanalysis is advancing rapidly. Organizations relying on 'migrate eventually' timelines should set a firm deadline rather than treat migration as a future aspiration.