Google DeepMind announced on November 6 that AI agents, guided by human cryptanalysts, found two new algorithmic weaknesses in legacy RSA-1024 encryption — and it took them weeks, not years. This is not the same story as September’s RSA-896 factoring record, where AI threw compute at a known problem. DeepMind’s agents found new math: a 1,600x improvement on signature forgery efficiency and a 30x reduction in batch factoring cost. Modern RSA-2048 is unaffected. But if RSA-1024 keys are hiding anywhere in your infrastructure — old firmware, forgotten VPN configs, ancient SSH keys — the case for leaving them alone just got significantly weaker.
Two Findings, Not One
The DeepMind team, working with cryptanalysts Nadia Heninger and Emmanuel Thomé, published two results:
Signature forgery. A new algorithm improves on the best-known forgery attack by roughly 1,600x for 1024-bit keys, specifically in scenarios where an attacker controls only a small portion of the signed data — for example, a 32-byte hash. The full paper is titled “Forging 1024-bit RSA signatures in nearly SNFS time” and is published on IACR. This is a theoretical advance, not a live attack; nobody has forged a certificate in production using this method. But the theoretical floor just dropped considerably.
Batch factoring. A second algorithm achieves better asymptotic complexity than any previously known batch factoring method, cutting the marginal cost of factoring each additional 1024-bit key (in a batch of many) by about 30x. This is the finding that should concern infrastructure teams. IoT fleets, enterprise certificate pools, and legacy server farms often have many 1024-bit keys across them. Attacking them in bulk just got cheaper on paper.
This Is Different from the RSA-896 Story
In September 2026, an Anthropic engineer factored RSA-896 by using Claude to accelerate CADO-NFS across 2,048 GPUs — 30 GPU-years of compute, no new math. That was AI as a force multiplier for existing techniques. The DeepMind finding is categorically different: AI agents were used to discover new algorithms — better theoretical approaches that reduce the complexity class, not just run existing approaches faster.
That distinction matters. If the problem were only compute-bound, keeping keys offline or air-gapping old devices buys time. If the problem is algorithmic, the security boundary shrinks regardless of how much compute the attacker brings. RSA-1024 was already deprecated; now there is a theoretical argument for why batch exploitation of legacy keys could become materially cheaper.
Where RSA-1024 Still Hides
RSA-1024 has been prohibited for new deployments since 2013 and CAs stopped issuing 1024-bit certs in 2014. But prohibited is not the same as gone:
- Embedded devices and IoT firmware signing — many shipped with 1024-bit keys and have never been updated
- Internal PKI certificates on enterprise networks, issued before 2014, with long validity periods
- Old SSH keys on servers that have never been rotated
- Legacy VPN appliances and firewalls using 1024-bit for key exchange
- HSMs provisioned years ago with locked-in 1024-bit signing keys
Separately, GitHub ran a brownout on November 4, 2026, as part of its plan to remove RSA-SHA1 signatures and enforce a 3072-bit minimum for new RSA uploads. If automation scripts or CI pipelines failed on November 4, RSA-1024 keys are likely involved.
How to Find and Replace Them
Three commands cover most cases:
# Check a certificate file
openssl x509 -in cert.pem -text -noout | grep "Public-Key"
# Check a live TLS endpoint
openssl s_client -connect yourserver.com:443 2>/dev/null \
| openssl x509 -noout -text | grep "Public Key"
# Check an SSH key
ssh-keygen -l -f ~/.ssh/id_rsaIf the output shows (1024 bit), replace it. The replacement path is straightforward: Ed25519 for SSH keys, RSA-4096 or ECDSA P-256 for TLS certificates, RSA-3072 or better for long-lived code-signing or CA keys.
The Bigger Signal
Pushmeet Kohli, DeepMind’s VP of Science, chose his words carefully: “these results show why we must not assume the mathematical ‘hardness’ of cryptographic schemes which we have relied upon in the past.” That is not just about RSA-1024. It is a statement about methodology — AI agents can now compress years of cryptanalysis research into weeks.
RSA-2048 is not under threat from this research. But the same AI-guided algorithm discovery that found shortcuts in RSA-1024 will be pointed at other problems. The timeline for expected cryptographic lifetimes is shortening. Treat this as the final notice on RSA-1024: not because a live attack is imminent, but because the cost curve for such an attack just moved, and it will not move back.
