Google DeepMind AI Agents Reduce the Cost of Attacking RSA-1024
Summary
Google DeepMind reports AI-assisted methods that reduce the cost of RSA-1024 signature forgery and repeated key factoring. The findings concern legacy 1024-bit systems; modern 2048-bit-or-larger keys remain secure, the researchers say.
Key points
- In a sandboxed test, agents reran an earlier RSA-1024 signature-forgery attack in 391 CPU core-years, down from 1,380.
- The researchers found padding adds no protection when an attacker controls roughly half or more of the signed block.
- For attackers controlling less of the block, a proposed method is theoretically about 1,600 times better than the previous best approach.
- The signature attack does not recover the private key; it requires roughly 4 billion signing queries in advance and does not work against devices that hash messages internally.
- A separate, unimplemented algorithm is estimated to make factoring each additional same-size RSA-1024 key about 30 times cheaper on average, after an initial computation as costly as factoring one key.
- The researchers say the results affect obsolete RSA-1024 systems, not modern protocols using 2048-bit or larger keys.
Article Details
- Attack Vectors
- A signature-forgery attack against legacy RSA-1024 using the PKCS#1 v1.5 format through the PKCS#11 signing interface may become more feasible when an attacker controls roughly half or more of the signed block. The reported attack requires about 4 billion signing queries in advance and does not work against devices that hash messages internally.
- The researchers describe a theoretical method for reducing the average cost of factoring additional RSA-1024 keys of the same size by sharing an upfront computation. The method has not been implemented.
- Defensive Notes
- The article says the results affect obsolete RSA-1024 systems; Pushmeet Kohli said modern protocols using 2048-bit or larger keys remain secure.
- The signature-forgery attack does not recover the private key and does not work against devices that hash messages internally.
- The reported factoring-cost improvement is a theoretical estimate, assumes an upfront computation as costly as factoring one key, and has not been implemented.