Google DeepMind's AI Agents Make 1024-Bit RSA Keys Cheaper to Attack

Entenda a falha

A vulnerabilidade

This is a cryptanalytic weakness in legacy 1024-bit RSA, not a bug in one product, and no CVE is listed. Google DeepMind, with UC San Diego and Inria cryptographers, reports two ways to cut attack cost. First, PKCS#1 v1.5 signature padding, as used by the PKCS#11 interface of devices such as HSMs, gives no protection once the attacker controls roughly half the signed block or more. The attacker must be able to choose what gets signed and needs about 4 billion signing queries made in advance. It does not recover the private key and does not work against devices that hash messages internally. Second, factoring many 1024-bit keys at once becomes about 30 times cheaper per extra key, but this is a theoretical estimate. Google says 2048-bit or larger keys remain secure. No affected or fixed versions are given.

Como funciona

In the signature scenario, a device signs messages chosen by the attacker, and the signing interface adds PKCS#1 v1.5 padding to bring each message to a fixed block size before applying the RSA private key. The attacker collects a large number of these signatures and combines them to forge a valid signature on a message the device never signed. The padding was thought to make this harder, but DeepMind found its protection depends on how much of the block the attacker controls. At roughly half the block or more, it adds nothing. In the multi-key scenario, one large upfront computation is shared across many keys of the same size, so each additional key costs less to factor.

Por que é vulnerável

The root cause is a wrong assumption about hardness. Padding was known to make forgery harder, but its value against an attacker who chooses what gets signed was unclear, and it turns out to vanish when the attacker controls enough of the block. Separately, the cost of factoring many same-size keys had not been reduced by sharing one upfront computation as the new algorithm does. 1024-bit keys leave little security margin to absorb such gains. The articles describe no code fix; the mitigation implied is to stop using 1024-bit RSA and move to 2048-bit or larger keys.

Como foi descoberta

Google DeepMind says AI agents working under human supervision found both results, in research with cryptographers from UC San Diego and Inria, and an accompanying paper describes them. In the forgery test, two agents designed, ran and debugged the computation in under four days, with about 20 messages from the human researcher, mostly approvals. The finding for keys with less attacker-controlled data, such as a 32-byte hash, was an algorithm DeepMind estimates is roughly 1,600 times better than the previous best method. The disclosure is the research publication itself, with no vendor reports or exploitation in the wild mentioned.

Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 06:15.