DeepMind 1024-bit RSA: what it found and how to check keys

Google DeepMind says AI agents, guided by human researchers, found two weaknesses in legacy 1024-bit RSA: a cheaper way to forge signatures on some systems and a cheaper way to factor many keys at once. Keys of 2048 bits and up aren't affected, so the job for most businesses is finding anything still running at 1024 bits, starting with email signing keys.

The posts on X

@GoogleDeepMind announced the work on November 6, writing, "Guided by humans, our models uncovered two major weaknesses." A follow-up post says "modern 2048-bit systems remain safe from these specific exploits," then adds that "we can no longer rely on historical hardness assumptions." Pushmeet Kohli (@pushmeet), DeepMind's VP of Science, published the longer explanation as an X article. The team released two working papers, and neither has been peer reviewed.

What DeepMind found

The first paper is about forging signatures. It assumes an attacker who can temporarily send data to a signing device, collect the answers, and later sign new things without the device. The paper shows the device's fixed formatting stops helping once the attacker controls about half the block, or a 64-byte digest at 1024 bits. Devices that compute the digest themselves fall outside the attack. Kohli's article estimates a gain of roughly 1,600x for 32-byte digests, but that figure is theoretical and hasn't been run at this size.

The measured result is a repeat of a known forgery from a September study. Two AI agents did it in 391 CPU core-years, against 1,380 for the original, on the same algorithm. The savings came from better code and execution. The paper says a human researcher sent about twenty short messages, most of them approvals, while the agents wrote about 33,500 lines of code.

The second paper covers factoring many keys. After a setup costing about one normal factoring, each further 1024-bit key would cost about 1/58 of a normal factoring, 30 times less than the best comparable method. The authors call these leading-order estimates that "do not predict running times."

Our read

We care more about the agents than the keys. The paper still estimates factoring its test key at 500,000 to 1,000,000 core-years, so nobody is spending that on a local business's email. What caught our attention is how little a person had to do on a hard cryptanalysis job. Anthropic reported cryptography results from Claude Mythos Preview in July, while GPT-6 Cyber and Anthropic's five exploit chains point the same way on software bugs. Weak settings that stayed cheap to ignore for years could get expensive sooner.

How to check your keys

Email signing keys (DKIM)

Start here if your business sends email from its own domain. The signature paper doesn't say any email system offers the signing access its attack needs. Our concern is the factoring side, since a DKIM public key sits in DNS for anyone to read.

To find your selector, open a message you sent in Gmail, choose "Show original" (steps here), and look for s= in the DKIM-Signature header. Then run this, swapping in your selector and domain:

dig +short TXT google._domainkey.yourdomain.com

Count the characters after p=. About 216 means 1024-bit, and about 392 means 2048-bit.

To upgrade on Google Workspace, go to Apps, Google Workspace, Gmail, Authenticate email in the Admin console, pick the domain, click Generate New Record and choose 2048. Google's guide covers the DNS step, and its troubleshooting page explains how to split the key if your host caps TXT strings at 255 characters.

On Microsoft 365, Microsoft's docs list 1024 as the default for the PowerShell key size setting, so it's worth a look. In Exchange Online PowerShell:

Get-DkimSigningConfig -Identity yourdomain.com | Format-List Selector1KeySize,Selector2KeySize
Rotate-DkimSigningConfig -Identity yourdomain.com -KeySize 2048

Microsoft says a rotation takes four days and only changes the next active selector, so you need a second rotation to move the other one.

SSH keys and your website

For an SSH key, the first number this prints is the key size:

ssh-keygen -l -f ~/.ssh/id_rsa.pub

Anything at 1024 should be replaced, and ssh-keygen -t ed25519 makes a modern key. For your site's certificate:

openssl s_client -connect yourdomain.com:443 </dev/null 2>/dev/null | openssl x509 -noout -text | grep "Public-Key"

For older firewalls, door controllers and other boxed hardware you can't inspect, ask the vendor what key size it uses.

What it means for businesses

None of this calls for panic, but you can only fix the old settings you know about, so write down what you run. New Face Design's free process audit can help you list the tools and accounts your business depends on.