Google DeepMind says two AI agents cut the computing work in a legacy RSA signature experiment by about 3.5 times. They reproduced a known test involving 1024-bit keys, writing and running the code with human guidance. A separate working paper sets out a theoretical way to make factoring many old RSA keys cheaper.
Both papers say the results do not threaten deployed systems using RSA keys of 2048 bits or more. The findings concern older cryptography, but they also show AI agents taking on substantial research work under human guidance.
RSA is used for tasks including digital signatures, which help verify that data is authentic. Key length, measured in bits, is one part of its security: the 1024-bit systems studied here are older than today’s recommended minimum for generating RSA signatures.
What the researchers actually ran
In the signature working paper, the team reports using 391 CPU core-years to reproduce a computation previously reported at 1,380. The unit adds up work across processor cores. One core running for a year counts as one core-year.
The experiment finished in 3.2 days using up to 300,000 CPU cores and 16 graphics processors. That short elapsed time mainly reflects the huge amount of parallel computing. The reduction in CPU work came from better implementation and execution of the same underlying algorithm.
The agents designed, wrote, ran and debugged the code. A human researcher sent about twenty short messages, mostly approvals. The paper also records a software bug that made the first computed result wrong before the agents corrected it.
The experiment assumed prior access to a signing service. It did not recover a private key or compromise a live encrypted connection.
The bigger factoring claim is still theoretical
RSA relies on the difficulty of splitting a large number into its prime factors. The second paper, “Fan Factories”, proposes sharing expensive preparation across many targets so that each additional 1024-bit number would be cheaper to factor.
Its estimate is about 30 times less work per additional target than the previous multiple-number-field method, after substantial preparation. That is a mathematical estimate, not a measured speed-up: the authors say no fan factory has been implemented. Large memory requirements remain an obstacle.
Pushmeet Kohli, a co-author of both papers, wrote on X that “AI can help defenders improve security standards well ahead of future threats.”
What security teams should check
If you manage signing systems, check where old RSA keys are still used and plan replacements with your suppliers. The US National Institute of Standards and Technology’s 2019 transition guidance already disallowed generating RSA signatures with keys shorter than 2048 bits. It treated verification of existing signatures using 1024-bit to sub-2048-bit keys as legacy use.
Ask suppliers which key sizes and signature configurations your systems use before deciding what needs replacing.
Sources
- Google DeepMind announcement
- Pushmeet Kohli’s explanation
- Modular Roots working paper (PDF)
- Fan Factories working paper (PDF)
- NIST SP 800-131A Revision 2 (PDF)
Discover more from Sulat — AI & Tech News
Subscribe to get the latest posts sent to your email.
