DeepMind's AI Agents Cut the Cost of Forging 1024-bit RSA Signatures by About 1,600x. Here Is the Ten-Minute Audit for Your SSH Keys, Certs and DKIM.
Google DeepMind announced on November 6 that its AI agents helped find two weaknesses in legacy 1024-bit RSA. As Byteiota reports it, one is a signature forgery algorithm roughly 1,600x better than the best known attack for 1024-bit keys, and the other cuts the marginal cost of factoring each additional 1024-bit key in a batch by about 30x. Nobody has forged a production certificate with this, and 2048-bit keys are reported unaffected. If you own a 1024-bit key somewhere, though, this is the moment to find it.
What was actually announced
Per Byteiota, DeepMind worked with cryptanalysts Nadia Heninger and Emmanuel Thomé, and the forgery result is described in a paper titled "Forging 1024-bit RSA signatures in nearly SNFS time" on the IACR ePrint server. The forgery attack applies when an attacker controls only a small part of the signed data, for example a 32-byte hash. The factoring result is a relative saving: 30x cheaper per extra key in a batch, with no absolute cost for a single key given.
Byteiota's own framing is that this is a theoretical advance. I haven't read the paper, and I couldn't retrieve DeepMind's own post, so I'm relying on one secondary source here. That is enough to justify an audit and not enough to justify panic.
Where a solo operator still has 1024-bit keys
Three places come to mind, in the order I'd check them. DKIM keys are set once and forgotten, and a lot of them date from when 1024 bits was a common default. Old SSH keys on a forgotten laptop or a deploy user are the second spot. Third is anything you generated for a side project years ago and never rotated: JWT signing keys, code-signing keys, an internal CA for a home lab.
TLS certificates are the least likely hiding place, because public CAs stopped issuing 1024-bit certificates years ago, but checking costs one command.
The ten-minute audit
# SSH keys: the first number is the bit length for f in ~/.ssh/*.pub; do ssh-keygen -l -f "$f"; done # TLS certificate on a live host echo | openssl s_client -connect example.com:443 2>/dev/null \ | openssl x509 -noout -text | grep "Public-Key" # DKIM key length (replace selector and domain) dig +short TXT selector._domainkey.example.com \ | tr -d '" ' | sed 's/.*p=//;s/;.*//' \ | base64 -d | openssl rsa -pubin -inform DER -noout -text | head -1
Anything that prints 1024 bit goes on a replacement list. Run the DKIM line against one domain you know first, because DNS providers format long TXT records differently and the pipeline assumes quoted chunks.
What to replace them with
For SSH, I'd generate Ed25519 keys and retire the RSA ones. For DKIM, publish a new 2048-bit selector, switch your sender to sign with it, and remove the old selector after a few days. Many DNS panels need the long key split into two quoted strings, so read your provider's docs before pasting. For TLS, a modern CA will already give you something sane, and I'd pick ECDSA P-256 or RSA-2048 over agonizing about 4096. Byteiota suggests RSA-4096 for TLS and RSA-3072 or better for long-lived signing keys, which is a reasonable conservative call for anything you can't rotate easily.
Where I could be wrong
A 1,600x improvement on an astronomically expensive attack can still be astronomically expensive. Byteiota gives no absolute cost, time or hardware figure, so I can't tell you whether forging a 1024-bit signature is now cheap, merely cheaper, or still out of reach for anyone but a state. And 1024-bit RSA has been on the retire-it list for years, so a skeptic would say this changes nothing about advice you should have followed already. I'd agree with that. The AI-agent angle is what's new, and it suggests the next improvement may arrive faster than the last.
What I'd actually do
Block twenty minutes today. Run the three commands, rotate DKIM first since it's cheap and invisible to users, then replace old SSH keys as you touch each server. Write the key sizes you find into a note so the next announcement costs you two minutes instead of twenty.
Author
Lukas
@lukcombinator