Crossover: Google DeepMind's AI Cracked Open RSA-1024 Defenses and Proved the Signal Protocol Sound

Key points

Google DeepMind's agents found an algorithm for forging RSA-1024 signatures that is theoretically about 1,600 times better than the previous best, and a batch method that makes each additional 1024-bit key about 30 times cheaper to factor ¹ ³.
Separately, DeepMind used its AlphaProof Code framework to formally verify key cryptographic guarantees of the Signal protocol in four weeks, finding no new flaws in the parts it examined ².
The same machinery that proves a protocol correct also exposes where an old scheme's assumptions fail: on old Signal versions with known, fixed bugs, the tool correctly refused to certify them ².
Both projects kept humans in the loop and carry real limits: the RSA work has not factored a key and only affects obsolete 1024-bit systems, while the Signal proof did not cover the whole mobile app ¹ ².

One Lab, Two Opposite Verdicts

Imagine handing the same brilliant mathematician two assignments. In the first, you ask her to tear a cryptosystem apart. In the second, you ask her to prove another one cannot be torn. Google DeepMind has now, in effect, done both with AI agents, and the results landed almost side by side.

On the offensive side, DeepMind worked with cryptographers from UC San Diego and Inria and found that attacking legacy 1024-bit RSA costs less computation than anyone assumed ¹. On the defensive side, researchers used agentic AI to formally verify a number of the Signal protocol’s key guarantees, the cryptography behind the Signal app, Google Messages and WhatsApp ². One result is a warning. The other is a reassurance. The deeper story is that they come from the same capability.

What the Agents Broke

The RSA findings are concrete. The first concerns padding, the preset data that signature standards add to a message. Padding was known to hinder forgery, but its value against an attacker who chooses what gets signed was unclear. The agents showed it depends on how much of the block the attacker controls: at roughly half or more, padding adds no protection ¹. The accompanying paper ties this to the PKCS#1 v1.5 format used in the PKCS#11 signing interface of devices such as hardware security modules ¹ ⁴.

To test it, two cooperating AI agents designed, ran and debugged a reproduction of an earlier academic forgery on a 1024-bit key in under four days, needing about 20 messages from a human, mostly approvals. The first forgery took 391 CPU core-years, 3.5 times less than the original study’s 1,380 ¹ ⁴. Even with a small controlled portion, such as a 32-byte hash, the agents found an algorithm estimated at roughly 1,600 times better than the prior best, and a second algorithm that makes each extra 1024-bit key about 30 times cheaper to factor in a batch ¹ ³.

The caveats matter. The key was not factored, which would take an estimated 500,000 to 1 million core-years. The signature attack needs around 4 billion signing queries and does not recover the private key. The 30-fold batch figure is a theoretical estimate that has not been implemented ¹. Modern systems using 2048-bit or larger keys are unaffected ¹ ³.

Image from securityweek.com — Image: securityweek.com

What the Same Tools Certified

The Signal project ran on a different mission but a similar philosophy. In about four weeks, as a proof of concept, DeepMind’s new AlphaProof Code framework helped mathematically verify core Signal guarantees, building on earlier formal verification work by the Signal Foundation ². Formal verification is long considered a holy grail of software security because it uses math, not testing, to show software does what it should.

Here is the detail that ties the two stories together. The analysis found no new vulnerabilities in the portions of the protocol it examined. But when pointed at older Signal versions with known, long-fixed flaws, it spotted them and showed those versions could not be verified ². A tool that can say yes only when yes is true is, by construction, also a tool that finds the no. Proving security and finding weakness are the same act of rigorous reasoning, seen from two sides.

Humans Still in the Loop

Neither story is a tale of machines running unsupervised. The RSA agents worked under human supervision, and the Signal team stresses a human-AI collaboration process in which agents self-correct but people review key steps. DeepMind researcher Swarat Chaudhuri rejected a world where AI generates both the goals and the proofs and grades itself ².

The scale questions are also open. DeepMind did the Signal work free as research, Google declined to share its cost or say whether a commercial product is planned, and the proof did not cover the entire mobile app ². On the RSA side, the researchers argue the real significance is how fast AI-assisted research can move a field that normally advances slowly ⁴.

Image from interestingengineering.com — Image: interestingengineering.com

Hardness Is Not a Fixed Assumption

Pushmeet Kohli put the shared lesson plainly: in an era of AI-enabled mathematics, cryptographic hardness cannot be treated as a fixed assumption, and using AI to test old beliefs is how modern encryption stays secure ¹. The stories do not share a technical link. The RSA work is about attack costs on an obsolete key size, and the Signal work is about verifying a protocol implementation. What they share is the engine and the stance.

That is the emotional core. The same AI that shrinks a decades-old safety margin can also give banks and others a way to say they can prove their properties, in Kohli’s framing ². Going forward, security will likely be decided by who points these agents first: at the weaknesses, or at the proofs. Defenders now have both options.

Companies mentioned: Google (GOOGL $288.15 ▲1.2%) • DeepMind

Primary sources

Google DeepMind’s AI Agents Make 1024-Bit RSA Keys Cheaper to Attack (securityweek.com) – SecurityWeek's report on DeepMind's RSA-1024 research, done with UC San Diego and Inria cryptographers. It explains that padding gives no protection once an attacker controls about half the signed block, that agents reproduced a forgery in under four days with 391 core-years (3.5 times less than before), that a 32-byte-hash case improves by roughly 1,600 times, and that batch factoring gets about 30 times cheaper per key in theory. It lists limits (no key factored, about 4 billion queries, no implementation of the batch method) and quotes Pushmeet Kohli on 2048-bit keys staying safe. Published by SecurityWeek.
A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure (wired.com) – Wired's account of DeepMind researchers using agentic AI and a new framework, AlphaProof Code, to formally verify key guarantees of the Signal protocol in four weeks. It found no new flaws but flagged known old ones in earlier versions, was limited in scope (not the whole mobile app), leaned on prior Signal Foundation verification work, and is releasing its specification and proof. It covers the human-AI collaboration approach, Signal CTO Ehren Kret's comments, and open questions on cost and scaling. Published by Wired.

Further sources

1,600x faster: Google DeepMind agents expose weaknesses in older encryption methods (interestingengineering.com) – Interesting Engineering's coverage of Pushmeet Kohli's announcement of the RSA findings. It describes the padding result, the sandbox validation with 3.5 times less CPU time, the roughly 1,600-fold theoretical gain for small controlled input, and the 30-fold batch factoring gain. It says modern encryption is unaffected, names Dj Dvijotham and Abhradeep Thakurta as leads, and frames AI cryptanalysis as a stress-testing tool.
Faster Affine Root and a 1024bit Computation (storage.googleapis.com) – The DeepMind working paper 'Modular Roots from a Restricted Oracle: Faster Affine Roots and a 1024-bit Computation', with authors including Dvijotham, Heninger, Kohli, Thakurta, Thomé and others. It studies e-th roots modulo N with an oracle, shows the format constraint stops mattering once the variable part reaches about half a block (so PKCS#1 v1.5 with more than half a block or a 64-byte digest at 1024 bits is no harder than the unrestricted case), improves the cost of the affine problem through multi-stage early abort and a factor-base extension, and reports a reproduction taking 391 core-years, 3.5 times less than the original. It states results do not threaten 2048-bit or larger RSA.

Crossover: Google DeepMind’s AI Cracked Open RSA-1024 Defenses and Proved the Signal Protocol Sound