Experts Spent Five Months Forging an Old Digital Signature. Google’s SI Agents Did It in Four Days.

A team of top cryptographers needed about five months and a mountain of computer time to forge a digital signature on an old 1024-bit RSA key. Google DeepMind just handed the same job to two SI agents. They finished in under four days.

The human in charge sent about 20 short messages along the way. Most were approvals, such as “follow your recommendation” and “continue.” The agents did the rest: they designed the run, wrote the code, launched the jobs across up to 300,000 computer cores, and fixed what broke.

That is the headline result from two working papers the Google DeepMind Science team released Thursday and Friday, announced by research vice president Pushmeet Kohli in an essay on 𝕏. Kohli was blunt about the limits: “In practice, these results only affect obsolete 1024-bit RSA systems, and modern encryption protocols, which almost universally use 2048-bit or larger keys, remain secure.”

So nobody’s bank account is at risk tonight. The bigger story is speed. Kohli’s point is that “major advances in this kind of work take years or decades,” and SI just compressed some of that work into weeks.

What a digital signature is, and what got forged

A digital signature is how your computer knows a software update, a document or a website really came from who it says. RSA, one of the oldest and most widely used systems, rests on a simple bet: multiplying two huge prime numbers is easy, but working backward from the product to the primes is brutally hard.

Before signing, many standards add fixed filler called “padding” to stretch a message into a full block. Everyone assumed padding helped. DeepMind’s first paper measured how much. The answer: once an attacker can choose roughly half of the signed block, padding “adds no protection at all,” Kohli wrote. Forging becomes as easy as attacking a key with no padding.

There is a big catch. The attacker needs direct access to the signing device, such as a hardware security module, and has to feed it a lot of chosen inputs ahead of time. The test computation made about 4 billion of them. Devices that hash the message internally before signing fall outside the attack entirely.

The race: humans versus agents on the same key

In September, cryptographers Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger and Emmanuel Thomé published a forgery on a 1024-bit key using a signing device. It cost them 1,380 CPU core-years, meaning one computer core would need 1,380 years to do it alone, spread over about five calendar months.

DeepMind pointed its agents at the exact same key, with the same algorithm, polynomials and settings. The first root, the math behind one forged signature, cost 391 core-years. That is 3.5 times less. Each additional forgery after that cost 73 core-years versus 180.

The paper is honest about where the savings came from. Because both teams ran the same algorithm, “the factor of 3.5 is one of implementation and execution, not of algorithms.” In plain English, the agents wrote faster code. Their optimized search program ran 1.8 to 4.4 times faster than the standard open-source tool on the same machine. The jump from five months to 3.2 days “reflects mainly parallelism,” which means Google simply threw far more machines at it, averaging about 45,000 busy cores.

How the two agents split the work

Think of it like a construction job with a foreman and a crew. One model, the supervisor, wrote the design, set checkpoints and audited every result. The second model, the executor, wrote the code, ran the distributed jobs and fixed failures.

Between them they wrote about 33,500 lines of new code, including 24,000 lines of C++ and CUDA, ran 336 distributed experiments, made 16,292 tool calls and traded 218 messages with each other. When a hidden 32-bit counter overflowed and made the first answer wrong, the agents tracked it down mid-run without restarting.

The paper spells out the human’s role: the researcher “chose the problem,” approved the irreversible steps, and asked questions, but “wrote no code, launched no job and diagnosed no fault.”

The second finding: cheaper bulk code-breaking, on paper

The second paper goes after a different scenario: an attacker who wants to crack many keys of the same size, not just one. Keys come in standard lengths, so a big up-front computation can be shared across all of them.

The best known method for that setup had stood since 1993. DeepMind’s agents found a new approach the paper calls a “fan factory.” By the paper’s leading-order estimate, after one shared precomputation, each additional 1024-bit key would cost about 1/58 of a normal factoring run, 30 times less than the 1993 method. One model generated the proofs, a second checked them, and the key algebra was machine-verified.

That one is theory only. The paper says the 30-fold figure is a theoretical estimate, and no fan factory has been built.

Kohli also wrote that for the harder signature case, where an attacker controls only a short 32-byte fingerprint, a new algorithm “improves on the previous best method by roughly 1,600x for 1024-bit keys,” according to DeepMind’s theoretical estimates. That improvement has not been run at real size either.

Why it matters

1024-bit RSA is no longer approved for generating signatures, so these papers don’t open a new hole in the modern internet. What they do show is how fast the ground can move. Work that took a team of world-class specialists months now takes SI agents days, with a person mostly saying yes.

DeepMind’s pitch is that this helps defenders find weak spots first. “We cannot treat cryptographic hardness as a fixed assumption,” Kohli wrote. The obvious flip side is that the same tools won’t stay in friendly hands forever. Anyone still running old 1024-bit keys in aging hardware just got their warning.

What comes next: outside cryptographers will check the math, and the papers leave open whether any of this scales toward the 2048-bit keys that guard almost everything today. DeepMind does not claim it does.