DeepMind’s 1024-bit run: check 391 vs 1,380 core-years and “2048+ unaffected,” not “modern RSA is broken”

The Google DeepMind working paper keeps the question narrow: after temporary access to an e-th root oracle, how much easier is computing e-th roots modulo N; an affine oracle accepts only a short variable offset inside a fixed format, modeling common signing interfaces. The paper also gives a faster affine algorithm and a full unrestricted-oracle reproduction at 1024 bits.

Google DeepMind’s X post (2026-11-06) framed the news as models, guided by humans, uncovering two major weaknesses in legacy 1024-bit RSA cryptosystems, while stating modern 2048-bit systems remain safe from these specific exploits. What to check is the PDF’s measurements and Important box, not reading “AI accelerates cryptanalysis” as “deployed RSA is down.”

Hard facts (PDF: https://storage.googleapis.com/deepmind-media/papers/Faster_Affine_Root_and_a_1024bit%20Computation.pdf; CreationDate 2026-11-06; Working Paper; accessed Asia/Shanghai same day):

• Model: an offline phase may query an e-th root oracle; the oracle is then withdrawn; the online phase must output t^(1/e) mod N for random targets. Queries are chosen before targets are known, so the model is non-adaptive. An unrestricted oracle accepts every residue; an affine oracle accepts only c+z with |z|≤Z.
• Format threshold: for every fixed c, once the variable window holds about √N offsets, the affine oracle simulates the unrestricted one with two queries per query. Mapped to PKCS#11: CKM_RSA_PKCS with long data (more than about half a block at 1024 bits, or a 64-byte digest at the threshold) is no harder than the unrestricted case; a 32-byte digest stays harder (affine); mechanisms that hash inside the device sit outside both models.
• Affine algorithm: cost of one root including the offline phase falls from L_N[1/3, 1.8171] to L_N[1/3, 1.5803]; with a larger offline phase at L[1.6373], online cost per root approaches L[1.3867]. Gains come from optimal multi-stage early abort and a factor-base extension that uses only admissible inputs.
• 1024-bit reproduction: on the same modulus, polynomials, and factor-base bounds as Shea, Haller, Suhl, Heninger, and Thomé [SHS+26], the first root took 391 CPU core-years (318 offline + 73 online) against 1,380 reported earlier (1,200 + 180), about 3.5× less. Factoring that modulus is estimated at 500,000 to 1,000,000 core-years. The authors state the 3.5× factor is implementation and execution, not a new algorithm.
• Agent setup (Section 6): supervisor Model A wrote the design, set checkpoints, and audited results; executor Model B wrote code, ran distributed jobs, and fixed failures. The human chose the problem and instance and approved irreversible steps, wrote no code, launched no job, and diagnosed no fault. About 33,500 lines of new code in 19 changes, 336 distributed experiments; up to about 300,000 CPU cores and 16 GPUs; 3.2 days from the first full-scale sieving job (versus about five months for the prior work; the authors say the calendar gap mainly reflects parallelism).
• Important box: the results do not threaten deployed cryptosystems today based on 2048-bit and larger RSA. The main significance is a sharper picture of what older signature standards can resist, and how quickly AI-assisted research can move the field.

Evidence strength: the threshold theorems for every fixed c are unconditional in the proved range; the exact half-bit window at 1024 bits rests on measurement (Figure 4); AMR costs rest on standard number-field-sieve heuristics. The 1024-bit core-year figures and the agent line counts and experiment counts are in the paper body and tables and can be matched to the PDF.

How to test it: check Table 2’s 391 versus 1,380; read the Important box and the Discussion line that modern RSA deployment security is unchanged; check that PKCS#11 mechanisms are still classified by how many bits the caller chooses. If independent teams cannot approach a 391-core-year-class run on the same instance, or if the authors withdraw the “2048+ unaffected” limit, revise the extrapolation.

Steelman: treating “how many bits of each input the caller chooses” as a property of the standard is harder than only checking whether implementations follow the text. Having agents finish the same algorithm and surface faults such as a 32-bit index overflow also shows that reproduction itself can expose implementation risk.

Strongest steelman: legacy 1024-bit keys and old padding formats still survive in some environments; measuring their real cost helps set migration priority. The authors put device-internal hashing outside both oracle models, which avoids treating a lab interface as every deployment.

Steelman risk: this is a working paper, not a final peer-reviewed version. The attack model needs about 4×10^9 chosen queries before the target is known; many real signing interfaces cannot offer that offline batch. The 3.2-day calendar figure mainly reflects parallelism; it should not be read alone as “the algorithm suddenly got three orders of magnitude easier.” AMR below the half-window remains unrun at cryptographic size; the authors list that as an open problem.

For crypto engineers and standards owners, the next six months to watch are faster migration pressure on surviving 1024-bit and long-data PKCS#1 v1.5 interfaces; whether other teams can reproduce core-year-class runs on the same instance; and whether any cryptographic-size AMR experiment appears for θ<1/2 windows. For readers, the check is 391 versus 1,380, the agent process description, and the Important box, not “AI already broke modern RSA.”

What to check in this working paper is the affine threshold, the faster AMR cost, and the same-instance 391 versus 1,380 core-year reproduction, plus the authors’ stated limit: today’s 2048-bit and larger RSA is not threatened; not “AI already toppled deployed crypto.” Two supervised agents finishing the full computation is a checkable process fact. Reading it as modern public-key failure leaves the source behind.

【No.2】