AI and cryptography · Primary papers checked November 8, 2026
A claim that AI has made RSA attacks faster needs three follow-up questions: what capability did the attacker already have, what work was actually measured, and which costs were left outside the headline? Two Google DeepMind working papers provide a useful case study. They report progress in cryptanalysis involving legacy 1024-bit RSA, while explicitly saying the results do not threaten deployed RSA systems using keys of 2048 bits or more today.
The sources describe different problems. Modular Roots from a Restricted Oracle combines theoretical results with a large computation. Fan Factories, dated November 5, proposes theoretical improvements for factoring many integers. Both are working papers. The first has no visible publication date; this article uses the versions checked above rather than assigning it an inferred release date.
What the large computation measured
The first paper reproduces a known 1024-bit modular-root computation using a restricted oracle: a program that answers certain mathematical queries. It reports 391 CPU core-years, compared with 1,380 in the earlier implementation. A core-year means one processor core working for a year; many cores can perform that work in parallel.
The comparison used the same instance, algorithm, polynomials and bounds. The roughly 3.5-fold improvement therefore reflects implementation and execution, rather than a new asymptotic algorithm. The 391 figure excludes a separately reported GPU stage and preliminary probes. The authors give a more conservative comparison of about 3.3-fold when they include probes and charge that stage at the earlier CPU cost.
Elapsed time was about 3.2 days from the start of full-scale sieving, with peaks around 300,000 CPU cores and 16 GPUs. That calendar-time result depends heavily on parallel resources. It is not evidence that an ordinary desktop can do the same work in a weekend.
The oracle is part of the security model
The experiment used about 4.06 billion oracle queries before the target was selected. The oracle itself knew the factorization; the subsequent computation had no oracle access. The result demonstrates root extraction under that model. It did not factor the RSA modulus or recover its private key.
That distinction matters for signatures. The analysis concerns particular interfaces in which callers control values submitted for signing. A device that hashes the message internally is outside these oracle models. This research does not demonstrate a break of SHA-256 or SHA-512, or establish that every RSA signing service exposes the required capability.
The paper also develops a faster affine-root algorithm for shorter controllable inputs. That algorithm was not run at cryptographic size. Its projected improvements should stay in a separate column from the measured reproduction.
Why the “30 times faster” claim needs a qualifier
Fan Factories studies shared preparation that can lower the cost of factoring additional, similarly sized integers. Its roughly 30-fold figure for 1024-bit targets is a leading-order comparison with a previous multiple-number-field approach after shared precomputation. It leaves out unspecified lower-order factors and is not a measured running time.
No fan factory has been implemented, and the practical crossover remains unknown. The shared table is also enormous: roughly 275 pairs at leading order for 1024 bits. The paper’s batch variant without that stored preparation has a much smaller estimated gain. These costs prevent translating the headline into a cheap, demonstrated attack on one key.
Where AI helped
Human-guided AI agents handled much of the engineering in the 1024-bit reproduction, including implementing, testing, running and debugging the computation. A researcher chose the problem and instance and approved key conditions. In Fan Factories, agents helped develop the analysis and Lean 4 formalization. The machine checks cover algebraic identities and exact feasibility witnesses, not the unproven assumptions behind the runtime estimates.
A useful review for IT teams
- Identify the actual key and interface. Record key sizes, owners, protocols and whether a signer accepts caller-supplied digests or hashes messages internally. Avoid placing private keys or sensitive payloads in an inventory.
- Separate evidence levels. Label a result as measured, theoretical or independently reproduced. Record precomputation, queries, hardware and storage alongside the speedup.
- Review legacy dependencies deliberately. If 1024-bit RSA remains, work with the system owner on supported replacements and compatibility testing. This report alone is not a reason for an unplanned production change.
AI-assisted research is worth tracking because it can improve implementations and mathematical analysis. The operational lesson is to evaluate the complete attack model and resource bill. We reviewed the papers; we did not reproduce their computations or test a production signing system.