RSA numbers

In mathematics, the RSA numbers are a set of large semiprimes (numbers with exactly two prime factors) that were part of the RSA Factoring Challenge. The challenge was to find the prime factors of each number. It was created by RSA Laboratories in March 1991 to encourage research into computational number theory and the practical difficulty of factoring large integers. The challenge was ended in 2007.^[1]

RSA Laboratories (which is an initialism of the creators of the technique; Rivest, Shamir and Adleman) published a number of semiprimes with 100 to 617 decimal digits. Cash prizes of varying size, up to US$200,000 (and prizes up to $20,000 awarded), were offered for factorization of some of them. The smallest RSA number was factored in a few days. Most of the numbers have still not been factored and many of them are expected to remain unfactored for many years to come. As of February 2020^[update], the smallest 23 of the 54 listed numbers have been factored.

While the RSA challenge officially ended in 2007, people are still attempting to find the factorizations. According to RSA Laboratories, "Now that the industry has a considerably more advanced understanding of the cryptanalytic strength of common symmetric-key and public-key algorithms, these challenges are no longer active."^[2] Some of the smaller prizes had been awarded at the time. The remaining prizes were retracted.

The first RSA numbers generated, from RSA-100 to RSA-500, were labeled according to their number of decimal digits. Later, beginning with RSA-576, binary digits are counted instead. An exception to this is RSA-617, which was created before the change in the numbering scheme. The numbers are listed in increasing order below.

Note: until work on this article is finished, please check both the table and the list, since they include different values and different information.

name	decimal digits	bits	announcement		prize	number	factorization	first solver				notes
			date	by				date	algorithm	compute power	calendar time
RSA-100							40094690950920881030683735292761468389214899724061 * 37975227936943673922808872755445627854565536638199	1991-04-01	ppmpqs by Mark Manasse and Arjen K. Lenstra	approx. 7 MIP-Years		^[3]
RSA-110							6122421090493547576937037317561418841225758554253106999 * 5846418214406154678836553182979162384198610505601062333	1992-04-14	ppmpqs by Arjen K. Lenstra	one month on 5/8 of a 16K MasPar		^[3]
RSA-120							327414555693498015751146303749141488063642403240171463406883 * 693342667110830181197325401899700641361965863127336680673013	1993-06-09	ppmpqs	835 mips years run by Arjen K. Lenstra (45.503%), Bruce Dodson (30.271%), Thomas Denny (22.516%), Mark Manasse (1.658%), and Walter Lioen and Herman te Riele (0.049%)		^[3]
RSA-129	129		1977-08	Martin Gardner, Mathematical Games, Scientific American	$100	114381625757888867669235779976146612010218296721242362562561842935706935245733897830597123563958705058989075147599290026879543541	3490529510847650949147849619903898133417764638493387843990820577 * 32769132993266709549961988190834461413177642967992942539798288533	1994-04-26	ppmpqs	approximately 5000 mips years run by Derek Atkins, Michael Graff, Arjen K. Lenstra, Paul Leyland, and more than 600 volunteers		^[3]
RSA-130							39685999459597454290161126162883786067576449112810064832555157243 * 45534498646735972188403686897274408864356301263205069600999044599	1996-04-10	General Number Field Sieve with lattice sieving implementations by Bellcore, CWI, and Saarbruecken; and blocked Lanczos and square root by Peter L. Montgomery	sieving: estimated 500 mips years, run by Bruce Dodson (28.37%), Peter L. Montgomery and Marije Elkenbracht-Huizing (27.77%), Arjen K. Lenstra (19.11%), WWW contributors (17.17% ), Matt Fante (4.36%), Paul Leyland (1.66%), Damian Weber and Joerg Zayer (1.56%) matrix (67.5 hours on the Cray-C90 at SARA, Amsterdam) and square root (48 hours per dependency on an SGI Challenge processor) run by Peter L. Montgomery and Marije Elkenbracht-Huizing		the factorization was found in the third trial^[3]
RSA-140							3398717423028438554530123627613875835633986495969597423490929302771479 * 6264200187401285096151654948264442219302037178623509019111660653946049	1999-02-02	GNFS with line (by CWI; 45%) and lattice (by Arjen K. Lenstra; 55%) sieving, and a polynomial selection method by Brian Murphy and Peter L. Montgomery; and blocked Lanczos and square root by Peter L. Montgomery	polynomial selection: 2000 CPU hours on four 250 MHZ SGI Origin 2000 processors at CWI sieving: 8.9 CPU-years on about 125 SGI and Sun workstations running at 175 MHZ on average, and on about 60 PCs running at 300 MHZ on average; approximately equivalent to 1500 mips years; run by Peter L. Montgomery, Stefania Cavallar, Herman J.J. te Riele, and Walter M. Lioen (36.8%), Paul Leyland (28.8%), Bruce Dodson (26.6%), Paul Zimmermann (5.4%), and Arjen K. Lenstra (2.5%). matrix: 100 hours on the Cray-C916 at SARA, Amsterdam square root: four different dependencies were run in parallel on four 250 MHZ SGI Origin 2000 processors at CWI; three of them found the factors of RSA-140 after 14.2, 19.0 and 19.0 CPU-hours	eleven weeks (including four weeks for polynomial selection, one month for sieving, one week for data filtering and matrix construction, five days for the matrix, and 14.2 hours to find the factors using the square root)	the matrix had 4671181 rows and 4704451 columns and weight 151141999 (32.36 nonzeros per row)^[3]
RSA-155							102639592829741105772054196573991675900716567808038066803341933521790711307779 * 106603488380168454820927220360012878679207958575989291522270608237193062808643	1999-08-22	GNFS with line (29%) and lattice (71%) sieving, and a polynomial selection method written by Brian Murphy and Peter L. Montgomery, ported by Arjen Lenstra to use his multiple precision arithmetic code (LIP); and blocked Lanczos and square root by Peter L. Montgomery	polynomial selection run by Brian Murphy, Peter Montgomery, Arjen Lenstra and Bruce Dodson; Dodson found the one that was used sieving: 35.7 CPU-years in total, on about one hundred and sixty 175-400 MHz SGI and Sun workstations, eight 250 MHz SGI Origin 2000 processors, one hundred and twenty 300-450 MHz Pentium II PCs, and four 500 MHz Digital/Compaq boxes; approximately equivalent to 8000 mips years; run by Alec Muffett (20.1% of relations, 3057 CPU days), Paul Leyland (17.5%, 2092 CPU days), Peter L. Montgomery and Stefania Cavallar (14.6%, 1819 CPU days), Bruce Dodson (13.6%, 2222 CPU days), Francois Morain and Gerard Guillerm (13.0%, 1801 CPU days), Joel Marchand (6.4%, 576 CPU days), Arjen K. Lenstra (5.0%, 737 CPU days), Paul Zimmermann (4.5%, 252 CPU days), Jeff Gilchrist (4.0%, 366 CPU days), Karen Aardal (0.65%, 62 CPU days), and Chris and Craig Putnam (0.56%, 47 CPU days) matrix: 224 hours on one CPU of the Cray-C916 at SARA, Amsterdam square root: four 300 MHz R12000 processors of a 24-processor SGI Origin 2000 at CWI; the successful one took 39.4 CPU-hours and the others took 38.3, 41.9, and 61.6 CPU-hours	9 weeks for polynomial selection, plus 5.2 months for the rest (including 3.7 months for sieving, about 1 month for data filtering and matrix construction, and 10 days for the matrix)	the polynomials were 119377138320*x^5 - 80168937284997582*y*x^4 - 66269852234118574445*y^2*x^3 + 11816848430079521880356852*y^3*x^2 + 7459661580071786443919743056*y^4*x - 40679843542362159361913708405064*y^5 and x - 39123079721168000771313449081*y (this pair has a yield of relations approximately 13.5 times that of a random polynomial selection); 124722179 relations were collected in the sieving stage; the matrix had 6699191 rows and 6711336 columns and weight 417132631 (62.27 nonzeros per row).^[3]

RSA-100

RSA-100 has 100 decimal digits (330 bits). Its factorization was announced on April 1, 1991, by Arjen K. Lenstra.^[3][4] Reportedly, the factorization took a few days using the multiple-polynomial quadratic sieve algorithm on a MasPar parallel computer.^[5]

The value and factorization of RSA-100 are as follows:

RSA-100 = 1522605027922533360535618378132637429718068114961380688657908494580122963258952897654000350692006139 

RSA-100 = 37975227936943673922808872755445627854565536638199 × 40094690950920881030683735292761468389214899724061 

It takes four hours to repeat this factorization using the program Msieve on a 2200 MHz Athlon 64 processor.

The number can be factorized in 72 minutes on overclocked to 3.5 GHz Intel Core2 Quad q9300, using GGNFS and Msieve binaries running by distributed version of the factmsieve Perl script.^[6]

RSA-110

RSA-110 has 110 decimal digits (364 bits), and was factored in April 1992 by Arjen K. Lenstra and Mark S. Manasse in approximately one month.^[4][5]

The number can be factorized in less than four hours on overclocked to 3.5 GHz Intel Core2 Quad q9300, using GGNFS and Msieve binaries running by distributed version of the factmsieve Perl script.^[6]

The value and factorization are as follows:

RSA-110 = 35794234179725868774991807832568455403003778024228226193532908190484670252364677411513516111204504060317568667 

RSA-110 = 6122421090493547576937037317561418841225758554253106999 × 5846418214406154678836553182979162384198610505601062333 

RSA-120

RSA-120 has 120 decimal digits (397 bits), and was factored in June 1993 by Thomas Denny, Bruce Dodson, Arjen K. Lenstra, and Mark S. Manasse.^[7] The computation took under three months of actual computer time.

The value and factorization are as follows:

RSA-120 = 227010481295437363334259960947493668895875336466084780038173258247009162675779735389791151574049166747880487470296548479 

RSA-120 = 327414555693498015751146303749141488063642403240171463406883 × 693342667110830181197325401899700641361965863127336680673013 

RSA-129

RSA-129, having 129 decimal digits (426 bits), was not part of the 1991 RSA Factoring Challenge, but rather related to Martin Gardner's Mathematical Games column in the August 1977 issue of Scientific American.^[3]

RSA-129 was factored in April 1994 by a team led by Derek Atkins, Michael Graff, Arjen K. Lenstra and Paul Leyland, using approximately 1600 computers^[8] from around 600 volunteers connected over the Internet.^[9] A US$100 token prize was awarded by RSA Security for the factorization, which was donated to the Free Software Foundation.

The value and factorization are as follows:

RSA-129 = 114381625757888867669235779976146612010218296721242362562561842935706935245733897830597123563958705058989075147599290026879543541 

RSA-129 = 3490529510847650949147849619903898133417764638493387843990820577 × 32769132993266709549961988190834461413177642967992942539798288533 

The factorization was found using the Multiple Polynomial Quadratic Sieve algorithm.

The factoring challenge included a message encrypted with RSA-129. When decrypted using the factorization the message was revealed to be "The Magic Words are Squeamish Ossifrage".

In 2015, RSA-129 was factored in about one day, with the CADO-NFS open source implementation of number field sieve, using a commercial cloud computing service for about $30.^[10]

RSA-130

RSA-130 has 130 decimal digits (430 bits), and was factored on April 10, 1996, by a team led by Arjen K. Lenstra and composed of Jim Cowie, Marije Elkenbracht-Huizing, Wojtek Furmanski, Peter L. Montgomery, Damian Weber and Joerg Zayer.^[11]

The value and factorization are as follows:

RSA-130 = 1807082088687404805951656164405905566278102516769401349170127021450056662540244048387341127590812303371781887966563182013214880557 

RSA-130 = 39685999459597454290161126162883786067576449112810064832555157243 × 45534498646735972188403686897274408864356301263205069600999044599 

The factorization was found using the Number Field Sieve algorithm and the polynomial

 5748302248738405200 x5 + 9882261917482286102 x4 - 13392499389128176685 x3 + 16875252458877684989 x2 + 3759900174855208738 x1 - 46769930553931905995 

which has a root of 12574411168418005980468 modulo RSA-130.

RSA-140

RSA-140 has 140 decimal digits (463 bits), and was factored on February 2, 1999, by a team led by Herman te Riele and composed of Stefania Cavallar, Bruce Dodson, Arjen K. Lenstra, Paul Leyland, Walter Lioen, Peter L. Montgomery, Brian Murphy and Paul Zimmermann.^[12][13]

The value and factorization are as follows:

RSA-140 = 21290246318258757547497882016271517497806703963277216278233383215381949984056495911366573853021918316783107387995317230889569230873441936471 

RSA-140 = 3398717423028438554530123627613875835633986495969597423490929302771479 × 6264200187401285096151654948264442219302037178623509019111660653946049 

The factorization was found using the Number Field Sieve algorithm and an estimated 2000 MIPS-years of computing time.

RSA-150

RSA-150 has 150 decimal digits (496 bits), and was withdrawn from the challenge by RSA Security. RSA-150 was eventually factored into two 75-digit primes by Aoki et al. in 2004 using the general number field sieve (GNFS), years after bigger RSA numbers that were still part of the challenge had been solved.

The value and factorization are as follows:

RSA-150 = 155089812478348440509606754370011861770654545830995430655466945774312632703463465954363335027577729025391453996787414027003501631772186840890795964683 

RSA-150 = 348009867102283695483970451047593424831012817350385456889559637548278410717 × 445647744903640741533241125787086176005442536297766153493419724532460296199 

RSA-155

RSA-155 has 155 decimal digits (512 bits), and was factored on August 22, 1999, in a span of six months, by a team led by Herman te Riele and composed of Stefania Cavallar, Bruce Dodson, Arjen K. Lenstra, Walter Lioen, Peter L. Montgomery, Brian Murphy, Karen Aardal, Jeff Gilchrist, Gerard Guillerm, Paul Leyland, Joel Marchand, François Morain, Alec Muffett, Craig Putnam, Chris Putnam and Paul Zimmermann.^[14][15]

The value and factorization are as follows:

RSA-155 = 10941738641570527421809707322040357612003732945449205990913842131476349984288934784717997257891267332497625752899781833797076537244027146743531593354333897 

RSA-155 = 1026395928297411057720541965739916759007165678080380668033419335217907113077  79 × 1066034883801684548209272203600128786792079585759892915222706082371930628086  43 

The factorization was found using the general number field sieve algorithm and an estimated 8000 MIPS-years of computing time.

RSA-160

RSA-160 has 160 decimal digits (530 bits), and was factored on April 1, 2003, by a team from the University of Bonn and the German Federal Office for Information Security (BSI). The team contained J. Franke, F. Bahr, T. Kleinjung, M. Lochter, and M. Böhm.^[16][17]

The value and factorization are as follows:

RSA-160 = 2152741102718889701896015201312825429257773588845675980170497676778133145218859135673011059773491059602497907111585214302079314665202840140619946994927570407753 

RSA-160 = 4542789285848139407168619064973883165613714577846979325095998470925000415733  5359 × 4738809060383201619663383230378895197326892292104095794474135464881202849390  9367 

The factorization was found using the general number field sieve algorithm.

RSA-170

RSA-170 has 170 decimal digits (563 bits) and was first factored on December 29, 2009, by D. Bonenberger and M. Krone from Fachhochschule Braunschweig/Wolfenbüttel.^[18] An independent factorization was completed by S. A. Danilov and I. A. Popovyan two days later.^[19]

The value and factorization are as follows:

RSA-170 = 26062623684139844921529879266674432197085925380486406416164785191859999628542069361450283931914514618683512198164805919882053057222974116478065095809832377336510711545759 

RSA-170 = 3586420730428501486799804587268520423291459681059978161140231860633948450858  040593963 × 7267029064107019078863797763923946264136137803856996670313708936002281582249  587494493 

The factorization was found using the general number field sieve algorithm.

RSA-576

RSA-576 has 174 decimal digits (576 bits), and was factored on December 3, 2003, by J. Franke and T. Kleinjung from the University of Bonn.^[20][21][22] A cash prize of $10,000 was offered by RSA Security for a successful factorization.

The value and factorization are as follows:

RSA-576 = 188198812920607963838697239461650439807163563379417382700763356422988859715234665485319060606504743045317388011303396716199692321205734031879550656996221305168759307650257059 

RSA-576 = 3980750864240649373971255005503864911990643623425267084063851895759463889572  61768583317 × 4727721461074353025362230719730482246329146953020971164598521711305207112563  63590397527 

The factorization was found using the general number field sieve algorithm.

RSA-180

RSA-180 has 180 decimal digits (596 bits), and was factored on May 8, 2010, by S. A. Danilov and I. A. Popovyan from Moscow State University, Russia.^[23]

RSA-180 = 1911479277189866096892294666314546498129862462766673548641885036388072607034  3679905877620136513516127813425829612810920004670291298456875280033022177775  2773957404540495707851421041 

RSA-180 = 4007800823297508779525813391041005725268293178158071765648821789984975727719  50624613470377 × 4769396887386118369955354773570708579399020760277882320319897758246062255957  73435668861833 

The factorization was found using the general number field sieve algorithm implementation running on three Intel Core i7 PCs.

RSA-190

RSA-190 has 190 decimal digits (629 bits), and was factored on November 8, 2010, by I. A. Popovyan from Moscow State University, Russia, and A. Timofeev from CWI, Netherlands.^[24]

RSA-190 = 1907556405060696491061450432646028861081179759533184460647975622318915025587  1841757540549761551215932934922604641526300932385092466032074171247261215808  58185985938946945490481721756401423481 

RSA-190 = 3171195257690152709485171289740475929805147316029450327784761927832793642798  1256542415724309619 × 6015260020444561641587641685526676183243543359471811072599763828083615704046  0481625355619404899 

RSA-640

RSA-640 has 193 decimal digits (640 bits). A cash prize of US$20,000 was offered by RSA Security for a successful factorization. On November 2, 2005, F. Bahr, M. Boehm, J. Franke and T. Kleinjung of the German Federal Office for Information Security announced that they had factorized the number using GNFS as follows:^[25][26][27]

RSA-640 = 3107418240490043721350750035888567930037346022842727545720161948823206440518  0815045563468296717232867824379162728380334154710731085019195485290073377248  22783525742386454014691736602477652346609 

RSA-640 = 1634733645809253848443133883865090859841783670033092312181110852389333100104  508151212118167511579 × 1900871281664822113126851573935413975471896789968515493666638539088027103802  104498957191261465571 

The computation took five months on 80 2.2 GHz AMD Opteron CPUs.

The slightly larger RSA-200 was factored in May 2005 by the same team.

RSA-200

 

Wikinews has related news:

• Two hundred digit number factored

RSA-200 has 200 decimal digits (663 bits), and factors into the two 100-digit primes given below.

On May 9, 2005, F. Bahr, M. Boehm, J. Franke, and T. Kleinjung announced^[28][29] that they had factorized the number using GNFS as follows:

RSA-200 = 2799783391122132787082946763872260162107044678695542853756000992932612840010  7609345671052955360856061822351910951365788637105954482006576775098580557613  579098734950144178863178946295187237869221823983 

RSA-200 = 3532461934402770121272604978198464368671197400197625023649303468776121253679  423200058547956528088349 × 7925869954478333033347085841480059687737975857364219960734330341455767872818  152135381409304740185467 

The CPU time spent on finding these factors by a collection of parallel computers amounted – very approximately – to the equivalent of 75 years work for a single 2.2 GHz Opteron-based computer.^[28] Note that while this approximation serves to suggest the scale of the effort, it leaves out many complicating factors; the announcement states it more precisely.

RSA-210

RSA-210 has 210 decimal digits (696 bits) and was factored in September 2013 by Ryan Propper:^[30]

RSA-210 = 2452466449002782119765176635730880184670267876783327597434144517150616008300  3858721695220839933207154910362682719167986407977672324300560059203563124656  1218465817904100131859299619933817012149335034875870551067 

RSA-210 = 4359585683259407917999519653872144063854709102652201963187054821445240853452  75999740244625255428455944579 × 5625457617268841037562770073044474817438769440075105451049468510945483965774  79473472146228550799322939273 

RSA-704

RSA-704 has 212 decimal digits (704 bits), and was factored by Shi Bai, Emmanuel Thomé and Paul Zimmermann.^[31] The factorization was announced July 2, 2012.^[32] A cash prize of US$30,000 was previously offered for a successful factorization.

RSA-704 = 7403756347956171282804679609742957314259318888923128908493623263897276503402  8266276891996419625117843995894330502127585370118968098286733173273108930900  552505116877063299072396380786710086096962537934650563796359 

RSA-704 = 9091213529597818878440658302600437485892608310328358720428512168960411528640  933367824950788367956756806141 × 8143859259110045265727809126284429335877899002167627883200914172429324360133  004116702003240828777970252499 

RSA-220

RSA-220 has 220 decimal digits (729 bits), and was factored by S. Bai, P. Gaudry, A. Kruppa, E. Thomé and P. Zimmermann. The factorization was announced on May 13, 2016.^[33]

RSA-220 = 2260138526203405784941654048610197513508038915719776718321197768109445641817  9666766085931213065825772506315628866769704480700018111497118630021124879281  99487482066070131066586646083327982803560379205391980139946496955261 

RSA-220 = 6863656412267566274382371499288437800130842239979164844621244993321541061441  4642667938213644208420192054999687 × 3292907439486349812049301549212935291916455196536233952462686051169290349309  4652463337824866390738191765712603 

RSA-230

RSA-230 has 230 decimal digits (762 bits), and was factored by Samuel S. Gross on August 15, 2018.^[34]

RSA-230 = 1796949159794106673291612844957324615636756180801260007088891883553172646034  1490933493372247868650755230855864199929221814436684722874052065257937495694  3483892631711525225256544109808191706117425097024407180103648316382885188526  89 

RSA-230 = 4528450358010492026612439739120166758911246047493700040073956759261590397250  033699357694507193523000343088601688589 × 3968132623150957588532394439049887341769533966621957829426966084093049516953  598120833228447171744337427374763106901 

RSA-232

RSA-232 has 232 decimal digits (768 bits), and was factored on February 17, 2020, by N. L. Zamarashkin, D. A. Zheltkov and S. A. Matveev.^[35][36][37]

RSA-232 = 1009881397871923546909564894309468582818233821955573955141120516205831021338  5285453743661097571543636649133800849170651699217015247332943892702802343809  6090980497644054071120196541074755382494867277137407501157718230539834060616  2079 

RSA-232 = 2966909333208360660361779924242630634742946262521852394401857157419437019472  3262390744910112571804274494074452751891 × 3403816175197563438006609498491521420547121760734723172735163413276050706174  8526506443144325148088881115083863017669 

RSA-768

RSA-768 has 232 decimal digits (768 bits), and was factored on December 12, 2009, over the span of two years, by Thorsten Kleinjung, Kazumaro Aoki, Jens Franke, Arjen K. Lenstra, Emmanuel Thomé, Pierrick Gaudry, Alexander Kruppa, Peter Montgomery, Joppe W. Bos, Dag Arne Osvik, Herman te Riele, Andrey Timofeev, and Paul Zimmermann.^[38]

RSA-768 = 1230186684530117755130494958384962720772853569595334792197322452151726400507  2636575187452021997864693899564749427740638459251925573263034537315482685079  1702612214291346167042921431160222124047927473779408066535141959745985690214  3413 

RSA-768 = 3347807169895689878604416984821269081770479498371376856891243138898288379387  8002287614711652531743087737814467999489 × 3674604366679959042824463379962795263227915816434308764267603228381573966651  1279233373417143396810270092798736308917 

The CPU time spent on finding these factors by a collection of parallel computers amounted approximately to the equivalent of almost 2000 years of computing on a single-core 2.2 GHz AMD Opteron-based computer.^[38]

RSA-240

RSA-240 has 240 decimal digits (795 bits), and was factored in November 2019 by Fabrice Boudot, Pierrick Gaudry, Aurore Guillevic, Nadia Heninger, Emmanuel Thomé and Paul Zimmermann.^[39]

RSA-240 = 1246203667817187840658350446081065904348203746516788057548187888832896668011  8821085503603957027250874750986476843845862105486553797025393057189121768431  8286362846948405301614416430468066875699415246993185704183030512549594371372  159029236099 

RSA-240 = 5094359522858399145550510235808437141326483820241114731866602965218212064697  46700620316443478873837606252372049619334517 × 2446242088383181505678131390240028966538020925789314014520412213365584770951  78155258218897735030590669041302045908071447 

The CPU time spent on finding these factors amounted to approximately 900 core-years on a 2.1 GHz Intel Xeon Gold 6130 CPU. Compared to the factorization of RSA-768, the authors estimate that better algorithms sped their calculations by a factor of 3–4 and faster computers sped their calculation by a factor of 1.25–1.67.

RSA-250

RSA-250 has 250 decimal digits (829 bits), and was factored in February 2020 by Fabrice Boudot, Pierrick Gaudry, Aurore Guillevic, Nadia Heninger, Emmanuel Thomé, and Paul Zimmermann. The announcement of the factorization occurred on February 28.

RSA-250 = 2140324650240744961264423072839333563008614715144755017797754920881418023447  1401366433455190958046796109928518724709145876873962619215573630474547705208  0511905649310668769159001975940569345745223058932597669747168173806936489469  9871578494975937497937 

RSA-250 = 6413528947707158027879019017057738908482501474294344720811685963202453234463  0238623598752668347708737661925585694639798853367 × 3337202759497815655622601060535511422794076034476755466678452098702384172921  0037080257448673296881877565718986258036932062711 

The factorisation of RSA-250 utilised approximately 2700 CPU core-years, using a 2.1 GHz Intel Xeon Gold 6130 CPU as a reference. The computation was performed with the Number Field Sieve algorithm, using the open source CADO-NFS software.

The team dedicated the computation to Peter Montgomery, an American mathematician known for his contributions to computational number theory and cryptography who died on February 18, 2020, and had contributed to factoring RSA-768.^[40]

RSA-260

RSA-260 has 260 decimal digits (862 bits), and has not been factored so far.

RSA-260 = 2211282552952966643528108525502623092761208950247001539441374831912882294140  2001986512729726569746599085900330031400051170742204560859276357953757185954  2988389587092292384910067030341246205457845664136645406842143612930176940208  46391065875914794251435144458199 

RSA-270

RSA-270 has 270 decimal digits (895 bits), and has not been factored so far.

RSA-270 = 2331085303444075445276376569106805241456198124803054490429486119684959182451  3578286788836931857711641821391926857265831491306067262691135402760979316634  1626693946596196427744273886601876896313468704059066746903123910748277606548  649151920812699309766587514735456594993207 

RSA-896

RSA-896 has 270 decimal digits (896 bits), and has not been factored so far. A cash prize of $75,000 was previously offered for a successful factorization.

RSA-896 = 4120234369866595438555313653325759481798116998443279828454556264338764455652  4842619809887042316184187926142024718886949256093177637503342113098239748515  0944909106910269861031862704114880866970564902903653658867433731720813104105  190864254793282601391257624033946373269391 

RSA-280

RSA-280 has 280 decimal digits (928 bits), and has not been factored so far.

RSA-280 = 1790707753365795418841729699379193276395981524363782327873718589639655966058  5783742549640396449103593468573113599487089842785784500698716853446786525536  5503525160280656363736307175332772875499505341538927978510751699922197178159  7724733184279534477239566789173532366357270583106789 

RSA-290

RSA-290 has 290 decimal digits (962 bits), and has not been factored so far.

RSA-290 = 3050235186294003157769199519894966400298217959748768348671526618673316087694  3419156362946151249328917515864630224371171221716993844781534383325603218163  2549201100649908073932858897185243836002511996505765970769029474322210394327  60575157628357292075495937664206199565578681309135044121854119 

RSA-300

RSA-300 has 300 decimal digits (995 bits), and has not been factored so far.

RSA-300 = 2769315567803442139028689061647233092237608363983953254005036722809375824714  9473946190060218756255124317186573105075074546238828817121274630072161346956  4396741836389979086904304472476001839015983033451909174663464663867829125664  459895575157178816900228792711267471958357574416714366499722090015674047 

RSA-309

RSA-309 has 309 decimal digits (1,024 bits), and has not been factored so far.

RSA-309 = 1332943998825757583801437794588036586217112243226684602854588261917276276670  5425540467426933349195015527349334314071822840746357352800368666521274057591  1870128339157499072351179666739658503429931021985160714113146720277365006623  6927218079163559142755190653347914002967258537889160429597714204365647842739  10949 

RSA-1024

RSA-1024 has 309 decimal digits (1,024 bits), and has not been factored so far. $100,000 was previously offered for factorization.

RSA-1024 = 135066410865995223349603216278805969938881475605667027524485143851526510604 859533833940287150571909441798207282164471551373680419703964191743046496589 274256239341020864383202110372958725762358509643110564073501508187510676594 629205563685529475213500852879416377328533906109750544334999811150056977236 890927563 

RSA-310

RSA-310 has 310 decimal digits (1,028 bits), and has not been factored so far.

RSA-310 = 1848210397825850670380148517702559371400899745254512521925707445580334710601  4125276757082979328578439013881047668984294331264191394626965245834649837246  5163148188847336415136873623631778358751846501708714541673402642461569061162  0116380982484120857688483676576094865930188367141388795454378671343386258291  687641 

RSA-320

RSA-320 has 320 decimal digits (1,061 bits), and has not been factored so far.

RSA-320 = 2136810696410071796012087414500377295863767938372793352315068620363196552357  8837094085435000951700943373838321997220564166302488321590128061531285010636  8571638978998117122840139210685346167726847173232244364004850978371121744321  8270343654835754061017503137136489303437996367224915212044704472299799616089  2591129924218437 

RSA-330

RSA-330 has 330 decimal digits (1,094 bits), and has not been factored so far.

RSA-330 = 1218708633106058693138173980143325249157710686226055220408666600017481383238  1352456802425903555880722805261111079089882303717632638856140900933377863089  0634828167900405006112727432172179976427017137792606951424995281839383708354  6364684839261149319768449396541020909665209789862312609604983709923779304217  01862444655244698696759267 

RSA-340

RSA-340 has 340 decimal digits (1,128 bits), and has not been factored so far.

RSA-340 = 2690987062294695111996484658008361875931308730357496490239672429933215694995  2758588771223263308836649715112756731997946779608413232406934433532048898585  9176676580752231563884394807622076177586625973975236127522811136600110415063  0004691128152106812042872285697735145105026966830649540003659922618399694276  990464815739966698956947129133275233 

RSA-350

RSA-350 has 350 decimal digits (1,161 bits), and has not been factored so far.

RSA-350 = 2650719995173539473449812097373681101529786464211583162467454548229344585504  3495841191504413349124560193160478146528433707807716865391982823061751419151  6068496555750496764686447379170711424873128631468168019548127029171231892127  2886825928263239383444398948209649800021987837742009498347263667908976501360  3382322972552204068806061829535529820731640151 

RSA-360

RSA-360 has 360 decimal digits (1,194 bits), and has not been factored so far.

RSA-360 = 2186820202343172631466406372285792654649158564828384065217121866374227745448  7764963889680817334211643637752157994969516984539482486678141304751672197524  0052350576247238785129338002757406892629970748212734663781952170745916609168  9358372359962787832802257421757011302526265184263565623426823456522539874717  61591019113926725623095606566457918240614767013806590649 

RSA-370

RSA-370 has 370 decimal digits (1,227 bits), and has not been factored so far.

RSA-370 = 1888287707234383972842703127997127272470910519387718062380985523004987076701  7212819937261952549039800018961122586712624661442288502745681454363170484690  7379449525034797494321694352146271320296579623726631094822493455672541491544  2700993152879235272779266578292207161032746297546080025793864030543617862620  878802244305286292772467355603044265985905970622730682658082529621 

RSA-380

RSA-380 has 380 decimal digits (1,261 bits), and has not been factored so far.

RSA-380 = 3013500443120211600356586024101276992492167997795839203528363236610578565791  8270750937407901898070219843622821090980641477056850056514799336625349678549  2187941807116344787358312651772858878058620717489800725333606564197363165358  2237779263423501952646847579678711825720733732734169866406145425286581665755  6977260763553328252421574633011335112031733393397168350585519524478541747311 

RSA-390

RSA-390 has 390 decimal digits (1,294 bits), and has not been factored so far.

RSA-390 = 2680401941182388454501037079346656065366941749082852678729822424397709178250  4623002472848967604282562331676313645413672467684996118812899734451228212989  1630084759485063423604911639099585186833094019957687550377834977803400653628  6955344904367437281870253414058414063152368812498486005056223028285341898040  0795447435865033046248751475297412398697088084321037176392288312785544402209  1083492089 

RSA-400

RSA-400 has 400 decimal digits (1,327 bits), and has not been factored so far.

RSA-400 = 2014096878945207511726700485783442547915321782072704356103039129009966793396  1419850865094551022604032086955587930913903404388675137661234189428453016032  6191193056768564862615321256630010268346471747836597131398943140685464051631  7519403149294308737302321684840956395183222117468443578509847947119995373645  3607109795994713287610750434646825511120586422993705980787028106033008907158  74500584758146849481 

RSA-410

RSA-410 has 410 decimal digits (1,360 bits), and has not been factored so far.

RSA-410 = 1965360147993876141423945274178745707926269294439880746827971120992517421770  1079138139324539033381077755540830342989643633394137538983355218902490897764  4412968474332754608531823550599154905901691559098706892516477785203855688127  0635069372091564594333528156501293924133186705141485137856845741766150159437  6063244163040088180887087028771717321932252992567756075264441680858665410918  431223215368025334985424358839 

RSA-420

RSA-420 has 420 decimal digits (1,393 bits), and has not been factored so far.

RSA-420 = 2091366302476510731652556423163330737009653626605245054798522959941292730258  1898373570076188752609749648953525484925466394800509169219344906273145413634  2427186266197097846022969248579454916155633686388106962365337549155747268356  4666583846809964354191550136023170105917441056517493690125545320242581503730  3405952887826925813912683942756431114820292313193705352716165790132673270514  3817744164107601735413785886836578207979 

RSA-430

RSA-430 has 430 decimal digits (1,427 bits), and has not been factored so far.

RSA-430 = 3534635645620271361541209209607897224734887106182307093292005188843884213420  6950355315163258889704268733101305820000124678051064321160104990089741386777  2424190744453885127173046498565488221441242210687945185565975582458031351338  2070785777831859308900851761495284515874808406228585310317964648830289141496  3289966226854692560410075067278840383808716608668377947047236323168904650235  70092246473915442026549955865931709542468648109541 

RSA-440

RSA-440 has 440 decimal digits (1,460 bits), and has not been factored so far.

RSA-440 = 2601428211955602590070788487371320550539810804595235289423508589663391270837  4310252674800592426746319007978890065337573160541942868114065643853327229484  5029942332226171123926606357523257736893667452341192247905168387893684524818  0307729497304959710847337973805145673263119916483529703607405432752966630781  2234597766390750441445314408171802070904072739275930410299359006059619305590  701939627725296116299946059898442103959412221518213407370491 

RSA-450

RSA-450 has 450 decimal digits (1,493 bits), and has not been factored so far.

RSA-450 = 1984634237142836623497230721861131427789462869258862089878538009871598692569  0078791591684242367262529704652673686711493985446003494265587358393155378115  8032447061155145160770580926824366573211993981662614635734812647448360573856  3132247491715526997278115514905618953253443957435881503593414842367096046182  7643434794849824315251510662855699269624207451365738384255497823390996283918  3287667419172988072221996532403300258906083211160744508191024837057033 

RSA-460

RSA-460 has 460 decimal digits (1,526 bits), and has not been factored so far.

RSA-460 = 1786856020404004433262103789212844585886400086993882955081051578507634807524  1464078819812169681394445771476334608488687746254318292828603396149562623036  3564554675355258128655971003201417831521222464468666642766044146641933788836  8932452217321354860484353296131403821175862890998598653858373835628654351880  4806362231643082386848731052350115776715521149453708868428108303016983133390  0416365515466857004900847501644808076825638918266848964153626486460448430073  4909 

RSA-1536

RSA-1536 has 463 decimal digits (1,536 bits), and has not been factored so far. $150,000 was previously offered for successful factorization.

RSA-1536 = 184769970321174147430683562020016440301854933866341017147178577491065169671 116124985933768430543574458561606154457179405222971773252466096064694607124 962372044202226975675668737842756238950876467844093328515749657884341508847 552829818672645133986336493190808467199043187438128336350279547028265329780 293491615581188104984490831954500984839377522725705257859194499387007369575 568843693381277961308923039256969525326162082367649031603655137144791393234 7169566988069 

RSA-470

RSA-470 has 470 decimal digits (1,559 bits), and has not been factored so far.

RSA-470 = 1705147378468118520908159923888702802518325585214915968358891836980967539803  6897711442383602526314519192366612270595815510311970886116763177669964411814  0957486602388713064698304619191359016382379244440741228665455229545368837485  5874455212895044521809620818878887632439504936237680657994105330538621759598  4047709603954312447692725276887594590658792939924609261264788572032212334726  8553025718835659126454325220771380103576695555550710440908570895393205649635  76770285413369 

RSA-480

RSA-480 has 480 decimal digits (1,593 bits), and has not been factored so far.

RSA-480 = 3026570752950908697397302503155918035891122835769398583955296326343059761445  7144169659817040125185215913853345598217234371231338324773210726853524776378  4105186549246199888070331088462855743520880671299302895546822695492968577380  7067958428022008294111984222973260208233693152589211629901686973933487362360  8129660418514569063995282978176790149760521395548532814196534676974259747930  6858645849268328985687423881853632604706175564461719396117318298679820785491  875674946700413680932103 

RSA-490

RSA-490 has 490 decimal digits (1,626 bits), and has not been factored so far.

RSA-490 = 1860239127076846517198369354026076875269515930592839150201028353837031025971  3738522164743327949206433999068225531855072554606782138800841162866037393324  6578171804201717222449954030315293547871401362961501065002486552688663415745  9758925793594165651020789220067311416926076949777767604906107061937873540601  5942747316176193775374190713071154900658503269465516496828568654377183190586  9537640698044932638893492457914750855858980849190488385315076922453755527481  1376719096144119390052199027715691 

RSA-500

RSA-500 has 500 decimal digits (1,659 bits) and has not been factored so far.

RSA-500 = 1897194133748626656330534743317202527237183591953428303184581123062450458870  7687605943212347625766427494554764419515427586743205659317254669946604982419  7301601038125215285400688031516401611623963128370629793265939405081077581694  4786041721411024641038040278701109808664214800025560454687625137745393418221  5494821277335671735153472656328448001134940926442438440198910908603252678814  7850601132077287172819942445113232019492229554237898606631074891074722425617  39680319169243814676235712934292299974411361 

RSA-617

RSA-617 has 617 decimal digits (2,048 bits) and has not been factored so far.

RSA-617 = 2270180129378501419358040512020458674106123596276658390709402187921517148311  9139894870133091111044901683400949483846818299518041763507948922590774925466  0881718792594659210265970467004498198990968620394600177430944738110569912941  2854289188085536270740767072259373777266697344097736124333639730805176309150  6836310795312607239520365290032105848839507981452307299417185715796297454995  0235053160409198591937180233074148804462179228008317660409386563445710347785  5345712108053073639453592393265186603051504106096643731332367283153932350006  7937107541955437362433248361242525945868802353916766181532375855504886901432  221349733 

RSA-2048

RSA-2048 has 617 decimal digits (2,048 bits). It is the largest of the RSA numbers and carried the largest cash prize for its factorization, $200,000.

RSA-2048 = 2519590847565789349402718324004839857142928212620403202777713783604366202070 7595556264018525880784406918290641249515082189298559149176184502808489120072 8449926873928072877767359714183472702618963750149718246911650776133798590957 0009733045974880842840179742910064245869181719511874612151517265463228221686 9987549182422433637259085141865462043576798423387184774447920739934236584823 8242811981638150106748104516603773060562016196762561338441436038339044149526 3443219011465754445417842402092461651572335077870774981712577246796292638635 6373289912154831438167899885040445364023527381951378636564391212010397122822 120720357 

See also

• Integer factorization records
• RSA Factoring Challenge (includes table with size and status of all numbers)
• RSA Secret-Key Challenge

Notes

1. RSA Laboratories. . Archived from the original on September 21, 2013. Retrieved August 5, 2008.{{cite web}}: CS1 maint: unfit URL (link)
2. RSA Laboratories. . Archived from the original on September 21, 2013. Retrieved August 5, 2008.{{cite web}}: CS1 maint: unfit URL (link)
3. RSA Factoring Challenge Administrator ([e-mail]) (January 30, 2002) [March 5, 1999]. "RSA Honor Roll". [e-mail] (Mailing list). from the original on September 9, 2023 – via Ray Ontko.
4. . Cryptography Watch. July 9, 1993. p. 2. Archived from the original on January 8, 2009.
5. Dixon, Brandon; Lenstra, Arjen K. (1994). "Factoring Integers Using SIMD Sieves". In Helleseth, Tor (ed.). Advances in Cryptology — EUROCRYPT '93. Lecture Notes in Computer Science. Vol. 765. Berlin, Heidelberg: Springer (published July 13, 2001). pp. 28–39. doi:10.1007/3-540-48285-7_3. ISBN 978-3-540-48285-7. S2CID 21157010 – via SpringerLink.
6. chris2be8 (March 27, 2012). "Distributed polynomial selection". mersenneforum.org. from the original on July 2, 2023. Retrieved June 8, 2015.{{cite web}}: CS1 maint: numeric names: authors list (link)
7. Denny, T.; Dodson, B.; Lenstra, A. K.; Manasse, M. S. (1994). "On the factorization of RSA-120". In Stinson, Douglas R. (ed.). Advances in Cryptology — CRYPTO' 93. Lecture Notes in Computer Science. Vol. 773. Berlin, Heidelberg: Springer (published July 13, 2001). pp. 166–174. doi:10.1007/3-540-48329-2_15. ISBN 978-3-540-48329-8 – via SpringerLink.
8. Atkins, Derek; Graff, Michael; Lenstra, Arjen K.; Leyland, Paul C. "The Magic Words Are Squeamish Ossifrage". Derek Atkins (PostScript document). from the original on September 9, 2023. Retrieved November 24, 2009 – via Massachusetts Institute of Technology.
9. Janeba, Mark (1994) [links and formatting updated September 24, 2002]. "Factoring Challenge Conquered - With a Little Help From Willamette". Prof. Mark Janeba's Framed Home Page. from the original on September 2, 2023. Retrieved March 10, 2008 – via Willamette University.
10. McHugh, Nathaniel (March 26, 2015). "The Magic Words are Squeamish Ossifrage - factoring RSA-129 using CADO-NFS". Nat McHugh: Transient Random-Noise Bursts with Announcements. Sheffield, South Yorkshire, UK. from the original on September 2, 2023. Retrieved May 25, 2016 – via Blogger.
11. Lenstra, Arjen K.; Cowie, Jim; Elkenbracht-Huizing, Marije; Furmanski, Wojtek; Montgomery, Peter L.; Weber, Damian; Zayer, Joerg (April 12, 1996) [April 11, 1996]. Caldwell, Chris (ed.). "Factorization of RSA-130". NMBRTHRY (Mailing list). PrimePages: prime number research records and results. from the original on September 2, 2023. Retrieved March 10, 2008 – via Notes, Proofs and other Comments.
12. Riele, Herman te; Cavallar, Stefania; Dodson, Bruce; Lenstra, Arjen; Leyland, Paul; Lioen, Walter; Montgomery, Peter; Murphy, Brian; Zimmermann, Paul (February 4, 1999) [February 3, 1999]. . Number Theory List <[e-mail]> (Mailing list). North Dakota University System. Archived from the original on December 8, 2004. Retrieved March 10, 2008.
13. . Other Activities: Cryptographic Challenges: The RSA Factoring Challenge. RSA Laboratories. RSA Security. Archived from the original on December 30, 2006. Retrieved March 10, 2008.
14. Riele, Herman te (August 26, 1999). . Number Theory List <[e-mail]> (Mailing list). North Dakota University System. Archived from the original on December 31, 2004. Retrieved March 10, 2008. On August 22, 1999, we found that the 512-bits number RSA-155 ...
15. . Other Activities: Cryptographic Challenges: The RSA Factoring Challenge. RSA Laboratories. RSA Security. Archived from the original on December 30, 2006. Retrieved March 10, 2008.
16. Bahr, F.; Franke, J.; Kleinjung, T.; Lochter, M.; Böhm, M. (April 1, 2003). Franke, Jens (ed.). "RSA-160". Paul Zimmermann, Laboratoire Lorrain de Recherche en Informatique et ses Applications. from the original on September 2, 2023. Retrieved March 10, 2008. We have factored RSA160 by gnfs.
17. RSA Laboratories, RSA-160 is factored! 2006-12-30 at the Wayback Machine. Retrieved on 2008-03-10.
18. D. Bonenberger and M. Krone, RSA-170 2011-07-19 at the Wayback Machine Retrieved on 2010-03-08.
19. Danilov, S. A.; Popovyan, I. A. (May 9, 2010). "Factorization of RSA-180" (PDF). Cryptology ePrint Archive.
20. Jens Franke (2003-12-03), RSA576 (repost of announcement of the factorization). Retrieved on 2008-03-10.
21. Eric W. Weisstein (2005-12-05), RSA-576 Factored at MathWorld. Retrieved on 2008-03-10.
22. RSA Laboratories, RSA-576 is factored! 2006-12-24 at the Wayback Machine. Retrieved on 2008-03-10.
23. Danilov, S. A.; Popovyan, I. A. (2010). "Factorization of RSA-180". Cryptology ePrint Archive. Retrieved May 12, 2010.
24. I. Popovyan, A. Timofeev (November 8, 2010). "RSA-190 factored". mersenneforum.org. Retrieved November 10, 2010.
25. RSA Laboratories, RSA-640 is factored! 2007-01-04 at the Wayback Machine. Retrieved on 2008-03-10.
26. Jens Franke (2005-11-04), We have factored RSA640 by GNFS 2008-06-16 at the Wayback Machine. Retrieved on 2008-03-10.
27. Eric W. Weisstein (2005-11-08), RSA-640 Factored at MathWorld. Retrieved on 2008-03-10.
28. Thorsten Kleinjung (2005-05-09), We have factored RSA200 by GNFS 2008-03-22 at the Wayback Machine. Retrieved on 2008-03-10.
29. RSA Laboratories, RSA-200 is factored!. Retrieved on 2017-01-25.
30. "mersenneforum.org - View Single Post - RSA-210 factored". www.mersenneforum.org. Retrieved February 10, 2024.
31. Factorisation of RSA-704 with CADO-NFS 2012-07-02 at the Wayback Machine.
32. Bai, Shi (July 2, 2012). "Factorization of RSA704". NMBRTHRY (Mailing list). Retrieved July 3, 2012.
33. Zimmermann, Paul (May 13, 2016). . Cado-nfs-discuss (Mailing list). Archived from the original on July 21, 2021. Retrieved May 13, 2016.
34. Gross, Samuel. . cado-nfs-discuss. Archived from the original on August 23, 2018. Retrieved August 17, 2018.
35. "RSA-232 number has been factored – ИВМ РАН". February 17, 2020. Retrieved February 10, 2024.
36. Zheltkov, Dmitry; Zamarashkin, Nikolai; Matveev, Sergey (2023). Voevodin, Vladimir; Sobolev, Sergey; Yakobovskiy, Mikhail; Shagaliev, Rashit (eds.). "How to Make Lanczos-Montgomery Fast on Modern Supercomputers?". Supercomputing. Lecture Notes in Computer Science. Cham: Springer Nature Switzerland: 114–128. doi:10.1007/978-3-031-49432-1_9. ISBN 978-3-031-49432-1.
37. Zheltkov, Dmitry; Zamarashkin, Nikolai; Matveev, Sergey (2023), Voevodin, Vladimir; Sobolev, Sergey; Yakobovskiy, Mikhail; Shagaliev, Rashit (eds.), "How to Make Lanczos-Montgomery Fast on Modern Supercomputers?", Supercomputing, vol. 14388, Cham: Springer Nature Switzerland, pp. 114–128, doi:10.1007/978-3-031-49432-1_9, ISBN 978-3-031-49431-4, retrieved February 10, 2024
38. Kleinjung, Thorsten; Aoki, Kazumaro; Franke, Jens; Lenstra, Arjen; Thomé, Emmanuel; Bos, Joppe; Gaudry, Pierrick; Kruppa, Alexander; Montgomery, Peter (2010), Factorization of a 768-bit RSA modulus, retrieved February 10, 2024
39. . Archived from the original on December 3, 2019. Retrieved December 2, 2019.
40. . Archived from the original on February 28, 2020. Retrieved February 28, 2020.

References

• RSA Factoring Challenge Administrator (1997-10-12), RSA Challenge List
• RSA Laboratories, (archived by the Internet Archive in 2006, before the RSA challenge ended)
• RSA Laboratories, . Archived from the original on May 21, 2013.
• Kazumaro Aoki, Yuji Kida, Takeshi Shimoyama, Hiroki Ueda, GNFS Factoring Statistics of RSA-100, 110, ..., 150, Cryptology ePrint Archive, Report 2004/095, 2004

External links

• Steven Levy (March 1996), Wisecrackers in Wired News. coverage on RSA-129