Impressive. I wonder the methodology. Algorithmic improvements? More probably just an implementational optimisation. Last RSA record was due to special q sieving methods if I recall well, some 3k core hours.
I hope there’s a theoretical improvement behind the result.
So RSA 260 is about 2-3 times harder than RSA 250, which was solved in 2700 core hours in 2020, so it’s probably no algorithmic improvements, just a tweak here and there plus faster hardware.
It's sort of fun to remember the genuine worry in the community around RSA and the (really, really shocking at the time!) progress in factorization leading up to GNFS techniques.
Like, it really looked like everything was going to fall apart. We all rushed to 1024 bit keys, and then to 2048 bit after what felt like a few months. And... maybe even that wouldn't be enough?
And actual history ended up being the boring version: it was absolutely enough, factorization is seemingly settled math at this point, no new techniques have been discovered.
At the end of the day RSA was just fine and no one really needed to bother with ECC and all of its confusing tutorials.
And the ~23 year old 1024 bit key holding my GnuPG box closed is still just fine, cryptographically. (Though the chances of getting hit with a keylogger or other side channel attack over that period are nontrivially high and I suppose I really should rotate it or something).
RSA might be fine mathematically but as a production cryptosystem it’s an unmitigated disaster by modern standards.
Compared to elliptic curves, it is comically easy to build an RSA implementation which is catastrophically broken. Both the number of and subtlety of footguns in RSA are extreme.
Even ignoring that, ECC is far more efficient (in part thanks to smaller key sizes and being able to be done with fixed-width arithmetic rather than needing bignums) and far better suited for embedded devices. Migration has been an enormous win even if you think the security of RSA is fine.
I'd say ECDSA is even worse, because almost anything you get even slightly wrong with Schnorr schemes ends up leaking the private key. With RSA OTOH you just use a decent library and something like encode-and-compare for signing and you're done. I'm much more nervous about something using ECDSA than RSA once I've had a look at the code and verified that it's at least somewhat competently written.
Assuming a given fixed key size, where does RSA need non-fixed-width arithmatic? AFAIK you can do all RSA maths with registers just double as wide as the key, no variable width anything required there. And I don't think that this is much different from ECC maths, apart from ECC's keys just being way less wide for an approximately equivalent security level.
RSA operations are performed modulo n, where n is the product of 2 primes. A 2048-bit RSA key is an n that is 2048 bits long (with the most significant bit set by definition).
There are no consumer CPUs that have 2048-bit-wide registers; even AVX10 tops out at 512 bits. Thus, mathematical operations on RSA keys are performed using arbitrary precision integer libraries like OpenSSL's own BN (BigNum) library, or GMP (the GNU Multiple Precision Arithmetic Library) as used by GNUTLS, in software.
For example, adding 1 to an arbitrary precision integer is not a CPU add or increment instruction, nor is multiplying 2 integers (or an integer and a constant factor) a CPU multiplication instruction.
and the more recent (post-quantum) lattice-based stuff can get away with ~16 bit arithmetic (it's vectors of ~512-1024 dimension, but the operations are SIMD-friendly)
the researchers from the RSA-250 record have publicly claimed that factoring 1024-bit RSA keys is within reach of nation states. Your 1024 bit key is only "fine" because you are a small fry, not because cryptographers think it cannot be attacked. This would be true if you used a (non-standard) RSA-768 parameterization as well, which is easier than what we are talking about on this post.
It's also worth mentioning the main concern for RSA is not GNFS, but something stronger. SOTA RSA attacks (such as GNFS) use "index calculus". You can also use index calculus to attack finite field diffie hellman. In the 2010's, there was remarkable progress in index calculus attacks against finite field DH in the small characteristic case. For example, the current record for binary characteristic finite field DH is ~30k bits (and this is by an academic --- a nation state could definitely do more).
It is not known that similar progress is possible in other cases (such as for RSA). But it's very much possible that factoring is much easier than expected. Simultaneously I wouldn't personally bet money on it, and if that breakthrough happened, there were sufficient warning signs that I would feel justified in saying "told you so" to people trusting RSA.
> Your 1024 bit key is only "fine" because you are a small fry, not because cryptographers think it cannot be attacked.
This is falling for an xkcd 538 fallacy, btw. Nation states obviously have vast higher capability to subvert individual data than brute forcing its crypto. I stand by what I said: 1024-bit RSA keys are "fine" and will remain so. RSA-309 will not fall within our lifetime.
> it's very much possible that factoring is much easier than expected
And this is sort of toothless? I mean, that's true for ECC too. It's true for all cryptography. It's true for all software. For all engineering. For all math. We'll never know what we don't know. New discoveries tomorrow may upend everything any given property ("safety" is just one) we think our existing machines hold.
But they probably won't. And the moments where that happens are extremely rare. And to be blunt RSA already got hit with that particular lightning bolt.
That's a weirdly confident prediction. Why do you think 309 isn't going to fall in our lifetimes?
"SHA2 will never be broken in our lifetimes" is something I've heard JP Aumasson say many times, but that's based on the fact that there's no line of sight anywhere to techniques that could break it. But you can't say that about 1024 bit RSA.
Everyone wants to argue crypto when my point was precisely the opposite (to wit: "Two decades after the factoring freakout, RSA is fine, go figure"), but whatever. I'll retract that when they break it. But the pace has been slowing down, not speeding up. Getting from RSA-250 to -260 was six years. That's not going to get us there before I kick it, at least.
If you want to pin me down on something slightly more formal: DRAM density scaling kinda stopped a few years back, systems aren't getting any bigger (much to Sam Altman's public dismay), and there is a superlinear matrix size requirement in factorization techniques that AFAIK no one knows how to fix. We can get the cycles to do it, but not the space.
Probably. Maybe not! But even so, it will remain cheaper to steal my secrets with the proverbial $5 wrench. RSA? It was fine.
any cryptography can break at any time. Sometimes "sudden" breaks happen. You can't defend against these, so there (perversely) isn't that much of a point worrying about them, besides using schemes many people have thought about for a while.
Another way cryptography breaks is via iterative improvements. For example, in the last few months there are two big cryptanalytic stories
1. The novel scheme (though not standardized) HAWK had its security reduced by ~1/2 by AI. It is no longer compelling in any way. This was in a sense "predictable" though. There was a series of papers showing that HAWK-like schemes were vulnerable to an attack of this type. Then, AI was able to bridge the gap and apply these attacks directly to HAWK.
2. The ISO-standardized scheme McCliece (from ~45 years ago) has had some alarming security reductions, and may be effectively broken (it's still a little early to tell, many cryptanalytic papers require heuristics that must be justified, etc). Again, this was in a sense "predictable". Starting ~3 years ago it was discovered that McCliece had some yet-unexploited structure, and since then there have been more and more papers exploiting this further, until recently more dramatic attacks have occurred.
In both cases, there is a clear "story" you can (post-hoc) tell about the attacks. You can't always predict precisely where the attacks will end up (for the McCliece attack, it appears more effective than I would have predicted at least). But you can often tell when things are gradually weakening, before a full collapse.
RSA has a cousin (binary characteristic finite field DH) that had this gradual weakening into total collapse happen in the 2010s. It is possible this cousin was a problem child, and GNFS will remain the best attack against RSA until quantum computers fully break it. I can't predict the future. But I can say that ECC has had no such problematic cousins.
This is to say that we are blessed that we have extremely strong cryptography available. Why you would choose to use the weakest defensible option is beyond me, and not something anyone serious about security would ever recommend doing. There is no upside, and only downsides.
> Why you would choose to use the weakest defensible option
I still remain confused why people are interpreting this from what I wrote. I'm not "choosing" to use RSA nor advocating for its use. I'm pointing out anecdotally that I have a GnuPG keychain still live with a 1024 bit key from the last millenium (or close to that, honestly I don't know for sure) that everyone was *sure*, 20 years ago, was broken and insecure. And... it wasn't. It's fine.
The xkcd point seems profound to me: the crypto nerds were entirely wrong about their focus and sense of urgency here. Today, it's much cheaper to steal my key with simple violence. It will remain so when I'm on my death bed. Probably when my heirs are too. And I find that interesting. What else are we nerds getting wrong?
We only need the ability to make make 1 qubit with indefinite reliable / fully error corrected state. Quantum interconnects would allow for these to be connected into arbitrarily large quantum computers.
It's more akin to "we only need to make reliable transistors to make classical computers." With the invention of the planar transistor, going from 1 transistor to 100 or 100k was not that big of a step, comparatively.
Impressive. I wonder the methodology. Algorithmic improvements? More probably just an implementational optimisation. Last RSA record was due to special q sieving methods if I recall well, some 3k core hours. I hope there’s a theoretical improvement behind the result.
So RSA 260 is about 2-3 times harder than RSA 250, which was solved in 2700 core hours in 2020, so it’s probably no algorithmic improvements, just a tweak here and there plus faster hardware.
2700 core years
faster hardware could also mean gpu/asic/etc.
anddd it's already on wikipedia https://en.wikipedia.org/wiki/RSA_numbers#RSA-260
"4397328654844826923795068102505872571721883526553349659561256924505973939597593482272505698004801207988043088656411102133523080581 divides RSA-260"
Background: https://en.wikipedia.org/wiki/RSA_Factoring_Challenge
What was the methodology,software, hardware, cpu cores, time taken?
Can I decode my DVD collection now?
DVD encryption doesn’t use RSA; and yes, you could since late 1999 already.
It's sort of fun to remember the genuine worry in the community around RSA and the (really, really shocking at the time!) progress in factorization leading up to GNFS techniques.
Like, it really looked like everything was going to fall apart. We all rushed to 1024 bit keys, and then to 2048 bit after what felt like a few months. And... maybe even that wouldn't be enough?
And actual history ended up being the boring version: it was absolutely enough, factorization is seemingly settled math at this point, no new techniques have been discovered.
At the end of the day RSA was just fine and no one really needed to bother with ECC and all of its confusing tutorials.
And the ~23 year old 1024 bit key holding my GnuPG box closed is still just fine, cryptographically. (Though the chances of getting hit with a keylogger or other side channel attack over that period are nontrivially high and I suppose I really should rotate it or something).
RSA might be fine mathematically but as a production cryptosystem it’s an unmitigated disaster by modern standards.
Compared to elliptic curves, it is comically easy to build an RSA implementation which is catastrophically broken. Both the number of and subtlety of footguns in RSA are extreme.
Even ignoring that, ECC is far more efficient (in part thanks to smaller key sizes and being able to be done with fixed-width arithmetic rather than needing bignums) and far better suited for embedded devices. Migration has been an enormous win even if you think the security of RSA is fine.
I'd say ECDSA is even worse, because almost anything you get even slightly wrong with Schnorr schemes ends up leaking the private key. With RSA OTOH you just use a decent library and something like encode-and-compare for signing and you're done. I'm much more nervous about something using ECDSA than RSA once I've had a look at the code and verified that it's at least somewhat competently written.
Assuming a given fixed key size, where does RSA need non-fixed-width arithmatic? AFAIK you can do all RSA maths with registers just double as wide as the key, no variable width anything required there. And I don't think that this is much different from ECC maths, apart from ECC's keys just being way less wide for an approximately equivalent security level.
RSA operations are performed modulo n, where n is the product of 2 primes. A 2048-bit RSA key is an n that is 2048 bits long (with the most significant bit set by definition).
There are no consumer CPUs that have 2048-bit-wide registers; even AVX10 tops out at 512 bits. Thus, mathematical operations on RSA keys are performed using arbitrary precision integer libraries like OpenSSL's own BN (BigNum) library, or GMP (the GNU Multiple Precision Arithmetic Library) as used by GNUTLS, in software.
For example, adding 1 to an arbitrary precision integer is not a CPU add or increment instruction, nor is multiplying 2 integers (or an integer and a constant factor) a CPU multiplication instruction.
256-bit ECC on the other hand is frequently performed by 4-wide 64-bit operations with a little extra accounting.
and the more recent (post-quantum) lattice-based stuff can get away with ~16 bit arithmetic (it's vectors of ~512-1024 dimension, but the operations are SIMD-friendly)
the researchers from the RSA-250 record have publicly claimed that factoring 1024-bit RSA keys is within reach of nation states. Your 1024 bit key is only "fine" because you are a small fry, not because cryptographers think it cannot be attacked. This would be true if you used a (non-standard) RSA-768 parameterization as well, which is easier than what we are talking about on this post.
It's also worth mentioning the main concern for RSA is not GNFS, but something stronger. SOTA RSA attacks (such as GNFS) use "index calculus". You can also use index calculus to attack finite field diffie hellman. In the 2010's, there was remarkable progress in index calculus attacks against finite field DH in the small characteristic case. For example, the current record for binary characteristic finite field DH is ~30k bits (and this is by an academic --- a nation state could definitely do more).
It is not known that similar progress is possible in other cases (such as for RSA). But it's very much possible that factoring is much easier than expected. Simultaneously I wouldn't personally bet money on it, and if that breakthrough happened, there were sufficient warning signs that I would feel justified in saying "told you so" to people trusting RSA.
> Your 1024 bit key is only "fine" because you are a small fry, not because cryptographers think it cannot be attacked.
This is falling for an xkcd 538 fallacy, btw. Nation states obviously have vast higher capability to subvert individual data than brute forcing its crypto. I stand by what I said: 1024-bit RSA keys are "fine" and will remain so. RSA-309 will not fall within our lifetime.
> it's very much possible that factoring is much easier than expected
And this is sort of toothless? I mean, that's true for ECC too. It's true for all cryptography. It's true for all software. For all engineering. For all math. We'll never know what we don't know. New discoveries tomorrow may upend everything any given property ("safety" is just one) we think our existing machines hold.
But they probably won't. And the moments where that happens are extremely rare. And to be blunt RSA already got hit with that particular lightning bolt.
That's a weirdly confident prediction. Why do you think 309 isn't going to fall in our lifetimes?
"SHA2 will never be broken in our lifetimes" is something I've heard JP Aumasson say many times, but that's based on the fact that there's no line of sight anywhere to techniques that could break it. But you can't say that about 1024 bit RSA.
Everyone wants to argue crypto when my point was precisely the opposite (to wit: "Two decades after the factoring freakout, RSA is fine, go figure"), but whatever. I'll retract that when they break it. But the pace has been slowing down, not speeding up. Getting from RSA-250 to -260 was six years. That's not going to get us there before I kick it, at least.
If you want to pin me down on something slightly more formal: DRAM density scaling kinda stopped a few years back, systems aren't getting any bigger (much to Sam Altman's public dismay), and there is a superlinear matrix size requirement in factorization techniques that AFAIK no one knows how to fix. We can get the cycles to do it, but not the space.
Probably. Maybe not! But even so, it will remain cheaper to steal my secrets with the proverbial $5 wrench. RSA? It was fine.
any cryptography can break at any time. Sometimes "sudden" breaks happen. You can't defend against these, so there (perversely) isn't that much of a point worrying about them, besides using schemes many people have thought about for a while.
Another way cryptography breaks is via iterative improvements. For example, in the last few months there are two big cryptanalytic stories
1. The novel scheme (though not standardized) HAWK had its security reduced by ~1/2 by AI. It is no longer compelling in any way. This was in a sense "predictable" though. There was a series of papers showing that HAWK-like schemes were vulnerable to an attack of this type. Then, AI was able to bridge the gap and apply these attacks directly to HAWK.
2. The ISO-standardized scheme McCliece (from ~45 years ago) has had some alarming security reductions, and may be effectively broken (it's still a little early to tell, many cryptanalytic papers require heuristics that must be justified, etc). Again, this was in a sense "predictable". Starting ~3 years ago it was discovered that McCliece had some yet-unexploited structure, and since then there have been more and more papers exploiting this further, until recently more dramatic attacks have occurred.
In both cases, there is a clear "story" you can (post-hoc) tell about the attacks. You can't always predict precisely where the attacks will end up (for the McCliece attack, it appears more effective than I would have predicted at least). But you can often tell when things are gradually weakening, before a full collapse.
RSA has a cousin (binary characteristic finite field DH) that had this gradual weakening into total collapse happen in the 2010s. It is possible this cousin was a problem child, and GNFS will remain the best attack against RSA until quantum computers fully break it. I can't predict the future. But I can say that ECC has had no such problematic cousins.
This is to say that we are blessed that we have extremely strong cryptography available. Why you would choose to use the weakest defensible option is beyond me, and not something anyone serious about security would ever recommend doing. There is no upside, and only downsides.
> Why you would choose to use the weakest defensible option
I still remain confused why people are interpreting this from what I wrote. I'm not "choosing" to use RSA nor advocating for its use. I'm pointing out anecdotally that I have a GnuPG keychain still live with a 1024 bit key from the last millenium (or close to that, honestly I don't know for sure) that everyone was *sure*, 20 years ago, was broken and insecure. And... it wasn't. It's fine.
The xkcd point seems profound to me: the crypto nerds were entirely wrong about their focus and sense of urgency here. Today, it's much cheaper to steal my key with simple violence. It will remain so when I'm on my death bed. Probably when my heirs are too. And I find that interesting. What else are we nerds getting wrong?
RSA-260 has a 862 bit key. In terms of work, a 1024 bit key is only about 50-100x more work to break than the factorization posted in TFA.
ECC does have the benefit of smaller keys, but yes, RSA seems fine security-wise for the foreseeable future.
RSA-1024 absolutely is not.
Peter Shor would like to have a word with you...
Shor's algorithm needs technology we still don’t have. Get back to me when we can have more than a handful of qubits reliably compute things.
We only need the ability to make make 1 qubit with indefinite reliable / fully error corrected state. Quantum interconnects would allow for these to be connected into arbitrarily large quantum computers.
So we only need to invent actual quantum computers. Got it, easy.
Yes, but since R&D and funding are in a feedback loop now (promising results -> more money -> better results etc), it might only take a couple more years to get there. https://arstechnica.com/science/2026/06/amazon-quera-promise...
It's more akin to "we only need to make reliable transistors to make classical computers." With the invention of the planar transistor, going from 1 transistor to 100 or 100k was not that big of a step, comparatively.
You can just send the gnupg box and keys to me, I will hold them securely for you so you don't have to worry about it
but complexity is not known right? like tomorrow someone could come up with a super fast algorithm?
depending on your definition of "super fast" all forms of crypto could fall.