> We are pleased to announce the factorization of RSA-240, from RSA's challenge list, and the computation of a discrete logarithm of the same size (795 bits):
>
> RSA-240 = 12462036678171878406583504460810659043482037465167880575481878888328 966680118821085503603957027250874750986476843845862105486553797025393057189121 768431828636284694840530161441643046806687569941524699318570418303051254959437 1372159029236099 = 509435952285839914555051023580843714132648382024111473186660296521821206469746 700620316443478873837606252372049619334517 * 244624208838318150567813139024002896653802092578931401452041221336558477095178 155258218897735030590669041302045908071447
>
> [...]
>
> The previous records were RSA-768 (768 bits) in December 2009 [2], and a 768-bit prime discrete logarithm in June 2016 [3].
>
> It is the first time that two records for integer factorization and discrete logarithm are broken together, moreover with the same hardware and software.
>
> Both computations were performed with the Number Field Sieve algorithm, using the open-source CADO-NFS software [4].
>
> The sum of the computation time for both records is roughly 4000 core-years, using Intel Xeon Gold 6130 CPUs as a reference (2.1GHz). A rough breakdown of the time spent in the main computation steps is as follows.
>
> RSA-240 sieving: 800 physical core-years
RSA-240 matrix: 100 physical core-years
DLP-240 sieving: 2400 physical core-years
DLP-240 matrix: 700 physical core-years
>
> The computation times above are well below the time that was spent with the previous 768-bit records. To measure how much of this can be attributed to Moore's law, we ran our software on machines that are identical to those cited in the 768-bit DLP computation [3], and reach the conclusion that sieving for our new record size on these old machines would have taken 25% less time than the reported sieving time of the 768-bit DLP computation.

EDITED TO ADD (12/4): News article. Dan Goodin points out that the speed improvements were more due to improvements in the algorithms than from Moore's Law.

{"id": "SCHNEIER:7613C321BEE184662E56FB15CC5BBAA9", "hash": "2da4c890317a127d1ecdbc7511983244", "type": "schneier", "bulletinFamily": "blog", "title": "RSA-240 Factored", "description": "This [just in](<https://listserv.nodak.edu/cgi-bin/wa.exe?A2=NMBRTHRY;fd743373.1912&FT=M&P=T&H=&S=>):\n\n> We are pleased to announce the factorization of RSA-240, from RSA's challenge list, and the computation of a discrete logarithm of the same size (795 bits): \n> \n> RSA-240 = 12462036678171878406583504460810659043482037465167880575481878888328 966680118821085503603957027250874750986476843845862105486553797025393057189121 768431828636284694840530161441643046806687569941524699318570418303051254959437 1372159029236099 = 509435952285839914555051023580843714132648382024111473186660296521821206469746 700620316443478873837606252372049619334517 * 244624208838318150567813139024002896653802092578931401452041221336558477095178 155258218897735030590669041302045908071447\n> \n> [...]\n> \n> The previous records were RSA-768 (768 bits) in December 2009 [2], and a 768-bit prime discrete logarithm in June 2016 [3].\n> \n> It is the first time that two records for integer factorization and discrete logarithm are broken together, moreover with the same hardware and software.\n> \n> Both computations were performed with the Number Field Sieve algorithm, using the open-source CADO-NFS software [4].\n> \n> The sum of the computation time for both records is roughly 4000 core-years, using Intel Xeon Gold 6130 CPUs as a reference (2.1GHz). A rough breakdown of the time spent in the main computation steps is as follows.\n> \n> RSA-240 sieving: 800 physical core-years \nRSA-240 matrix: 100 physical core-years \nDLP-240 sieving: 2400 physical core-years \nDLP-240 matrix: 700 physical core-years\n> \n> The computation times above are well below the time that was spent with the previous 768-bit records. To measure how much of this can be attributed to Moore's law, we ran our software on machines that are identical to those cited in the 768-bit DLP computation [3], and reach the conclusion that sieving for our new record size on these old machines would have taken 25% less time than the reported sieving time of the 768-bit DLP computation.\n\nEDITED TO ADD (12/4): News [article](<https://arstechnica.com/information-technology/2019/12/new-crypto-cracking-record-reached-with-less-help-than-usual-from-moores-law/>). Dan Goodin points out that the speed improvements were more due to improvements in the algorithms than from Moore's Law.", "published": "2019-12-03T20:12:12", "modified": "2019-12-04T09:26:27", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.schneier.com/blog/archives/2019/12/rsa-240_factore.html", "reporter": "Bruce Schneier", "references": [], "cvelist": [], "lastseen": "2019-12-04T16:27:30", "history": [{"bulletin": {"id": "SCHNEIER:7613C321BEE184662E56FB15CC5BBAA9", "hash": "3fbeaab5bc35a968bc3bbe846af773b2", "type": "schneier", "bulletinFamily": "blog", "title": "RSA-240 Factored", "description": "This [just in](<https://listserv.nodak.edu/cgi-bin/wa.exe?A2=NMBRTHRY;fd743373.1912&FT=M&P=T&H=&S=>):\n\n> We are pleased to announce the factorization of RSA-240, from RSA's challenge list, and the computation of a discrete logarithm of the same size (795 bits): \n> \n> RSA-240 = 12462036678171878406583504460810659043482037465167880575481878888328 966680118821085503603957027250874750986476843845862105486553797025393057189121 768431828636284694840530161441643046806687569941524699318570418303051254959437 1372159029236099 = 509435952285839914555051023580843714132648382024111473186660296521821206469746 700620316443478873837606252372049619334517 * 244624208838318150567813139024002896653802092578931401452041221336558477095178 155258218897735030590669041302045908071447\n> \n> [...]\n> \n> The previous records were RSA-768 (768 bits) in December 2009 [2], and a 768-bit prime discrete logarithm in June 2016 [3].\n> \n> It is the first time that two records for integer factorization and discrete logarithm are broken together, moreover with the same hardware and software.\n> \n> Both computations were performed with the Number Field Sieve algorithm, using the open-source CADO-NFS software [4].\n> \n> The sum of the computation time for both records is roughly 4000 core-years, using Intel Xeon Gold 6130 CPUs as a reference (2.1GHz). A rough breakdown of the time spent in the main computation steps is as follows.\n> \n> RSA-240 sieving: 800 physical core-years \nRSA-240 matrix: 100 physical core-years \nDLP-240 sieving: 2400 physical core-years \nDLP-240 matrix: 700 physical core-years\n> \n> The computation times above are well below the time that was spent with the previous 768-bit records. To measure how much of this can be attributed to Moore's law, we ran our software on machines that are identical to those cited in the 768-bit DLP computation [3], and reach the conclusion that sieving for our new record size on these old machines would have taken 25% less time than the reported sieving time of the 768-bit DLP computation.", "published": "2019-12-03T20:12:12", "modified": "2019-12-03T20:12:12", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.schneier.com/blog/archives/2019/12/rsa-240_factore.html", "reporter": "Bruce Schneier", "references": [], "cvelist": [], "lastseen": "2019-12-03T20:34:05", "history": [], "viewCount": 19, "enchantments": {"dependencies": {"references": [], "modified": "2019-12-03T20:34:05"}, "score": {"value": 0.4, "vector": "NONE", "modified": "2019-12-03T20:34:05"}}, "objectVersion": "1.4"}, "lastseen": "2019-12-03T20:34:05", "differentElements": ["description", "modified"], "edition": 1}], "viewCount": 19, "enchantments": {"dependencies": {"references": [], "modified": "2019-12-04T16:27:30"}, "score": {"value": 0.5, "vector": "NONE", "modified": "2019-12-04T16:27:30"}, "vulnersScore": 0.5}, "objectVersion": "1.4", "_object_type": "robots.models.rss.RssBulletin", "_object_types": ["robots.models.rss.RssBulletin", "robots.models.base.Bulletin"]}