[Cryptography] Recent factorization of RSA-240 & DLP

Phillip Hallam-Baker phill at hallambaker.com
Tue Jan 7 11:30:00 EST 2020


On Mon, Jan 6, 2020 at 8:45 PM Jerry Leichter <leichter at lrw.com> wrote:

> > The sum of the computation time for both records is roughly 4000
> > core-years, using Intel Xeon Gold 6130 CPUs as a reference (2.1GHz).
> > A rough breakdown of the time spent in the main computation steps is as
> > follows.
> >    RSA-240 sieving:  800 physical core-years
> >    RSA-240 matrix:   100 physical core-years
> >    DLP-240 sieving: 2400 physical core-years
> >    DLP-240 matrix:   700 physical core-years
> In the past, the real limit on factorization wasn't the very highly
> parallelizable sieving, it was the non-parallelizable, extremely
> memory-intensive matrix phase.  Has this changed?  I guess something has
> since they obviously didn't run this single-CPU for 100 years!  But there's
> still no indication of the memory requirements.
>

The hiatus in factoring is probably just the result of interest waning
after 768 was broken. There is no really interesting target till we reach
1024 which is of course very interesting indeed. Folk will be able to start
cracking the early RSA labs and VeriSign roots (long since expired of
course).

I strongly suspect the above crack was a result of the Crown Snakeoil
Factoring PR stunt renewing interest.

As for memory, it is now possible to buy a machine with 1.5TB of memory if
you would prefer owning that to owning a Mini Cooper with every possible
option etc. and the compute part now takes place in the cloud. So we should
expect to see a shift from the CPU part to the memory part.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.metzdowd.com/pipermail/cryptography/attachments/20200107/522bb15b/attachment.htm>


More information about the cryptography mailing list