On the Factorization of RSA-120

We present data concerning the factorization of the 12O-digit number RSA-120, which we factored on July 9,1993, using the quadratic sieve method. The factorization took approximately 825 MIPS years and was completed within three months real time. At the time of writing RSA-120 is the largest integer ever factored by a general purpose factoring algorithm. We also present some conservative extrapolations to estimate the difficulty of factoring even larger numbers, using either the quadratic sieve method or the number field sieve, and discuss the issue of the crossover point between these two methods. On the factorization of RSA-120 Evaluation of integer factoring algorithms, both from a theoretical and practical point of view, is of great importance for anyone interested in the security of factoring-based public key cryptosystems. In this paper we concentrate on the practical aspects of factoring. Furthermore, we restrict ourselves to general purpose factoring algorithms, i.e., algorithms that do not rely on special properties the numbers to be factored or their factors might have. These are the algorithms that are most relevant for cryptanalysis. Currently the two leading general purpose factoring algorithms are the quadratic sieve (QS) and the number field sieve (NFS), cf. [12] and [2]. Throughout this paper, NFS is the generalized version (from [2]) of the algorithm from [$I; the latter algorithm is much faster, but can only be applied to composites of a very special form, cf. [9]. Let ~ , [ a , b ] = exp((b+ o(l))(log2:)"(ioglogz)'-") for real a, b , 2, and 2: -+ 00. To factor an odd integer n > 1 which is not a prime power, QS runs in time D.R. Stinson (Ed.): Advances in Cryptology CRYPT0 '93, LNCS 773, pp. 166-174, 1994 0 Spnnger-Verlag Berlin Heidelberg 1994