## The Magic Words Are Squeamish Ossifrage (Extended Abstract)

Citations: | 2 - 0 self |

### BibTeX

@MISC{Atkins_themagic,

author = {Derek Atkins and Michael Graff and Arjen K. Lenstra and Paul C. Leyland},

title = {The Magic Words Are Squeamish Ossifrage (Extended Abstract)},

year = {}

}

### OpenURL

### Abstract

We describe the computation which resulted in the title of this paper. Furthermore, we give an analysis of the data collected during this computation. From these data, we derive the important observation that in the final stages, the progress of the double large prime variation of the quadratic sieve integer factoring algorithm can more effectively be approximated by a quartic function of the time spent, than by the more familiar quadratic function. We also present, as an update to [15], some of our experiences with the management of a large computation distributed over the Internet. Based on this experience, we give some realistic estimates of the current readily available computational power of the Internet. We conclude that commonly-used 512-bit RSA moduli are vulnerable to any organization prepared to spend a few million dollars and to wait a few months.

### Citations

2902 | A method for obtaining digital signatures and public-key cryptosystems
- Rivest, Shamir, et al.
- 1978
(Show Context)
Citation Context ...s es d e 1mod(p;1)(q ;1). Because of the condition on p and q, nding d is straightforward if (p ; 1)(q ; 1) is known. But knowing (p ; 1)(q ; 1) is equivalent toknowing the secret primes p and q (cf. =-=[21]-=-). 5 It follows that the encrypted message can be decrypted by factoring r. In the full paper, we will describe in detail how we managed to factor r. This extended abstract consists of a discussion of... |

675 | The Art of Computer Programming, volume 2: Seminumerical Algorithms - Knuth - 1988 |

126 | The Development of the Number Field Sieve - Lenstra, Lenstra - 1993 |

98 |
The Book of Numbers
- Conway, Guy
- 1996
(Show Context)
Citation Context ...on 6). 2 Predicting the di culty of factoring r Back in 1976, Richard Guy wrote `I shall be surprised if anyone regularly factors numbers of size 1080 without special form during the present century' =-=[8]-=-. In 1977, Rivest estimated in [20] that factoring a 125-digit number which is the product of two 63-digit prime numbers would require at least 40 quadrillion years using the best factoring algorithm ... |

75 | The multiple polynomial quadratic sieve - Silverman - 1987 |

53 | Analysis and comparison of some integer factoring algorithms - Pomerance - 1982 |

52 | Factoring by electronic mail
- Lenstra, Manasse
(Show Context)
Citation Context ...quadratic sieve integer factoring algorithm can more e ectively be approximated by a quartic function of the time spent, than by the more familiar quadratic function. We also present, as an update to =-=[15]-=-, some of our experiences with the management ofa large computation distributed over the Internet. Based on this experience, we give some realistic estimates of the current readily available computati... |

49 | The factorization of the ninth Fermat number - Lenstra, Jr, et al. - 1993 |

43 |
Factoring with two large primes
- Lenstra, Manasse
- 1991
(Show Context)
Citation Context ... L(n2)=L(n1), where both o(1)'s are simply omitted. Using this method it was estimated in [2] that factoring a 120-digit number using QS would take about 950 mips years, based on the observation from =-=[16]-=- that factoring a 116-digit number took about 400 mips years. The actual 120digit factorization took about 825 mips years, slightly less than the prediction, due to several improvements in the program... |

38 | Computation of discrete logarithms in prime fields - LaMacchia, Odlyzko - 1991 |

23 | NFS with Four Large Primes: An Explosive Experiment," draft manuscript
- Dodson, Lenstra
(Show Context)
Citation Context ...s of particular interest for future NFS factorizations where relations can have more than 2 large primes (cf. [7]). Understanding their cycle-yield is crucial to be able to predict the run-times (cf. =-=[5]-=-). The estimates that were sent to the contributors (cf. Section 5) were based on extrapolations of the cycle-curve. Initially a quadratic curve gave agoodt, and was therefore used to extrapolate. We ... |

22 | Reduction of huge, sparse matrices over finite fields via created catastrophes - Pomerance, Smith - 1992 |

21 | Fast Generation of Prime Numbers and Secure Public-Key Cryptographic Parameters - Maurer - 1995 |

18 |
private communication
- Shamir
(Show Context)
Citation Context ...be computed in 1 nanosecond, for 125-digit numbers a, b, andc. 6 Thus, it is not surprising that the inventors of RSA felt con dent that `with such a huge modulus the message will never be recovered' =-=[23]-=- and o ered a $100 prize to the rst successful decoder of the encrypted message. Interestingly, until the message was decoded, none of the parties involved remembered the expiration date of April 1, 1... |

17 | Asymptotically fast factorization of integers - Dixon - 1981 |

15 | On the Factorization of RSA120
- Denny, Dodson, et al.
- 1994
(Show Context)
Citation Context ...reasonably small, then factoring n2 using the same implementation can be expected to take time approximately t L(n2)=L(n1), where both o(1)'s are simply omitted. Using this method it was estimated in =-=[2]-=- that factoring a 120-digit number using QS would take about 950 mips years, based on the observation from [16] that factoring a 116-digit number took about 400 mips years. The actual 120digit factori... |

14 |
Factoring Integers Using SIMD Sieves
- Dixon, Lenstra
- 1994
(Show Context)
Citation Context ... We estimate that we had approximately 600 contributors using more than 1600 machines and producing about 80%of the relations. The other 20%was contributed by several MasPars running the program from =-=[4]-=-. On March 21 1994 we had about 8:25 million relations, with more than 108 000 fulls and 417 000 cycles. Because 108 000 + 417 000 > 524 339 = #P ,the `cease and desist' message was mailed out on Marc... |

12 | A general number field sieve implementation - Bernstein, Lenstra - 1993 |

11 |
Mathematical games, A new kind of cipher that would take millions of years to break, Scienti c American
- Gardner
- 1977
(Show Context)
Citation Context ... of this paper, thereby solving the `RSA-challenge' and winning the US$100 prize. The prize has been donated to the Free Software Foundation. The modulus r has 129 decimal digits and is, according to =-=[6]-=-, the product of a 64-digit prime p and a 65-digit prime q such that both p;1 and q;1 are relatively prime to e. The primes p and q were kept secret. It is well known that the encrypted message can be... |

9 | Algorithms in number theory, Chapter 12 - Lenstra, Lenstra - 1990 |

7 |
Massively parallel computing and factoring
- Lenstra
(Show Context)
Citation Context ...e dense matrix, in 268 separate les of about 16 MBytes each. To nd a dependency among the rows of the dense matrix, we used the incremental version from [1] of the MasPar dense matrix eliminator from =-=[11]-=-. The dense matrix was processed in 5 blocks. With a core size of 1GByte, 41 595 rows could be processed per block. Each newblockwas rst eliminated with the pivots found in the previous blocks, then w... |

5 | Computation of discrete logarithms in prime elds - Odlyzko - 1991 |

3 | Reduction of huge, sparse matrices over nite elds via created catastrophes, Experiment - Pomerance, Smith - 1992 |

2 |
Lattice sieving and trial division, Algorithmic number theory symposium
- Golliver, Lenstra, et al.
- 1994
(Show Context)
Citation Context ...pful to predict the cycle-yield in other factorizations. The behavior of the cycle-yield is of particular interest for future NFS factorizations where relations can have more than 2 large primes (cf. =-=[7]-=-). Understanding their cycle-yield is crucial to be able to predict the run-times (cf. [5]). The estimates that were sent to the contributors (cf. Section 5) were based on extrapolations of the cycle-... |

2 |
personal communication
- Schroeppel
- 1994
(Show Context)
Citation Context ... this practice hardly makes sense. This naive approachwas rst used in [21: Section IX.A], where L(n), without the o(1), was given as the run-time of Schroeppel's linear sieve factoring algorithm (cf. =-=[22]-=-). This is a big improvement compared with Rivest's slightly earlier estimate in [6]. The run-time from [21] did not include the matrix elimination step, because this step was considered to be trivial... |

1 |
letter to
- Rivest
- 1977
(Show Context)
Citation Context ...f factoring r Back in 1976, Richard Guy wrote `I shall be surprised if anyone regularly factors numbers of size 1080 without special form during the present century' [8]. In 1977, Rivest estimated in =-=[20]-=- that factoring a 125-digit number which is the product of two 63-digit prime numbers would require at least 40 quadrillion years using the best factoring algorithm known, assuming that a b (modc) cou... |

1 |
A general number eld sieve implementation
- Bernstein, Lenstra
(Show Context)
Citation Context ... which was spent building the 4 436 201 280 byte dense matrix, in 268 separate les of about 16 MBytes each. To nd a dependency among the rows of the dense matrix, we used the incremental version from =-=[1]-=- of the MasPar dense matrix eliminator from [11]. The dense matrix was processed in 5 blocks. With a core size of 1GByte, 41 595 rows could be processed per block. Each newblockwas rst eliminated with... |