Integer factorization records

Integer factorization is the process of determining which prime numbers divide a given positive integer. Doing this quickly has applications in cryptography. The difficulty depends on both the size and form of the number and its prime factors; it is currently very difficult to factorize large semiprimes (and, indeed, most numbers which have no small factors).

Numbers of a general form

The first very large distributed factorisation was RSA129, a challenge number described in the Scientific American article of 1977 which first popularised the RSA cryptosystem. It was factorised between September 1993 and April 1994, using MPQS, with relations contributed by about 600 people from all over the Internet, and the final stages of the calculation performed on a MasPar supercomputer at Bell Labs.

Between January and August 1999, RSA-155, a challenge number prepared by the RSA company, was factorised using GNFS with relations again contributed by a large group, and the final stages of the calculation performed in just over nine days on the Cray C916 supercomputer at the SARA Amsterdam Academic Computer Center.

In January 2002, Franke et al. announced the factorisation of a 158-digit cofactor of 2⁹⁵³+1, using a couple of months on about 25 PCs at the University of Bonn, with the final stages done using a cluster of six Pentium-III PCs.

In April 2003, the same team factored RSA-160 using about a hundred CPUs at BSI, with the final stages of the calculation done using 25 processors of an SGI Origin supercomputer.

The 174-digit RSA-576 was factored by Franke, Kleinjung and members of the NFSNET collaboration in December 2003, using resources at BSI and the University of Bonn; soon afterwards, Aoki, Kida, Shimoyama, Sonoda and Ueda announced that they had factored a 164-digit cofactor of 2¹⁸²⁶+1.

A 176-digit cofactor of 11²⁸¹+1 was factored by Aoki, Kida, Shimoyama and Ueda between February and May 2005 using machines at NTT and Rikkyo University in Japan.^[1]

The RSA-200 challenge number was factored by Franke, Kleinjung et al. between December 2003 and May 2005, using a cluster of 80 Opteron processors at BSI in Germany; the announcement was made on 9 May 2005.^[2] They later (November 2005) factored the slightly smaller RSA-640 challenge number.

On December 12, 2009, a team including researchers from the CWI, the EPFL, INRIA and NTT in addition to the authors of the previous record factored RSA-768, a 232-digit semiprime.^[3] They used the equivalent of almost 2000 years of computing on a single core 2.2 GHz AMD Opteron.

Numbers of a special form

12¹⁵¹ − 1, of 542 bits (163 digits), was factored between April and July 1993 by a team at CWI and Oregon State University.^[4]

2⁷⁷³ + 1, of 774 bits (233 digits), was factored between April and November 2000 by 'The Cabal', with the matrix step done over 250 hours on the Cray also used for RSA-155.^[5]

2⁸⁰⁹ − 1, of 809 bits (244 digits), had its factorisation announced at the start of January 2003. Sieving was done at the CWI, at the Scientific Computing Institute and the Pure Mathematics Department at Bonn University, and using private resources of J. Franke, T. Kleinjung and the family of F. Bahr. The linear algebra step was done by P. Montgomery at SARA in Amsterdam.^[6]

6³⁵³ − 1, of 911 bits (275 digits), was factored by Aoki, Kida, Shimoyama and Ueda between September 2005 and January 2006 using SNFS.^[7]

2¹⁰³⁹ − 1, of 1039 bits (313 digits) (though a factor of 23 bits was already known) was factored between September 2006 and May 2007 by a group including K. Aoki, J. Franke, T. Kleinjung, A. K. Lenstra and D. A. Osvik, using computers at NTT, EPFL and the University of Bonn.^[8][9]

2¹⁰⁶¹ − 1, of 1061 bits (320 digits) was factored between early 2011 and 4 August 2012 by a group headed by Greg Childers at CSU Fullerton, using the nfs@home BOINC project for about 300 CPU-years of sieving; the linear algebra was run at the Trestles cluster at SDSC and the Lonestar cluster at TACC and needed additional 35 CPU-years.^[10]

All unfactored parts of the numbers 2ⁿ − 1 with n between 1000 and 1200 were factored by a multiple-number-sieve approach in which much of the sieving step could be done simultaneously for multiple numbers, by a group including T. Kleinjung, J. Bos and A. K. Lenstra, starting in 2010.^[11] To be precise, n=1081 was completed on 11 March 2013; n=1111 on 13 June 2013; n=1129 on 20 September 2013; n=1153 on 28 October 2013; n=1159 on 9 February 2014; 1177 on May 29, 2014, n=1193 on 22 August 2014, and n=1199 on December 11, 2014; the first detailed announcement was made in late August 2014. The total effort for the project is of the order of 7500 CPU-years on 2.2 GHz Opterons, with roughly 5700 years spent sieving and 1800 years on linear algebra.

Comparison to efforts by individuals

As of the end of 2007, thanks to the constant decline in memory prices, the ready availability of multi-core 64-bit computers, and the availability of the efficient sieving code (developed by Thorsten Kleinjung of the Bonn group) via ggnfs^[12] and of robust open-source software such as msieve^[13] for the finishing stages, special-form numbers of up to 750 bits and general-form numbers of up to about 520 bits can be factored in a few months on a few PCs by a single person without any special mathematical experience.^[14] These bounds increase to about 950^[15] and 600^[16] if it were possible to secure the collaboration of a few dozen PCs for sieving; currently the amount of memory and the CPU power of a single machine for the finishing stage are equal barriers to progress.

In 2009, Benjamin Moody factored a 512-bit RSA key used to sign the TI-83 graphing calculator using software found on the internet; this eventually led to the Texas Instruments signing key controversy.

In September 2013, the 696-bit RSA-210 was factored by Ryan Propper^[17] using institutional resources; between March 2013 and October 2014, another 210-digit number (the 117th term in the 'home prime sequence' starting with 49) was completed by a user known as WraithX,^[18] using $7600 worth of processing time on Amazon EC2 machines for the sieving, and four months on a dual Xeon E5-2687W v1 for the linear algebra.

Records for efforts by quantum computers

The largest number factored by Shor's algorithm is 21 in 2012.^[19] 15 had previously been factored by several labs.

In April 2012, the factorization of by a room temperature (300K) NMR adiabatic quantum computer was reported by a group led by Xinhua Peng.^[20] In November 2014 it was discovered by Nike Dattani and Nathan Bryans that the 2012 experiment had in fact also factored much larger numbers without knowing it.^[21][22] In April 2016 the 18-bit number 200099 was factored using quantum annealing on a D-Wave 2X quantum processor.^[23] Shortly after, 291311 was factored using NMR at higher than room temperature.^[24]

See also

• Largest known prime number

References