Researcher publishes the factors of RSA-896
Serguey Asael Shinder2 min readStephen A. Weis published the factors of RSA-896 on 19 September, in a page that contains the modulus, the two primes, a date, and almost nothing else.
A claim like this does not need trust, because the arithmetic is checkable in one line, and we ran it. The modulus is 896 bits; the two published factors are 448 bits each; their product is exactly the modulus; and both pass a primality test. Anyone can repeat that in a Python shell in about a second — which is the pleasant thing about factoring claims and the reason they should never be reported on authority.
The context is that this is not happening alone. The RSA numbers page already records RSA-260 as factored earlier in September, and now carries RSA-896 with a reference to this post. For a yardstick of how the same class of problem used to be attacked: RSA-250, factored in 2020, consumed on the order of 2,700 CPU core-years using the number field sieve with CADO-NFS, and the team published the parameters, the software and the timing.
What this post does not contain is the interesting part. There is no method, no hardware, no runtime, no cost — the only hint at how it was done is a mention of doing it with an AI assistant. So the question a reader actually wants answered — whether the frontier moved because of an algorithmic idea, or because somebody pointed a very large amount of ordinary compute at it — is left open by the source.
What it means
Nothing in your estate changed this week. RSA-896 is a challenge number, not a deployed key size; 1024-bit RSA has been deprecated for years and 896 bits was never in serious use after that. If you are running key sizes in this range, the news you needed arrived a decade ago.
The signal worth tracking is the write-up, not the number. Publicly demonstrated factoring records have historically come with a methodology section, because reproducibility was the point of the exercise. A record announced as a result rather than as a procedure is a different kind of artefact: it cannot be checked except by re-doing it, and it gives defenders no way to recalculate their own margins. Expect more of these, and treat the absence of a method as the main fact about them.
And it is a reminder about how to read claims in this area at all. The factorisation is verifiable in one line; the story around it — how, how long, at what cost — is not verifiable at all from the source. Those two halves deserve different levels of confidence in your head, and in anything you forward to a colleague.
We verified the multiplication before publishing this. The rest we are reporting as claims, because that is what they are.