Set of large semiprimes
In mathematics, the RSA numbers are a set of large semiprimes (numbers with exactly two prime factors) that were part of the RSA Factoring Challenge. The challenge was to find the prime factors of each number. It was created by RSA Laboratories in March 1991 to encourage research into computational number theory and the practical difficulty of factoring large integers. The challenge was ended in 2007.
RSA Laboratories (which is an initialism of the creators of the technique; Rivest, Shamir and Adleman) published a number of semiprimes with 100 to 617 decimal digits. Cash prizes of varying size, up to US$200,000 (and prizes up to $20,000 awarded), were offered for factorization of some of them. The smallest RSA number was factored in a few days. Most of the numbers have still not been factored and many of them are expected to remain unfactored for many years to come. As of  2020[ [update]], the smallest 23 of the 54 listed numbers have been factored.
While the RSA challenge officially ended in 2007, people are still attempting to find the factorizations. According to RSA Laboratories, "Now that the industry has a considerably more advanced understanding of the cryptanalytic strength of common symmetric-key and public-key algorithms, these challenges are no longer active." Some of the smaller prizes had been awarded at the time. The remaining prizes were retracted.
The first RSA numbers generated, from RSA-100 to RSA-500, were labeled according to their number of decimal digits. Later, beginning with RSA-576, binary digits are counted instead. An exception to this is RSA-617, which was created before the change in the numbering scheme. The numbers are listed in increasing order below.
 ;templatestyles src="template:sticky header/styles.css"/ ;
Note: until work on this article is finished, please check both the table and the list, since they include different values and different information.
RSA-100.
RSA-100 has 100 decimal digits (330 bits). Its factorization was announced on April 1, 1991, by Arjen K. Lenstra. Reportedly, the factorization took a few days using the multiple-polynomial quadratic sieve algorithm on a MasPar parallel computer.
The value and factorization of RSA-100 are as follows:
 RSA-100 = 1522605027922533360535618378132637429718068114961380688657908494580122963258952897654000350692006139
 RSA-100 = 37975227936943673922808872755445627854565536638199
 × 40094690950920881030683735292761468389214899724061
It takes four hours to repeat this factorization using the program Msieve on a 2200 MHz Athlon 64 processor.
The number can be factorized in 72 minutes on overclocked to 3.5 GHz Intel Core2 Quad q9300, using GGNFS and Msieve binaries running by distributed version of the factmsieve Perl script.
RSA-110.
RSA-110 has 110 decimal digits (364 bits), and was factored in April 1992 by Arjen K. Lenstra and Mark S. Manasse in approximately one month.
The number can be factorized in less than four hours on overclocked to 3.5 GHz Intel Core2 Quad q9300, using GGNFS and Msieve binaries running by distributed version of the factmsieve Perl script.
The value and factorization are as follows:
 RSA-110 = 35794234179725868774991807832568455403003778024228226193532908190484670252364677411513516111204504060317568667
 RSA-110 = 6122421090493547576937037317561418841225758554253106999
 × 5846418214406154678836553182979162384198610505601062333
RSA-120.
RSA-120 has 120 decimal digits (397 bits), and was factored in June 1993 by Thomas Denny, Bruce Dodson, Arjen K. Lenstra, and Mark S. Manasse. The computation took under three months of actual computer time.
The value and factorization are as follows:
 RSA-120 = 227010481295437363334259960947493668895875336466084780038173258247009162675779735389791151574049166747880487470296548479
 RSA-120 = 327414555693498015751146303749141488063642403240171463406883
 × 693342667110830181197325401899700641361965863127336680673013
RSA-129.
RSA-129, having 129 decimal digits (426 bits), was not part of the 1991 RSA Factoring Challenge, but rather related to Martin Gardner's Mathematical Games column in the August 1977 issue of "Scientific American".
RSA-129 was factored in April 1994 by a team led by Derek Atkins, Michael Graff, Arjen K. Lenstra and Paul Leyland, using approximately 1600 computers from around 600 volunteers connected over the Internet. A US$100 token prize was awarded by RSA Security for the factorization, which was donated to the Free Software Foundation.
The value and factorization are as follows:
 RSA-129 = 114381625757888867669235779976146612010218296721242362562561842935706935245733897830597123563958705058989075147599290026879543541
 RSA-129 = 3490529510847650949147849619903898133417764638493387843990820577
 × 32769132993266709549961988190834461413177642967992942539798288533
The factorization was found using the Multiple Polynomial Quadratic Sieve algorithm.
The factoring challenge included a message encrypted with RSA-129. When decrypted using the factorization the message was revealed to be "The Magic Words are Squeamish Ossifrage".
In 2015, RSA-129 was factored in about one day, with the CADO-NFS open source implementation of number field sieve, using a commercial cloud computing service for about $30.
RSA-130.
RSA-130 has 130 decimal digits (430 bits), and was factored on April 10, 1996, by a team led by Arjen K. Lenstra and composed of Jim Cowie, Marije Elkenbracht-Huizing, Wojtek Furmanski, Peter L. Montgomery, Damian Weber and Joerg Zayer.
The factorization was found in the third trial.
The value and factorization are as follows:
 RSA-130 = 1807082088687404805951656164405905566278102516769401349170127021450056662540244048387341127590812303371781887966563182013214880557
 RSA-130 = 39685999459597454290161126162883786067576449112810064832555157243
 × 45534498646735972188403686897274408864356301263205069600999044599
The factorization was found using the Number Field Sieve algorithm and the polynomial
 5748302248738405200 x5 + 9882261917482286102 x4
 - 13392499389128176685 x3 + 16875252458877684989 x2
 + 3759900174855208738 x1 - 46769930553931905995
which has a root of 12574411168418005980468 modulo RSA-130.
RSA-140.
RSA-140 has 140 decimal digits (463 bits), and was factored on February 2, 1999, by a team led by Herman te Riele and composed of Stefania Cavallar, Bruce Dodson, Arjen K. Lenstra, Paul Leyland, Walter Lioen, Peter L. Montgomery, Brian Murphy and Paul Zimmermann.
The value and factorization are as follows:
 RSA-140 = 21290246318258757547497882016271517497806703963277216278233383215381949984056495911366573853021918316783107387995317230889569230873441936471
 RSA-140 = 3398717423028438554530123627613875835633986495969597423490929302771479
 × 6264200187401285096151654948264442219302037178623509019111660653946049
The factorization was found using the Number Field Sieve algorithm and an estimated 2000 MIPS-years of computing time.
The matrix had 4671181 rows and 4704451 columns and weight 151141999 (32.36 nonzeros per row)
RSA-150.
RSA-150 has 150 decimal digits (496 bits), and was withdrawn from the challenge by RSA Security. RSA-150 was eventually factored into two 75-digit primes by Aoki et al. in 2004 using the general number field sieve (GNFS), years after bigger RSA numbers that were still part of the challenge had been solved.
The value and factorization are as follows:
 RSA-150 = 155089812478348440509606754370011861770654545830995430655466945774312632703463465954363335027577729025391453996787414027003501631772186840890795964683
 RSA-150 = 348009867102283695483970451047593424831012817350385456889559637548278410717
 × 445647744903640741533241125787086176005442536297766153493419724532460296199
RSA-155.
RSA-155 has 155 decimal digits (512 bits), and was factored on August 22, 1999, in a span of six months, by a team led by Herman te Riele and composed of Stefania Cavallar, Bruce Dodson, Arjen K. Lenstra, Walter Lioen, Peter L. Montgomery, Brian Murphy, Karen Aardal, Jeff Gilchrist, Gerard Guillerm, Paul Leyland, Joel Marchand, François Morain, Alec Muffett, Craig Putnam, Chris Putnam and Paul Zimmermann.
The value and factorization are as follows:
 RSA-155 = 10941738641570527421809707322040357612003732945449205990913842131476349984288934784717997257891267332497625752899781833797076537244027146743531593354333897
 RSA-155 = 1026395928297411057720541965739916759007165678080380668033419335217907113077
 79
 × 1066034883801684548209272203600128786792079585759892915222706082371930628086
 43
The factorization was found using the general number field sieve algorithm and an estimated 8000 MIPS-years of computing time.
The polynomials were 119377138320*x^5 - 80168937284997582*y*x^4 - 66269852234118574445*y^2*x^3 + 11816848430079521880356852*y^3*x^2 + 7459661580071786443919743056*y^4*x - 40679843542362159361913708405064*y^5 and x - 39123079721168000771313449081*y (this pair has a yield of relations approximately 13.5 times that of a random polynomial selection); 124722179 relations were collected in the sieving stage; the matrix had 6699191 rows and 6711336 columns and weight 417132631 (62.27 nonzeros per row).
RSA-160.
RSA-160 has 160 decimal digits (530 bits), and was factored on April 1, 2003, by a team from the University of Bonn and the German Federal Office for Information Security (BSI). The team contained J. Franke, F. Bahr, T. Kleinjung, M. Lochter, and M. Böhm.
The value and factorization are as follows:
 RSA-160 = 2152741102718889701896015201312825429257773588845675980170497676778133145218859135673011059773491059602497907111585214302079314665202840140619946994927570407753
 RSA-160 = 4542789285848139407168619064973883165613714577846979325095998470925000415733
 5359
 × 4738809060383201619663383230378895197326892292104095794474135464881202849390
 9367
The factorization was found using the general number field sieve algorithm.
RSA-170.
RSA-170 has 170 decimal digits (563 bits) and was first factored on December 29, 2009, by D. Bonenberger and M. Krone from Fachhochschule Braunschweig/Wolfenbüttel. An independent factorization was completed by S. A. Danilov and I. A. Popovyan two days later.
The value and factorization are as follows:
 RSA-170 = 26062623684139844921529879266674432197085925380486406416164785191859999628542069361450283931914514618683512198164805919882053057222974116478065095809832377336510711545759
 RSA-170 = 3586420730428501486799804587268520423291459681059978161140231860633948450858
 040593963
 × 7267029064107019078863797763923946264136137803856996670313708936002281582249
 587494493
The factorization was found using the general number field sieve algorithm.
RSA-576.
RSA-576 has 174 decimal digits (576 bits), and was factored on December 3, 2003, by J. Franke and T. Kleinjung from the University of Bonn. A cash prize of $10,000 was offered by RSA Security for a successful factorization.
The value and factorization are as follows:
 RSA-576 = 188198812920607963838697239461650439807163563379417382700763356422988859715234665485319060606504743045317388011303396716199692321205734031879550656996221305168759307650257059
 RSA-576 = 3980750864240649373971255005503864911990643623425267084063851895759463889572
 61768583317
 × 4727721461074353025362230719730482246329146953020971164598521711305207112563
 63590397527
The factorization was found using the general number field sieve algorithm.
RSA-180.
RSA-180 has 180 decimal digits (596 bits), and was factored on May 8, 2010, by S. A. Danilov and I. A. Popovyan from Moscow State University, Russia.
 RSA-180 = 1911479277189866096892294666314546498129862462766673548641885036388072607034
 3679905877620136513516127813425829612810920004670291298456875280033022177775
 2773957404540495707851421041
 RSA-180 = 4007800823297508779525813391041005725268293178158071765648821789984975727719
 50624613470377
 × 4769396887386118369955354773570708579399020760277882320319897758246062255957
 73435668861833
The factorization was found using the general number field sieve algorithm implementation running on three Intel Core i7 PCs.
RSA-190.
RSA-190 has 190 decimal digits (629 bits), and was factored on November 8, 2010, by I. A. Popovyan from Moscow State University, Russia, and A. Timofeev from CWI, Netherlands.
 RSA-190 = 1907556405060696491061450432646028861081179759533184460647975622318915025587
 1841757540549761551215932934922604641526300932385092466032074171247261215808
 58185985938946945490481721756401423481
 RSA-190 = 3171195257690152709485171289740475929805147316029450327784761927832793642798
 1256542415724309619
 × 6015260020444561641587641685526676183243543359471811072599763828083615704046
 0481625355619404899
RSA-640.
RSA-640 has 193 decimal digits (640 bits). A cash prize of US$20,000 was offered by RSA Security for a successful factorization. On November 2, 2005, F. Bahr, M. Boehm, J. Franke and T. Kleinjung of the German Federal Office for Information Security announced that they had factorized the number using GNFS as follows:
 RSA-640 = 3107418240490043721350750035888567930037346022842727545720161948823206440518
 0815045563468296717232867824379162728380334154710731085019195485290073377248
 22783525742386454014691736602477652346609
 RSA-640 = 1634733645809253848443133883865090859841783670033092312181110852389333100104
 508151212118167511579
 × 1900871281664822113126851573935413975471896789968515493666638539088027103802
 104498957191261465571
The computation took five months on 80 2.2 GHz AMD Opteron CPUs.
The slightly larger RSA-200 was factored in May 2005 by the same team.
RSA-200.
RSA-200 has 200 decimal digits (663 bits), and factors into the two 100-digit primes given below.
On May 9, 2005, F. Bahr, M. Boehm, J. Franke, and T. Kleinjung announced that they had factorized the number using GNFS as follows:
 RSA-200 = 2799783391122132787082946763872260162107044678695542853756000992932612840010
 7609345671052955360856061822351910951365788637105954482006576775098580557613
 579098734950144178863178946295187237869221823983
 RSA-200 = 3532461934402770121272604978198464368671197400197625023649303468776121253679
 423200058547956528088349
 × 7925869954478333033347085841480059687737975857364219960734330341455767872818
 152135381409304740185467
The CPU time spent on finding these factors by a collection of parallel computers amounted – very approximately – to the equivalent of 75 years work for a single 2.2 GHz Opteron-based computer. Note that while this approximation serves to suggest the scale of the effort, it leaves out many complicating factors; the announcement states it more precisely.
RSA-210.
RSA-210 has 210 decimal digits (696 bits) and was factored in September 2013 by Ryan Propper:
 RSA-210 = 2452466449002782119765176635730880184670267876783327597434144517150616008300
 3858721695220839933207154910362682719167986407977672324300560059203563124656
 1218465817904100131859299619933817012149335034875870551067
 RSA-210 = 4359585683259407917999519653872144063854709102652201963187054821445240853452
 75999740244625255428455944579
 × 5625457617268841037562770073044474817438769440075105451049468510945483965774
 79473472146228550799322939273
RSA-704.
RSA-704 has 212 decimal digits (704 bits), and was factored by Shi Bai, Emmanuel Thomé and Paul Zimmermann. The factorization was announced July 2, 2012. A cash prize of US$30,000 was previously offered for a successful factorization.
 RSA-704 = 7403756347956171282804679609742957314259318888923128908493623263897276503402
 8266276891996419625117843995894330502127585370118968098286733173273108930900
 552505116877063299072396380786710086096962537934650563796359
 RSA-704 = 9091213529597818878440658302600437485892608310328358720428512168960411528640
 933367824950788367956756806141
 × 8143859259110045265727809126284429335877899002167627883200914172429324360133
 004116702003240828777970252499
RSA-220.
RSA-220 has 220 decimal digits (729 bits), and was factored by S. Bai, P. Gaudry, A. Kruppa, E. Thomé and P. Zimmermann. The factorization was announced on May 13, 2016.
 RSA-220 = 2260138526203405784941654048610197513508038915719776718321197768109445641817
 9666766085931213065825772506315628866769704480700018111497118630021124879281
 99487482066070131066586646083327982803560379205391980139946496955261
 RSA-220 = 6863656412267566274382371499288437800130842239979164844621244993321541061441
 4642667938213644208420192054999687
 × 3292907439486349812049301549212935291916455196536233952462686051169290349309
 4652463337824866390738191765712603
RSA-230.
RSA-230 has 230 decimal digits (762 bits), and was factored by Samuel S. Gross on August 15, 2018.
 RSA-230 = 1796949159794106673291612844957324615636756180801260007088891883553172646034
 1490933493372247868650755230855864199929221814436684722874052065257937495694
 3483892631711525225256544109808191706117425097024407180103648316382885188526
 89
 RSA-230 = 4528450358010492026612439739120166758911246047493700040073956759261590397250
 033699357694507193523000343088601688589
 × 3968132623150957588532394439049887341769533966621957829426966084093049516953
 598120833228447171744337427374763106901
RSA-232.
RSA-232 has 232 decimal digits (768 bits), and was factored on February 17, 2020, by N. L. Zamarashkin, D. A. Zheltkov and S. A. Matveev.
 RSA-232 = 1009881397871923546909564894309468582818233821955573955141120516205831021338
 5285453743661097571543636649133800849170651699217015247332943892702802343809
 6090980497644054071120196541074755382494867277137407501157718230539834060616
 2079
 RSA-232 = 2966909333208360660361779924242630634742946262521852394401857157419437019472
 3262390744910112571804274494074452751891
 × 3403816175197563438006609498491521420547121760734723172735163413276050706174
 8526506443144325148088881115083863017669
RSA-768.
RSA-768 has 232 decimal digits (768 bits), and was factored on December 12, 2009, over the span of two years, by Thorsten Kleinjung, Kazumaro Aoki, Jens Franke, Arjen K. Lenstra, Emmanuel Thomé, Pierrick Gaudry, Alexander Kruppa, Peter Montgomery, Joppe W. Bos, Dag Arne Osvik, Herman te Riele, Andrey Timofeev, and Paul Zimmermann.
 RSA-768 = 1230186684530117755130494958384962720772853569595334792197322452151726400507
 2636575187452021997864693899564749427740638459251925573263034537315482685079
 1702612214291346167042921431160222124047927473779408066535141959745985690214
 3413
 RSA-768 = 3347807169895689878604416984821269081770479498371376856891243138898288379387
 8002287614711652531743087737814467999489
 × 3674604366679959042824463379962795263227915816434308764267603228381573966651
 1279233373417143396810270092798736308917
The CPU time spent on finding these factors by a collection of parallel computers amounted approximately to the equivalent of almost 2000 years of computing on a single-core 2.2 GHz AMD Opteron-based computer.
RSA-240.
RSA-240 has 240 decimal digits (795 bits), and was factored in November 2019 by Fabrice Boudot, Pierrick Gaudry, Aurore Guillevic, Nadia Heninger, Emmanuel Thomé and Paul Zimmermann.
 RSA-240 = 1246203667817187840658350446081065904348203746516788057548187888832896668011
 8821085503603957027250874750986476843845862105486553797025393057189121768431
 8286362846948405301614416430468066875699415246993185704183030512549594371372
 159029236099
 RSA-240 = 5094359522858399145550510235808437141326483820241114731866602965218212064697
 46700620316443478873837606252372049619334517
 × 2446242088383181505678131390240028966538020925789314014520412213365584770951
 78155258218897735030590669041302045908071447
The CPU time spent on finding these factors amounted to approximately 900 core-years on a 2.1 GHz Intel Xeon Gold 6130 CPU. Compared to the factorization of RSA-768, the authors estimate that better algorithms sped their calculations by a factor of 3–4 and faster computers sped their calculation by a factor of 1.25–1.67.
RSA-250.
RSA-250 has 250 decimal digits (829 bits), and was factored in February 2020 by Fabrice Boudot, Pierrick Gaudry, Aurore Guillevic, Nadia Heninger, Emmanuel Thomé, and Paul Zimmermann. The announcement of the factorization occurred on February 28.
 RSA-250 = 2140324650240744961264423072839333563008614715144755017797754920881418023447
 1401366433455190958046796109928518724709145876873962619215573630474547705208
 0511905649310668769159001975940569345745223058932597669747168173806936489469
 9871578494975937497937
 RSA-250 = 6413528947707158027879019017057738908482501474294344720811685963202453234463
 0238623598752668347708737661925585694639798853367
 × 3337202759497815655622601060535511422794076034476755466678452098702384172921
 0037080257448673296881877565718986258036932062711
The factorisation of RSA-250 utilised approximately 2700 CPU core-years, using a 2.1 GHz Intel Xeon Gold 6130 CPU as a reference. The computation was performed with the Number Field Sieve algorithm, using the open source CADO-NFS software.
The team dedicated the computation to Peter Montgomery, an American mathematician known for his contributions to computational number theory and cryptography who died on February 18, 2020, and had contributed to factoring