Why has the RSA factoring challenge been withdrawn?

Question

Wikipedia states that RSA challenge has been withdrawn.

Does it mean that an efficient factoring algorithm is "just around the corner"?

or are there some other reasons?

If the challenge was still open people would have even more confidence in RSA.

Answer 1

RSA themselves (the company) say this in their RSA Factoring Challenge FAQ:

Why is the RSA Factoring Challenge no longer active?

Various cryptographic challenges — including the RSA Factoring Challenge — served in the early days of commercial cryptography to measure the state of progress in practical cryptanalysis and reward researchers for the new knowledge they have brought to the community. Now that the industry has a considerably more advanced understanding of the cryptanalytic strength of common symmetric-key and public-key algorithms, these challenges are no longer active. The records, however, are presented here for reference by interested cryptographers.

This, of course, does not really answer the question. Although there have been many optimizations, and computers have quite grown in both CPU power and RAM size, the best known algorithms for factorization have not qualitatively changed since the late 1980s, when the General Number Field Sieve was discovered. Even with GNFS, today's computers, and the fine brains of the authors of the RSA-768 factorization, a 1024-bit RSA modulus still seems out of reach. The money at stake was sizeable for an individual, but not that much for a company such as RSA (there was a 100k\$ prize on RSA-1024, 150k\$ for RSA-1536 and 200k\$ for RSA-2048; RSA Security appears to have a yearly revenue of more than 700 millions of dollars).

My guess is that they withdrew the challenges for a mixture of the two following reasons:

• When a RSA challenge is broken, it makes bad press, and the press is worse if there is a prize, because it may serve as an highlight on the event (which is otherwise extremely technical).

• An open challenge with a prize implies some kind of provisioning, which is bound to upset someone in the accounting department.

So, at some point, RSA Security decided that the inconvenience of maintaining the challenges exceeded the inconvenience of withdrawing (which your question incarnates: a suspicion of potential weaknesses).

One might notice that the withdrawal happened at about the same time than the bulk of the sieving work for RSA-768 began -- I do not have the exact timing, but it is conceivable that the withdrawal decision had been pending for awhile, and was triggered by rumours of the RSA-768 factorization effort.