Factorization is the problem of taking an integer and finding the set of prime numbers that produce the integer when multiplied together. For large integers with large factors, factorization is hard and is the basis for cryptosystems like RSA.

learn more… | top users | synonyms

3
votes
2answers
127 views

Collision free one way function

I was playing with a function that I think is collision free and uninvertible assuming the hardness of integer factorization. I am unfortunately not as skilled at math as I would like to be, and do ...
6
votes
2answers
111 views

Effect of $L_n[1/4,c]$ integer factorization on RSA-2048

Using the L-notation, integer factorization of an integer $n$ has the best known complexity of $L_n[1/3,c]$ using general number field sieve. Would discovery of an algorithm with complexity ...
6
votes
1answer
110 views

Proof of RSA security dependent on public key exponent

I am writing a (high-school) paper on the public key exponent's (in textbook RSA - no padding is discussed!) significance in terms of time and security. The time part is done; as for the security ...
3
votes
2answers
92 views

RSA and difference between factors

As I understand, for RSA $n = p \cdot q$. For the key to be safe enough from getting factored, $p$ and $q$ have to be far from each other. How far do they have to be? For example, if I have two ...
3
votes
1answer
32 views

Does Coppersmith's method always finds non-trivial factor of integers of the form $n=a(2^k b+1)$ assuming $1 < a<2^k b +1$ and $b < n^{1/4-0.05}$?

Crossposted from mathoverflow. Got an argument and numeric evidence that pari's implementation of Coppersmith's method finds non trivial factor of integers of certain form under some assumptions very ...
3
votes
2answers
174 views

How can I factorize a 350 bit (106 decimal digits) number in two prime factors?

I have this large number: 1728098743723095094470726818328193358068864405124007684733613106475812450278961107574624070107782941006379 which is the multiplication of two unknown large prime numbers. I ...
1
vote
1answer
27 views

Checking for factor base

In algorithms like Dixon's factorization a factor base is used, which contains all primes below a bound. Then calculates $x^2 \mod n$, and then checks it is in factor base or not. Suppose $P$ is ...
1
vote
1answer
58 views

Time complexity of trial division

Suppose $n=pq$, where p,q are prime numbers. let $p ( \le q)$ be the smallest prime, then we know that $p \le \sqrt{n}$. In trail division, we check $n \mod i$ for the values of $i$ from 2 to ...
4
votes
1answer
75 views

Adding two RSA private key

We've constructed a new private RSA key from two known private RSA keys $Priv_1$ and $Priv_2$ as follows: $$p = next\underline{}prime\left(\frac{Priv_1(p) + Priv_2(p)}{2}\right)$$ and $$q = ...
1
vote
1answer
65 views

Factors of the group order to secure against Pohlig-Hellman

I am looking into the security of Diffie-Hellman and the discrete log in general. To make sure an attacker can not use Pohlig-Hellman to solve the discrete log quickly we need to make sure that the ...
0
votes
1answer
46 views

Algorithm for factoring a number $n$ of a specific form given $n$ and $\varphi(n)$

Given the natural number $n$, which is in the form $p^2 \cdot q^2$ with $p$,$q$ prime numbers. Also $\varphi(n)$ is given. Describe a fast algorithm (polynomial time) that calculates $p$ and $q$. ...
3
votes
0answers
35 views

Blinding to mask private key operations

Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, its used in both RSA and Rabin-Williams signature schemes. This presumes ...
3
votes
2answers
106 views

Why is Rabin encryption equivalent to factoring?

I don't understand the proof of equivalence I've read everywhere (e.g., in Rabin's paper or on Wikipedia). Here's my objection: let's say you have a Rabin decryption oracle that takes ...
2
votes
1answer
563 views

Why should the primes used in RSA be distinct?

The two primes $p$ and $q$ part of the public key need to be distinct. What's the reason for them to be distinct? Is it because factorization of $p^2$ where $p$ is a prime is relatively easier, or is ...
2
votes
0answers
25 views

Are there UFDs where the factorization problem is difficult but finding irreducibles is cheap?

Factorization of integers is hard, but finding irreducibles is expensive. Is there a ring where factorization is assumed hard but finding irreducibles is much cheaper than over $\Bbb Z$? It could ...
3
votes
1answer
85 views

Logjam-style attack on Factoring?

We're all aware of the Logjam attack, which is known as "FREAK on discrete logarithms". The attack works by doing a large pre-computation step, which needs only to be done once per field and then ...
2
votes
1answer
272 views

Attack for RSA 1024 bit with Low Public Exponent

I am facing a challenge at university. Our teacher give us the challenge to try to break an RSA 1024 bit. We have public modulus N and public exponent e (0x03), we don't know the padding. We have a ...
2
votes
3answers
127 views

Can spatial filters be used to factor composite numbers?

$Z=(N-XY)^2$ is a surface with absolute minima ($0s$) anywere $Y=N/X$. I know this question is naiive, but shouldn't it be possible to apply a lossy compression filter to this function which ...
1
vote
1answer
79 views

If someone had a list of all primes, would it be possible for them to factor any integer in polynomial time? [duplicate]

For example, if they somehow got a function that would churn out any arbitrary amount of primes in a row. Could they break the RSA problem then?
4
votes
1answer
152 views

Prime factorization

What is the largest integer that can be factored by modern algorithm like Msieve and GGNFS in a time less than 5 hours with normal computers? For example, can an integer like ...
7
votes
1answer
138 views

Factoring two RSA moduli $N_i=p_i\cdot q_i$ knowing that $p_2=p_1+2$?

It is given two RSA moduli $N_1$ and $N_2$, known to be of the form $N_i=p_i\cdot q_i$, with $p_i$ and $q_i$ unknown primes, and such that $p_2=p_1+2$. Can we make use of that relation to factor the ...
1
vote
0answers
51 views

Zero knowledge of two factor

Here I overconfident in myself state that I can show, that n has two factors. This is not completely true, can possibly show $n$ is composite - prover generates RSA key with modulo $n$, and gives $e$ ...
7
votes
2answers
122 views

Are factorization algorithms parallelizable?

I was reading about the Blum-Blum-Shub random number generator, and its security depends on the hardness of factoring very large numbers (like many things in crypto do). I'm just wondering, if I have ...
1
vote
0answers
68 views

Is the half-homomorphic property of RSA a problem for blind RSA signatures?

For blind RSA signatures, is it problematic that RSA is half-homomorph? Take a scenario where blind RSA signatures are used for something like a voting procedure or this proposal: Lots of people, ...
1
vote
1answer
70 views

How to choose the integer m in the general number field sieve (GNFS)?

Given an integer you want to factor $N$, GNFS starts by selecting a monic irreducible polynomial $f \in \mathbb{Z}[X]$ and an integer $m$ such that $f(m) \equiv 0 \text{ mod } N$. In practice, if $m$ ...
1
vote
1answer
152 views

Why is factoring $p-1$ easy when $p$ is a safe prime?

A paper states: [...] $(p,g,y)$ is a correct ElGamal public key if $g^x=y\pmod p$. To verify this the order of $g$, and thus the factorization of $p-1$, is needed. This is easy for safe primes ...
1
vote
3answers
233 views

Programming language for modular arithmetic over large numbers [closed]

I'am trying to implement algorithms on integer factorization.This involves dealing with integers of 200-500 digits and doing modular arithmetic over them.Which programming language has inbuilt support ...
1
vote
2answers
235 views

Factors of RSA modulus

In the article A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any ...
0
votes
0answers
28 views

How to find the factors of the modulus? [duplicate]

In the article "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems", the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any ...
3
votes
0answers
120 views

Relations between RSA and DLOG, factoring and DLOG

Definition: (The generalized Diffie-Hellman problem) Let $n=pq$ for two large primes $p,q$. Given $x, x^a, x^b,n$, find $x^{ab}\pmod{n}$. (1) Is there a known reduction from the GDH problem ...
2
votes
1answer
273 views

Discrete logarithm modulo a smooth number

I am solving the discrete logarithm problem modulo $N$. $N$ is a composite number, I found its factors — lots of small primes and two big primes ($> 2^{50}$). Does the factorization of $N$ somehow ...
1
vote
1answer
101 views

What is the value of Q such that Q|P-1 where P is a prime number?

For my crypto assignment, I'm asked to enter a prime P and generate Q such that Q|P-1 Can anyone guide me what is Q|P-1?
2
votes
1answer
301 views

Square roots, prime factorization

I´m stuck in my homework and since its homework, I would rather get some hints than full solution. The problem goes: factorize n = 88416763 in case that you know that the square roots of 51733469 ...
1
vote
1answer
268 views

Compare two approaches for cracking RSA key

I came across these questions while studying for a crypto course, does anyone have any ideas on how to answer these? (a) Random prime numbers of size 1536 bits are chosen to generate an RSA modulus ...
7
votes
1answer
443 views

Adi Shamir's secret database of all primes

I was going through these presentation slides (PDF) on Crypto 2013. It summarizes the paper, Factoring RSA keys from certified smart cards: Coppersmith in the wild. In the last slide, it was ...
1
vote
1answer
158 views

Brute force RSA cracking

Suppose one had a complete list of primes up to $2^{n+1}-1$. Then wouldn't one be able to crack an $n$-bit RSA public key in time $O(\pi(2^{n+1}-1))$, making RSA insecure? Thanks, René
1
vote
1answer
53 views

Computational Diffie-Hellman problem over the group of quadratic residues

Suppose that $N=pq$ where $p$ and $q$ are safe primes. $\mathbb{QR}_N$ is the group of quadratic residues which is a cyclic group with order $\frac{\phi(N)}{4}$. Let $g$ be the generator of ...
4
votes
1answer
361 views

Is knowing the private key of RSA equivalent to the factorization of $N$?

Given the RSA modulus $N$ the fastest method to factor it is of sub-exponent order. But, now if I know the private key $d$ of RSA, does that mean I can factor $N$ efficiently?. It intuitively seems ...
0
votes
1answer
54 views

From Factorisation of semiprimes to breaching confidentiality

If someone or some group found an efficient way to factor large composites with two distinct prime divisors, would this make it easier to decode any messages?
7
votes
2answers
332 views

RSA: Letting $p$ and $q$ have different bit-size

I am aware that there are concerns if $p$ and $q$ are close i.e. $\Delta=|p-q|$ can't be too small. But I would like to know if there are any known attacks for cases where $p$ and $q$ take on ...
3
votes
1answer
145 views

Quadratic Sieve: what's the next step after it fails?

Factoring some 20-45 digit values n with a (simple) quadratic sieve, the quadratic sieve may end up with pairs of x and y s.t. $x^2 \equiv y^2 \pmod n$, but neither x+y nor x-y has a nontrivial gcd ...
5
votes
0answers
192 views

How can I create an RSA modulus for which no one knows the factors?

It's easy to create an RSA modulus where almost no one knows the factors: for example, I can generate two 1024-bit primes $p$ and $q$ and set $n=pq$. If I publish $n$, I will be the only person in ...
1
vote
0answers
116 views

Determine the iteration times using Pollard's rho Method for factoring

Let's say, we have a large number $n=181937053$ and $f(x)=x^2+1$. And also we know that $n=12391 \times 14683$. The problem is that ,using Pollard rho method, can we find the algorithm iteration ...
4
votes
1answer
774 views

Why can ECC key sizes be smaller than RSA keys for similar security?

I understand how ECC is based on the discrete log problem and RSA on integer factorization. I've read several references that show how a solution to either of these problems can typically be adapted ...
8
votes
1answer
462 views

What does “Inverting the RSA function is as hard as factoring” mean (a rigorous explanation or intuitive will do)?

I was reading that a current open problem is if inverting the RSA function is as hard as factoring. Does this mean that, its an open problem whether, if given a subroutine that computes in ...
1
vote
0answers
154 views

Distributed integer factorization?

I'm looking around for publicly published work on factorization of large numbers using distributed systems of any kind. So far I've come across the PDF "Mapreduce for integer factorization" by Javier ...
2
votes
3answers
308 views

Is it possible to attack RSA with a WalkSat derivative?

We consider a large $n$-bit number $N$. We want to find a factor, if it admits any. For $m$ taking values from $1$ to $n$, perform the following three steps (actually, for each $m$, perform many ...
2
votes
1answer
303 views

Elliptic Curve Factorization: Why are elliptic curves suited for this kind of task?

Currently I'm working on a presentation of a paper that talks about the factorization of large numbers. In the paper elliptic curves are presented as a way to factorize large numbers. After hearing a ...
-1
votes
1answer
312 views

Factoring large numbers

I am trying to factor few integers that are each between 115 and 135 digits long. I was wondering if anyone knew of any efficient methods or any programs that I could use to find the two primes $p$ ...
0
votes
1answer
128 views

What is the difference between exhaustive search and factorization in relationship to determining a key?

It seems to me an exhaustive search would simply try to use all the possible bit combinations of a key, while factorization is some mathematical formula for determining the key? When discussing the ...