Factorization is the problem of taking an integer and finding the set of prime numbers that produce the integer when multiplied together. For large integers with large factors, factorization is hard and is the basis for cryptosystems like RSA.

learn more… | top users | synonyms

2
votes
1answer
67 views

Can spatial filters be used to factor composite numbers?

$Z=(N-XY)^2$ is a surface with absolute minima ($0s$) anywere $Y=N/X$. I know this question is naiive, but shouldn't it be possible to apply a lossy compression filter to this function which ...
0
votes
1answer
60 views

If someone had a list of all primes, would it be possible for them to factor any integer in polynomial time? [duplicate]

For example, if they somehow got a function that would churn out any arbitrary amount of primes in a row. Could they break the RSA problem then?
4
votes
0answers
86 views

Prime factorization

What is the largest integer that can be factored by modern algorithm like Msieve and GGNFS in a time less than 5 hours with normal computers? For example, can an integer like ...
7
votes
1answer
124 views

Factoring two RSA moduli $N_i=p_i\cdot q_i$ knowing that $p_2=p_1+2$?

It is given two RSA moduli $N_1$ and $N_2$, known to be of the form $N_i=p_i\cdot q_i$, with $p_i$ and $q_i$ unknown primes, and such that $p_2=p_1+2$. Can we make use of that relation to factor the ...
1
vote
0answers
32 views

Zero knowledge of two factor

Here I overconfident in myself state that I can show, that n has two factors. This is not completely true, can possibly show $n$ is composite - prover generates RSA key with modulo $n$, and gives $e$ ...
2
votes
1answer
68 views

Are factorization algorithms parallelizable?

I was reading about the Blum-Blum-Shub random number generator, and its security depends on the hardness of factoring very large numbers (like many things in crypto do). I'm just wondering, if I have ...
1
vote
0answers
48 views

Is the half-homomorphic property of RSA a problem for blind RSA signatures?

For blind RSA signatures, is it problematic that RSA is half-homomorph? Take a scenario where blind RSA signatures are used for something like a voting procedure or this proposal: Lots of people, ...
1
vote
1answer
50 views

How to choose the integer m in the general number field sieve (GNFS)?

Given an integer you want to factor $N$, GNFS starts by selecting a monic irreducible polynomial $f \in \mathbb{Z}[X]$ and an integer $m$ such that $f(m) \equiv 0 \text{ mod } N$. In practice, if $m$ ...
1
vote
1answer
121 views

Why is factoring $p-1$ easy when $p$ is a safe prime?

A paper states: [...] $(p,g,y)$ is a correct ElGamal public key if $g^x=y\pmod p$. To verify this the order of $g$, and thus the factorization of $p-1$, is needed. This is easy for safe primes ...
1
vote
3answers
101 views

Programming language for modular arithmetic over large numbers [closed]

I'am trying to implement algorithms on integer factorization.This involves dealing with integers of 200-500 digits and doing modular arithmetic over them.Which programming language has inbuilt support ...
0
votes
2answers
160 views

Factors of RSA modulus

In the article A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any ...
0
votes
0answers
27 views

How to find the factors of the modulus? [duplicate]

In the article "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems", the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any ...
3
votes
0answers
82 views

Relations between RSA and DLOG, factoring and DLOG

Definition: (The generalized Diffie-Hellman problem) Let $n=pq$ for two large primes $p,q$. Given $x, x^a, x^b,n$, find $x^{ab}\pmod{n}$. (1) Is there a known reduction from the GDH problem ...
2
votes
1answer
124 views

Discrete logarithm modulo a smooth number

I am solving the discrete logarithm problem modulo $N$. $N$ is a composite number, I found its factors — lots of small primes and two big primes ($> 2^{50}$). Does the factorization of $N$ somehow ...
1
vote
1answer
77 views

What is the value of Q such that Q|P-1 where P is a prime number?

For my crypto assignment, I'm asked to enter a prime P and generate Q such that Q|P-1 Can anyone guide me what is Q|P-1?
2
votes
1answer
232 views

Square roots, prime factorization

I´m stuck in my homework and since its homework, I would rather get some hints than full solution. The problem goes: factorize n = 88416763 in case that you know that the square roots of 51733469 ...
1
vote
1answer
199 views

Compare two approaches for cracking RSA key

I came across these questions while studying for a crypto course, does anyone have any ideas on how to answer these? (a) Random prime numbers of size 1536 bits are chosen to generate an RSA modulus ...
0
votes
0answers
35 views

Hard problems in composite order group even when factorization is known

Composite discrete log problem has been proved to be reducible to hardness of factorization and discrete log on the prime factor groups. Are there any problems apart from that in composite order ...
5
votes
1answer
316 views

Adi Shamir's secret database of all primes

I was going through these presentation slides (PDF) on Crypto 2013. It summarizes the paper, Factoring RSA keys from certified smart cards: Coppersmith in the wild. In the last slide, it was ...
1
vote
1answer
127 views

Brute force RSA cracking

Suppose one had a complete list of primes up to $2^{n+1}-1$. Then wouldn't one be able to crack an $n$-bit RSA public key in time $O(\pi(2^{n+1}-1))$, making RSA insecure? Thanks, René
1
vote
1answer
44 views

Computational Diffie-Hellman problem over the group of quadratic residues

Suppose that $N=pq$ where $p$ and $q$ are safe primes. $\mathbb{QR}_N$ is the group of quadratic residues which is a cyclic group with order $\frac{\phi(N)}{4}$. Let $g$ be the generator of ...
4
votes
1answer
315 views

Is knowing the private key of RSA equivalent to the factorization of $N$?

Given the RSA modulus $N$ the fastest method to factor it is of sub-exponent order. But, now if I know the private key $d$ of RSA, does that mean I can factor $N$ efficiently?. It intuitively seems ...
0
votes
1answer
51 views

From Factorisation of semiprimes to breaching confidentiality

If someone or some group found an efficient way to factor large composites with two distinct prime divisors, would this make it easier to decode any messages?
7
votes
2answers
263 views

RSA: Letting $p$ and $q$ have different bit-size

I am aware that there are concerns if $p$ and $q$ are close i.e. $\Delta=|p-q|$ can't be too small. But I would like to know if there are any known attacks for cases where $p$ and $q$ take on ...
3
votes
1answer
123 views

Quadratic Sieve: what's the next step after it fails?

Factoring some 20-45 digit values n with a (simple) quadratic sieve, the quadratic sieve may end up with pairs of x and y s.t. $x^2 \equiv y^2 \pmod n$, but neither x+y nor x-y has a nontrivial gcd ...
5
votes
0answers
157 views

How can I create an RSA modulus for which no one knows the factors?

It's easy to create an RSA modulus where almost no one knows the factors: for example, I can generate two 1024-bit primes $p$ and $q$ and set $n=pq$. If I publish $n$, I will be the only person in ...
1
vote
0answers
75 views

Determine the iteration times using Pollard's rho Method for factoring

Let's say, we have a large number $n=181937053$ and $f(x)=x^2+1$. And also we know that $n=12391 \times 14683$. The problem is that ,using Pollard rho method, can we find the algorithm iteration ...
3
votes
1answer
418 views

Why can ECC key sizes be smaller than RSA keys for similar security?

I understand how ECC is based on the discrete log problem and RSA on integer factorization. I've read several references that show how a solution to either of these problems can typically be adapted ...
6
votes
1answer
339 views

What does “Inverting the RSA function is as hard as factoring” mean (a rigorous explanation or intuitive will do)?

I was reading that a current open problem is if inverting the RSA function is as hard as factoring. Does this mean that, its an open problem whether, if given a subroutine that computes in ...
1
vote
0answers
122 views

Distributed integer factorization?

I'm looking around for publicly published work on factorization of large numbers using distributed systems of any kind. So far I've come across the PDF "Mapreduce for integer factorization" by Javier ...
2
votes
3answers
297 views

Is it possible to attack RSA with a WalkSat derivative?

We consider a large $n$-bit number $N$. We want to find a factor, if it admits any. For $m$ taking values from $1$ to $n$, perform the following three steps (actually, for each $m$, perform many ...
2
votes
1answer
193 views

Elliptic Curve Factorization: Why are elliptic curves suited for this kind of task?

Currently I'm working on a presentation of a paper that talks about the factorization of large numbers. In the paper elliptic curves are presented as a way to factorize large numbers. After hearing a ...
1
vote
0answers
216 views

Factoring large numbers

I am trying to factor few integers that are each between 115 and 135 digits long. I have just, little over a month ago, began my study of Cryptography. I was wondering if anyone knew of any efficient ...
0
votes
1answer
107 views

What is the difference between exhaustive search and factorization in relationship to determining a key?

It seems to me an exhaustive search would simply try to use all the possible bit combinations of a key, while factorization is some mathematical formula for determining the key? When discussing the ...
2
votes
0answers
99 views

What role plays Quantum Fourier Transformation in Shor's integer factorization algorithm?

I cannot seem to understand the role or goal of Quantum Fourier Transformation in Shor's integer factorization algorithm. Is it used to collapse all quantum states into one, in which it has a factor ...
5
votes
1answer
258 views

How can I take advantage of repeated patterns in non random RSA prime factors?

I am researching vulnerable RSA moduli which are composed of primes generated with poor entropy. Having a list of these primes I searched for variable sized repeated patterns among them and I noticed ...
3
votes
2answers
289 views

Is it possible that two distinct RSA moduli share both of their prime factors?

I am using an algorithm (can be found here1) that can compute efficiently the GCD of multiple RSA keys. It intended for RSA keys that were generated with low entropy and may have one of their primes ...
1
vote
1answer
207 views

Relationship between Elliptic Curve Discrete Log, Integer Discrete Log, and Integer Factorization

I am trying to look into a relation between the following three problems which are widely used to build public crypto systems: Integer Discrete log Elliptic Curve Discrete log Integer Factorization ...
1
vote
1answer
411 views

Discrete log problem with modulus prime

I am a bit confused on the hardness of the discrete logarithm problem. Does it become intractale only when it is mod n, where n is a large composite number (Like RSA key). What about if it is mod a ...
1
vote
1answer
128 views

Does it necessarily mean that an RSA moduli generated with poor randomness is not random?

In 2012 a group of researchers collected a large amount of RSA moduli and calculated their greatest common divisor in order to find common factors between them. By finding a common factor they could ...
6
votes
1answer
211 views

What is the difference between Shor's algorithm for factoring and Shor's algorithm for logarithm

There is a paper from Peter W. Shor from 1994: http://www.csee.wvu.edu/~xinl/library/papers/comp/shor_focs1994.pdf "Algorithms for Quantum Computation: Discrete Logarithms and Factoring", and I have a ...
1
vote
1answer
863 views

Reduction of Integer factorization to Discrete logarithm problem

I was reading Eric Bach paper entitles "Discrete logarithms and factoring", in which he states the following reductions: solving the integer factorization problem suffices to solve the discrete ...
3
votes
2answers
221 views

Efficiency of finding sub group order vs factorization

Suppose you got a prime $p = 2\mathbb\Pi_{i=0}^{n-1}q_i+1$, where $2^{k-1} \lt q_i \lt 2^k$ for some $k$ and all $0 \le i \lt n$, and that you also got a generator $g$ of one of the prime order sub ...
3
votes
2answers
229 views

Quadratic residuosity problem reduction to integer factorization

How can one show how to reduce the quadratic residuosity problem to an integer factorization?
-1
votes
1answer
189 views

Integer factorization via geometric mean problem

presume: we have A and B integers, and C - product of multiplication of A and B, A and B are prime numbers (strong or usual) G - is geometric mean of A and B (square root of C) also, we have: if B > ...
5
votes
2answers
639 views

uniqueness of the RSA public modulus

What is the probability that two separate RSA public moduli are the same? For example, consider a 2048-bit modulus. The number seems to be huge, but the choice for prime factors p and q is much more ...
2
votes
1answer
208 views

How did they factor RSA-704?

I don't understand the 'Wiedemann algorithm' works. Can someone explain the factoring of RSA-704 in an easy way?
1
vote
0answers
70 views

Why is it impractical to generate a semiprime dictionary? [duplicate]

This might be a very simple question. However, I am just learning the concept, so just excuse me. I am wondering why there is not any attempt to generate all semiprime numbers? (as an dict. attack to ...
15
votes
1answer
3k views

Security strength of RSA in relation with the modulus size

NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits: ...
8
votes
5answers
497 views

RSA leak bits to factor N

Suppose you randomly generate large primes p and q as in RSA, and then tell me N=pq but not p or q. Then, you would like to actually let me factor N, except you should tell me as few bits of ...