# Upper bounds on difference of RSA primes

I was wondering whether given a concrete $$N = p \cdot q$$ whether we can find a upper bound on $$\Delta = | p - q|$$ as function of $$N$$ e.g, $$N^\delta$$, and thus test whether a given $$N$$ is vulnerable to Fermat-Factoring?

• Marc, are trying to say; in case of security, what are the bound of the difference $a < |p-q| < b$ Nov 8, 2018 at 13:41
• @kelalaka, Yes I am wondering if it is possible to detect unsafe primes for RSA. "IF" it ever happens and in a way that It can be factored using Fermat's method. Nov 8, 2018 at 14:33

## 1 Answer

Given that $$p$$ and $$q$$ are prime, they must be at least $$2$$, so $$|p-q| \le \frac 12N - 2$$. I'm pretty sure that's the only hard upper bound one can give.

Of course, typically $$p$$ and $$q$$ are chosen at random from among primes having the same bitlength in binary, meaning that the expected value of $$|p-q|$$ is roughly proportional to $$N^{\frac12}$$.

• Thanks for your answer, the hidden intent behind the question was also with regard to Fermat factoring methods and variants. Although It seems the way we generate primes for RSA is safe, I was wondering if there is a way to detect if a number is "Fermat"-factorable. In which case $|p - q| < N^{1/4}$ should be enough. P.S: This has probably low probability of happening but I am curious. ;) Nov 8, 2018 at 14:31
• With $N$ at hand, trial division allows a small improvement :-)
– fgrieu
Nov 8, 2018 at 15:20
• Even if we could find "a way to detect if a number is Fermat-factorable", we'd need to insure that $6\,N$ can't be factored into $(2\,p)(3\,q)$ by Fermat's method. And same for $a\,b\,N$ with a wide choice of $a$ and $b$ coprime...
– fgrieu
Nov 8, 2018 at 15:41
• Illmari, could you write the reason for the bound into the question? Nov 8, 2018 at 17:31