S. Cavallar, B. Dodson, A.K. Lenstra, W. Lioen, P.L. Montgomery, B. Murphy, H.J.J. te Riele, et al., Factorization of a 512-bit RSA modulus, proc. Eurocrypt 2000.  Home/Search   Document Details and Download   Summary   Related Articles   Check

.... that the prime factors of N do not fall within the range of the Elliptic Curve Method (ECM) which is analyzed in [15] Currently, 256 bit prime factors are considered within the bounds of ECM, since the work to nd such factors is within range of the work needed for the RSA 512 factoring project [5]. Consequently, for 1024 bit moduli one should not use more than three factors. 3.2 Multi power RSA: N = p q One can further speed up RSA decryption using a modulus of the form N = p q where p and q are n=b bits each [14] When N is 1024 bits long we can use at most b = 3, i.e. N = p ....

S. Cavallar, B. Dodson, A. K. Lenstra, W. Lioen, P. Montgomery, B. Murphy, H. Riele, K. Aardal, J. Gilchrist, G. Guillerm, P. Leyland, J. Marchand, F. Morain, A. Muett, C. Putnam, P. Zimmermann, \Factorization of a 512-Bit RSA Modulus", Proceedings of Eurocrypt '2000.

....The hardness of integer factorization is a central cryptographic assumption and forms the basis of several widely deployed cryptosystems. The best integer factorization algorithm known is the Number Field Sieve [12] which was successfully used to factor 512 bit and 530 bit RSA moduli [5,1]. However, it appears that a PC based implementation of the NFS cannot practically scale much further, and specifically its cost for 1024 bit composites is prohibitive. Recently, the prospect of using custom hardware for the computationally expensive steps of the Number Field Sieve has gained much ....

S. Cavallar, B. Dodson, A.K. Lenstra, W. Lioen, P.L. Montgomery, B. Murphy, H.J.J. te Riele, et al., Factorization of a 512-bit RSA modulus, proc. Eurocrypt 2000, LNCS 1807 1--17, Springer-Verlag, 2000

....account on which computations a cryptanalist can do with the current technology is necessary. While a tremendous amount of work (and CPU time) has been put towards the factorization of larger and larger numbers (S. Cavallar et al. used the Number Field Sieve to factor numbers as big as 512 bits [6, 9], and even up to 774 bits numbers of a special form [7] the computation of discrete logarithms in nite elds does not seem to looked at so frequently. For prime elds, a recent work by Joux and Lercier [22] computed logarithms in F p with p having 120 decimal digits, i.e. 399 bits. For elds of ....

S. Cavallar et al. Factorization of a 512-bit RSA modulus. In B. Preneel, ed., Proc. EUROCRYPT 2000, vol. 1807 of Lecture Notes in Comput. Sci., pp. 118. Springer-Verlag, 2000.

....ISSAC 2001, UWO, Canada c 2001 ACM 1 58113 218 2 00 0008 5. 00 index calculus type algorithm for computing discrete logarithms in appropriate groups: see [19] and for instance [11, 12] Huge matrices also appeared in the course of recent record breaking factorizations of composite numbers [6, 4]. There, the linear system is de ned over F2 , which changes some of the issues. The algorithm of Coppersmith is an extension of an algorithm proposed by Wiedemann in [26] In Wiedemann s algorithm, we compute the sequence: ak = x T B k y; 0 k 2N 1; where x and y are xed elements of ....

Cavallar, S., et al. Factorization of a 512-bit RSA modulus. In Proc. EUROCRYPT

No context found.

S. Cavallar, B. Dodson, A.K. Lenstra, W. Lioen, P.L. Montgomery, B. Murphy, H.J.J. te Riele, et al., Factorization of a 512-bit RSA modulus, Proceedings Eurocrypt 2000, LNCS 1807, Springer-Verlag 2000, 1-17

....believe that the designs are fundamentally sound and give realistic indications of feasibility using technology that is available in the present or in the near future. 5.1 Matrix sizes. For the factorization of RSA 512 the matrix had about 6. 7 million columns and average column density about 63 [3]. There is no doubt that this matrix is considerably smaller than a matrix that would have resulted from ordinary relation collection as de ned in 2.6, cf. Remark 3.7. Nevertheless, we make the optimistic assumption that this is the size that would result from ordinary relation collection. ....

....columns for the circuit NFS 1024bit matrix. We again, optimistically, assume that the average column density is about 100. We refer to this matrix as the small matrix. 5.2 Estimated relation collection cost. Relation collection for RSA 512 could have been done in about 8 years on a 1GHz PC [3]. Since 8 [1=3; 4=3 512 [1=3; 4=3 6 10 we estimate that generating the large matrix would require about a year on about 30 million 1GHz PCs with large memories (or more PC time but less memory when using alternative smoothness tests keep in mind, though, that it may be ....

S. Cavallar, B. Dodson, A.K. Lenstra, W. Lioen, P.L. Montgomery, B. Murphy, H.J.J. te Riele, et al., Factorization of a 512-bit RSA modulus, Proceedings Eurocrypt 2000, LNCS 1807, Springer-Verlag 2000, 1-17

....early experiments look encouraging (cf. 19] and there is no reason to believe that it will not be successful. Software data points. The largest published factorization using the NFS is that of the 512bit number RSA155 which is an RSA modulus of 155 decimal digits, in August of 1999 (cf. [6]) This factoring effort was estimated to cost at most 20 years on a PC with at least 64Mbytes of memory (or a single day on 7500 PCs) This time was spent almost entirely on the sieving step. It is less than 10 Mips Years and corresponds to fewer than 3 10 operations, whereas L[10 ] ....

....not allow efficient caching. Straightforward extrapolation of NFS run times to faster processors was therefore impossible. Surprisingly, newer generations of processors do not seem to suffer from this drawback, at least not for the type of sieving that was mainly used for the result presented in [6]. For instance, the speed of NFS lattice sieving on Pentium processors grows strictly linearly with the processor speed, with an interesting super linear speed up when moving from Pentium I to Pentium II processors. To illustrate this important point, an average sieving step operation takes 15.8 ....

[Article contains additional citation context not shown here]

S. Cavallar, B. Dodson, A.K. Lenstra, B. Murphy, P.L. Montgomery, H.J.J. te Riele, et al. Factorization of a 512-bit RSA modulus, manuscript, October 1999.

....stage can be distributed over almost any number of loosely coupled processors, similar to quadratic sieve. For an introductory description of the number eld sieve, refer to [63, 66, 93] For complete details see [65] and the references given there. The latest developments are described in [21, 81]. The largest special number factored using the special number eld sieve is 2 773 1 (see [33] This was done by the same group that achieved the current general number eld sieve record by factoring a 512 bit RSA modulus [21] Neither of these records can be expected to stand for a long ....

....given there. The latest developments are described in [21, 81] The largest special number factored using the special number eld sieve is 2 773 1 (see [33] This was done by the same group that achieved the current general number eld sieve record by factoring a 512 bit RSA modulus [21]. Neither of these records can be expected to stand for a long time. Consult [33] for the most recent information. Such public domain factoring records should 46 not be confused with factorizations that could, in principle or in practice, be obtained by well funded agencies or other large ....

S. Cavallar, B. Dodson, A.K. Lenstra, W. Lioen, P.L. Montgomery, B. Murphy, H. te Riele, et al., Factorization of a 512-bit RSA modulus, Proceedings Eurocrypt

....of a 512 bit RSA modulus referred to in 2.4.6 below is the best one can do at this point (see also 3.1.2) 2.4.6 Software data points. The largest published factorization using the NFS is that of the 512 bit number RSA155, which is an RSA modulus of 155 decimal digits, in August of 1999 [6]. This factoring e ort was estimated to cost at most 20 years on a PC with at least 64Mbytes of memory (or a single day on 7500 PCs) This time was spent almost entirely on the sieving step. It is less than 10 4 Mips Years and corresponds to fewer than 3 # 10 17 operations, whereas L[10 ....

.... this, we observed that the speed of NFS lattice sieving on Pentium processors grows strictly linearly with the processor speed, with an interesting larger than expected speedup when moving from Pentium I to Pentium II processors: an average sieving step operation for the result presented in [6] takes 15.8 seconds on a 133MHz Pentium I, 12.7 seconds on a 166MHz Pentium I, 5.34 seconds on a 300MHz Pentium II, and 3.61 seconds on a 450 MHz Pentium II. Here all processors execute the same binary that uses about 48MB of their about 200MB RAMs. As a consequence, there does not seem to be any ....

S. Cavallar, B. Dodson, A.K. Lenstra, W. Lioen, P.L. Montgomery, B. Murphy, H.J.J. te Riele, et al., Factorization of a 512-bit RSA modulus, Proceedings Eurocrypt

....proceedings of ANTS IV, Leiden, The Netherlands, July 2 7, 2000. Introduction The Number Field Sieve (NFS) is the asymptotically fastest algorithm known for factoring large integers. It holds the records in factoring special numbers (R211 [3] as well as general numbers (RSA 140 [4] and RSA 155 [5]) One disadvantage is that it produces considerably larger matrices than other methods, such as the Quadratic Sieve [1] Therefore it is more and more important to find ways to limit the matrix size. This can be achieved by using good sieving parameters and by intelligent filtering. In this ....

Stefania Cavallar, Bruce Dodson, Arjen K. Lenstra, Walter Lioen, Peter L. Montgomery, Brian Murphy, Herman te Riele, Karen Aardal, Jeff Gilchrist, G'erard Guillerm, Paul Leyland, Joel Marchand, Francois Morain, Alec Muffett, Chris Putnam, Craig Putnam, and Paul Zimmermann. Factorization of a 512-bit RSA modulus. Submitted to Eurocrypt 2000.

No context found.

S. Cavallar, B. Dodson, A.K. Lenstra, W. Lioen, P.L. Montgomery, B. Murphy, H.J.J. te Riele, et al., Factorization of a 512-bit RSA modulus, proc. Eurocrypt 2000.

No context found.

S. Cavallar et al, Factorization of a 512-bit RSA modulus. EUROCRYPT 2000, LNCS V. 1807, pp. 1-17.

No context found.

S. Cavallar, B. Dodson, A. K. Lensra, W. Lioen, P. Montgomery, B. Murphy, H. Riele, K. Aardal, J. Gilchrist, G. Guillerm, P. Leyland, J. Marchand, F. Morain, A. Muffet, C. Putnam, and P. Zimmermann. Factorization of a 512-bit RSA-modulus. In Proceedings of Eurocrypt 2000, volume 1807, pages 1--11. Springer-Verlag, 2000.

No context found.

Stefania Cavallar, Bruce Dodso, Arjen K. Lenstra, Walter Lioen, Peter L. Montgomery, Brian Murphy, Herman te Riele, Karen Aardal, Jeff Gilchrist, G'erard Guillerm, Paul Leyland, Joel Marchand, Franois Morain, Alec Muffett, Paul Zimmermann, Factorization of a 512-bit RSA Modulus, In Advances in Cryptology --- Eurocrypt

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC