RSA numbers

RSA-100 has 100 decimal digits (330 bits). Its factorization was announced on April 1, 1991, by Arjen K. Lenstra. Reportedly, the factorization took a few days using the multiple-polynomial quadratic sieve algorithm on a MasPar parallel computer. The value and factorization of RSA-100 are as follows: RSA-100 = 1522605027922533360535618378132637429718068114961380688657908494580122963258952897654000350692006139 RSA-100 = 37975227936943673922808872755445627854565536638199 × 40094690950920881030683735292761468389214899724061 RSA-100 is often used to benchmark new factorization software or new hardware. As of December 2009, it took four hours to repeat this factorization using the program Msieve on a 2200 MHz Athlon 64 processor. As of June 2015, the number could be factorized in 72 minutes on overclocked to 3.5 GHz Intel Core2 Quad q9300, using GGNFS and Msieve binaries running by distributed version of the factmsieve Perl script. As of June 2025, the number was factored in 108 seconds on 32 Epyc 9174 server cores using YAFU's implementation of the self initializing quadratic sieve. As of January 2026, the number was reported to have been factored in 4 minutes and 57 seconds on an NVIDIA RTX 5070 Ti, the first such factorization on a complete quadratic sieve factorization pipeline on GPU. ==RSA-110==

RSA-110 has 110 decimal digits (364 bits), and was factored in April 1992 by Arjen K. Lenstra and Mark S. Manasse in approximately one month. The number can be factorized in less than four hours on overclocked to 3.5 GHz Intel Core2 Quad q9300, using GGNFS and Msieve binaries running by distributed version of the factmsieve Perl script. The value and factorization are as follows: RSA-110 = 35794234179725868774991807832568455403003778024228226193532908190484670252364677411513516111204504060317568667 RSA-110 = 6122421090493547576937037317561418841225758554253106999 × 5846418214406154678836553182979162384198610505601062333 ==RSA-120==

RSA-120 has 120 decimal digits (397 bits), and was factored in June 1993 by Thomas Denny, Bruce Dodson, Arjen K. Lenstra, and Mark S. Manasse. The computation took under three months of actual computer time. The value and factorization are as follows: RSA-120 = 227010481295437363334259960947493668895875336466084780038173258247009162675779735389791151574049166747880487470296548479 RSA-120 = 327414555693498015751146303749141488063642403240171463406883 × 693342667110830181197325401899700641361965863127336680673013 ==RSA-129==

RSA-129, having 129 decimal digits (426 bits), was not part of the 1991 RSA Factoring Challenge, but rather related to Martin Gardner's Mathematical Games column in the August 1977 issue of Scientific American. from around 600 volunteers connected over the Internet. A US$100 token prize was awarded by RSA Security for the factorization, which was donated to the Free Software Foundation. The value and factorization are as follows: RSA-129 = 114381625757888867669235779976146612010218296721242362562561842935706935245733897830597123563958705058989075147599290026879543541 RSA-129 = 3490529510847650949147849619903898133417764638493387843990820577 × 32769132993266709549961988190834461413177642967992942539798288533 The factorization was found using the Multiple Polynomial Quadratic Sieve algorithm. The factoring challenge included a message encrypted with RSA-129. When decrypted using the factorization the message was revealed to be "The Magic Words are Squeamish Ossifrage". In 2015, RSA-129 was factored in about one day, with the CADO-NFS open source implementation of number field sieve, using a commercial cloud computing service for about $30. ==RSA-130==

RSA-130 has 130 decimal digits (430 bits), and was factored on April 10, 1996, by a team led by Arjen K. Lenstra and composed of Jim Cowie, Marije Elkenbracht-Huizing, Wojtek Furmanski, Peter L. Montgomery, Damian Weber and Joerg Zayer. The factorization was found in the third trial. The value and factorization are as follows: RSA-130 = 1807082088687404805951656164405905566278102516769401349170127021450056662540244048387341127590812303371781887966563182013214880557 RSA-130 = 39685999459597454290161126162883786067576449112810064832555157243 × 45534498646735972188403686897274408864356301263205069600999044599 The factorization was found using the Number Field Sieve algorithm and the polynomial 5748302248738405200 x5 + 9882261917482286102 x4 - 13392499389128176685 x3 + 16875252458877684989 x2 + 3759900174855208738 x1 - 46769930553931905995 which has a root of 12574411168418005980468 modulo RSA-130. ==RSA-140==

RSA-140 has 140 decimal digits (463 bits), and was factored on February 2, 1999, by a team led by Herman te Riele and composed of Stefania Cavallar, Bruce Dodson, Arjen K. Lenstra, Paul Leyland, Walter Lioen, Peter L. Montgomery, Brian Murphy and Paul Zimmermann. The value and factorization are as follows: RSA-140 = 21290246318258757547497882016271517497806703963277216278233383215381949984056495911366573853021918316783107387995317230889569230873441936471 RSA-140 = 3398717423028438554530123627613875835633986495969597423490929302771479 × 6264200187401285096151654948264442219302037178623509019111660653946049 The factorization was found using the Number Field Sieve algorithm and an estimated 2000 MIPS-years of computing time. The matrix had 4671181 rows and 4704451 columns and weight 151141999 (32.36 nonzeros per row) ==RSA-150==

RSA-150 has 150 decimal digits (496 bits), and was withdrawn from the challenge by RSA Security. RSA-150 was eventually factored into two 75-digit primes by Aoki et al. in 2004 using the general number field sieve (GNFS), years after bigger RSA numbers that were still part of the challenge had been solved. The value and factorization are as follows: RSA-150 = 155089812478348440509606754370011861770654545830995430655466945774312632703463465954363335027577729025391453996787414027003501631772186840890795964683 RSA-150 = 348009867102283695483970451047593424831012817350385456889559637548278410717 × 445647744903640741533241125787086176005442536297766153493419724532460296199 ==RSA-155==

RSA-155 has 155 decimal digits (512 bits), and was factored on August 22, 1999, in a span of six months, by a team led by Herman te Riele and composed of Stefania Cavallar, Bruce Dodson, Arjen K. Lenstra, Walter Lioen, Peter L. Montgomery, Brian Murphy, Karen Aardal, Jeff Gilchrist, Gerard Guillerm, Paul Leyland, Joel Marchand, François Morain, Alec Muffett, Craig Putnam, Chris Putnam and Paul Zimmermann. The value and factorization are as follows: RSA-155 = 10941738641570527421809707322040357612003732945449205990913842131476349984288934784717997257891267332497625752899781833797076537244027146743531593354333897 RSA-155 = 1026395928297411057720541965739916759007165678080380668033419335217907113077 79 × 1066034883801684548209272203600128786792079585759892915222706082371930628086 43 The factorization was found using the general number field sieve algorithm and an estimated 8000 MIPS-years of computing time. The polynomials were 119377138320*x^5 - 80168937284997582*y*x^4 - 66269852234118574445*y^2*x^3 + 11816848430079521880356852*y^3*x^2 + 7459661580071786443919743056*y^4*x - 40679843542362159361913708405064*y^5 and x - 39123079721168000771313449081*y (this pair has a yield of relations approximately 13.5 times that of a random polynomial selection); 124722179 relations were collected in the sieving stage; the matrix had 6699191 rows and 6711336 columns and weight 417132631 (62.27 nonzeros per row). ==RSA-160==

RSA-160 has 160 decimal digits (530 bits), and was factored on April 1, 2003, by a team from the University of Bonn and the German Federal Office for Information Security (BSI). The team contained J. Franke, F. Bahr, T. Kleinjung, M. Lochter, and M. Böhm. The value and factorization are as follows: RSA-160 = 2152741102718889701896015201312825429257773588845675980170497676778133145218859135673011059773491059602497907111585214302079314665202840140619946994927570407753 RSA-160 = 4542789285848139407168619064973883165613714577846979325095998470925000415733 5359 × 4738809060383201619663383230378895197326892292104095794474135464881202849390 9367 The factorization was found using the general number field sieve algorithm. ==RSA-170==

RSA-170 has 170 decimal digits (563 bits) and was first factored on December 29, 2009, by D. Bonenberger and M. Krone from Fachhochschule Braunschweig/Wolfenbüttel. An independent factorization was completed by S. A. Danilov and I. A. Popovyan two days later. The value and factorization are as follows: RSA-170 = 26062623684139844921529879266674432197085925380486406416164785191859999628542069361450283931914514618683512198164805919882053057222974116478065095809832377336510711545759 RSA-170 = 3586420730428501486799804587268520423291459681059978161140231860633948450858 040593963 × 7267029064107019078863797763923946264136137803856996670313708936002281582249 587494493 The factorization was found using the general number field sieve algorithm. ==RSA-576==

RSA-576 has 174 decimal digits (576 bits), and was factored on December 3, 2003, by J. Franke and T. Kleinjung from the University of Bonn. A cash prize of $10,000 was offered by RSA Security for a successful factorization. The value and factorization are as follows: RSA-576 = 188198812920607963838697239461650439807163563379417382700763356422988859715234665485319060606504743045317388011303396716199692321205734031879550656996221305168759307650257059 RSA-576 = 3980750864240649373971255005503864911990643623425267084063851895759463889572 61768583317 × 4727721461074353025362230719730482246329146953020971164598521711305207112563 63590397527 The factorization was found using the general number field sieve algorithm. ==RSA-180==

RSA-180 has 180 decimal digits (596 bits), and was factored on May 8, 2010, by S. A. Danilov and I. A. Popovyan from Moscow State University, Russia. RSA-180 = 1911479277189866096892294666314546498129862462766673548641885036388072607034 3679905877620136513516127813425829612810920004670291298456875280033022177775 2773957404540495707851421041 RSA-180 = 4007800823297508779525813391041005725268293178158071765648821789984975727719 50624613470377 × 4769396887386118369955354773570708579399020760277882320319897758246062255957 73435668861833 The factorization was found using the general number field sieve algorithm implementation running on three Intel Core i7 PCs. ==RSA-190==

RSA-190 has 190 decimal digits (629 bits), and was factored on November 8, 2010, by I. A. Popovyan from Moscow State University, Russia, and A. Timofeev from CWI, Netherlands. RSA-190 = 1907556405060696491061450432646028861081179759533184460647975622318915025587 1841757540549761551215932934922604641526300932385092466032074171247261215808 58185985938946945490481721756401423481 RSA-190 = 3171195257690152709485171289740475929805147316029450327784761927832793642798 1256542415724309619 × 6015260020444561641587641685526676183243543359471811072599763828083615704046 0481625355619404899 ==RSA-640==

RSA-640 has 193 decimal digits (640 bits). A cash prize of US$20,000 was offered by RSA Security for a successful factorization. On November 2, 2005, F. Bahr, M. Boehm, J. Franke and T. Kleinjung of the German Federal Office for Information Security announced that they had factorized the number using GNFS as follows: RSA-640 = 3107418240490043721350750035888567930037346022842727545720161948823206440518 0815045563468296717232867824379162728380334154710731085019195485290073377248 22783525742386454014691736602477652346609 RSA-640 = 1634733645809253848443133883865090859841783670033092312181110852389333100104 508151212118167511579 × 1900871281664822113126851573935413975471896789968515493666638539088027103802 104498957191261465571 The computation took five months on 80 2.2 GHz AMD Opteron CPUs. The slightly larger RSA-200 was factored in May 2005 by the same team. ==RSA-200==

RSA-200 has 200 decimal digits (663 bits), and factors into the two 100-digit primes given below. On May 9, 2005, F. Bahr, M. Boehm, J. Franke, and T. Kleinjung announced that they had factorized the number using GNFS as follows: RSA-200 = 2799783391122132787082946763872260162107044678695542853756000992932612840010 7609345671052955360856061822351910951365788637105954482006576775098580557613 579098734950144178863178946295187237869221823983 RSA-200 = 3532461934402770121272604978198464368671197400197625023649303468776121253679 423200058547956528088349 × 7925869954478333033347085841480059687737975857364219960734330341455767872818 152135381409304740185467 The CPU time spent on finding these factors by a collection of parallel computers amounted – very approximately – to the equivalent of 75 years work for a single 2.2 GHz Opteron-based computer. Note that while this approximation serves to suggest the scale of the effort, it leaves out many complicating factors; the announcement states it more precisely. ==RSA-210==

RSA-210 has 210 decimal digits (696 bits) and was factored in September 2013 by Ryan Propper: RSA-210 = 2452466449002782119765176635730880184670267876783327597434144517150616008300 3858721695220839933207154910362682719167986407977672324300560059203563124656 1218465817904100131859299619933817012149335034875870551067 RSA-210 = 4359585683259407917999519653872144063854709102652201963187054821445240853452 75999740244625255428455944579 × 5625457617268841037562770073044474817438769440075105451049468510945483965774 79473472146228550799322939273 ==RSA-704==

RSA-704 has 212 decimal digits (704 bits), and was factored by Shi Bai, Emmanuel Thomé and Paul Zimmermann. The factorization was announced July 2, 2012. A cash prize of US$30,000 was previously offered for a successful factorization. RSA-704 = 7403756347956171282804679609742957314259318888923128908493623263897276503402 8266276891996419625117843995894330502127585370118968098286733173273108930900 552505116877063299072396380786710086096962537934650563796359 RSA-704 = 9091213529597818878440658302600437485892608310328358720428512168960411528640 933367824950788367956756806141 × 8143859259110045265727809126284429335877899002167627883200914172429324360133 004116702003240828777970252499 ==RSA-220==

RSA-220 has 220 decimal digits (729 bits), and was factored by S. Bai, P. Gaudry, A. Kruppa, E. Thomé and P. Zimmermann. The factorization was announced on May 13, 2016. RSA-220 = 2260138526203405784941654048610197513508038915719776718321197768109445641817 9666766085931213065825772506315628866769704480700018111497118630021124879281 99487482066070131066586646083327982803560379205391980139946496955261 RSA-220 = 6863656412267566274382371499288437800130842239979164844621244993321541061441 4642667938213644208420192054999687 × 3292907439486349812049301549212935291916455196536233952462686051169290349309 4652463337824866390738191765712603 ==RSA-230==

RSA-230 has 230 decimal digits (762 bits), and was factored by Samuel S. Gross on August 15, 2018. RSA-230 = 1796949159794106673291612844957324615636756180801260007088891883553172646034 1490933493372247868650755230855864199929221814436684722874052065257937495694 3483892631711525225256544109808191706117425097024407180103648316382885188526 89 RSA-230 = 4528450358010492026612439739120166758911246047493700040073956759261590397250 033699357694507193523000343088601688589 × 3968132623150957588532394439049887341769533966621957829426966084093049516953 598120833228447171744337427374763106901 ==RSA-232==

RSA-232 has 232 decimal digits (768 bits), and was factored on February 17, 2020, by N. L. Zamarashkin, D. A. Zheltkov and S. A. Matveev. RSA-232 = 1009881397871923546909564894309468582818233821955573955141120516205831021338 5285453743661097571543636649133800849170651699217015247332943892702802343809 6090980497644054071120196541074755382494867277137407501157718230539834060616 2079 RSA-232 = 2966909333208360660361779924242630634742946262521852394401857157419437019472 3262390744910112571804274494074452751891 × 3403816175197563438006609498491521420547121760734723172735163413276050706174 8526506443144325148088881115083863017669 ==RSA-768==