<p>Of course this is a question with an answer that is due to evolve.</p>
<p>A 2002 paper about <a href="https://cs-people.bu.edu/tromer/twirl/" rel="nofollow noreferrer">TWIRL</a> stated that the cost would be around 10M$$ and an other 10M$ to manufacture the devices. A later 2007 <a href="https://www.hyperelliptic.org/tanja/SHARCS/talks07/sharcs2007_cairn3_3.pdf" rel="nofollow noreferrer">paper</a> claimed to have improved the design and created an actual FPGA, though at that time they were still used special bus rather than PCIe with dedicated memory.</p>
<p>After that, RSA laboratories stopped their bounties, and research slowed, and <strong>no serious paper later seems to have explored the cost of factoring a 1024‒bits RSA modulus in the last 15 years</strong>.</p>
<p>Even if you can today rent 500,000 PCIe Xilinx on AWS like GPUs, I’m noticing all the latest records for RSA numbers were performed on pure CPU implementations with the latest 1 being on <a href="https://cado-nfs.gitlabpages.inria.fr/" rel="nofollow noreferrer">CADO-NFS</a>. Their creators stated that GPUs wouldn’t be of help in any parts because it would break it’s capacities to abort early on unnecessary cases.</p>
<h3>Question :</h3>
<p>What would be the price to factor something like</p>
<pre><code>0xdc4e445b69fe9483216d0fa85492b4656287bfb2fb4da5b65f0b86cc2c073f3ee24a038d3d0e88c78b722b466c5ca1c89792c368ed182a5a13df919cac7fe335173cd04f23769d5ef027290f34a86e8fcab014f1a19d395b0662c5c52424a38796dd6f2394047d716abb6f48cc46abee6e2be3168348b456d5878cbec0b57d0f
</code></pre>
<p>today in order to forge signatures without considering labor designs costs outside the case of the ASIC ?</p>
<p>And with which setup (pure CPU or FPGA or ASIC) would be the less costly to achieve it if rented ?</p>
<h5>Disclaimer :</h5>
<p>I was just offered a <a href="https://web.archive.org/web/20240219004740/https://etherscan.io/address/0xd1ce90003a10e6dab877890ab1fd96511555e4b3#multichain-portfolio" rel="nofollow noreferrer">10% of damage bounty</a> that I agree to share by a casino should I prove with details the feasibility to break the modulus above in the span of a few months.</p>

CC BY-SA 4.0
2024-03-05T14:56:13.387Z
**I was aware of previous question**, but in my case, I indeed can’t apply the alternatives answer.
user2284570
CC BY-SA 4.0
2024-03-05T16:22:22.130Z
This seems to me like a very applied question that is way out of scope and most contributors here would struggle to answer, since it requires non-theoretical knowledge such as hardware and implementation specifics, costs, etc. Nonetheless, it seems like an interesting question that you could perhaps ask in the cryptography SE ( https://crypto.stackexchange.com/ ).
chazisop
CC BY-SA 4.0
2024-03-07T05:26:09.290Z
Duplicate of https://crypto.stackexchange.com/questions/109810/how-could-a-1024-bits-rsa-modulus-be-most-economically-factored-within-months-to
kodlu
<cc.complexity-theory><cr.crypto-security><nt.number-theory><factoring><primes>
What would be the cost to factor a 1024‒bits RSA modulus most economically within months today?
user2284570
# What would be the cost to factor a 1024‒bits RSA modulus most economically within months today?

(Asked by: username_0 on 2024-03-05)

Of course this is a question with an answer that is due to evolve.
A 2002 paper about TWIRL stated that the cost would be around 10M$$ and an other 10M$ to manufacture the devices. A later 2007 paper claimed to have improved the design and created an actual FPGA, though at that time they were still used special bus rather than PCIe with dedicated memory.
After that, RSA laboratories stopped their bounties, and research slowed, and no serious paper later seems to have explored the cost of factoring a 1024‒bits RSA modulus in the last 15 years.
Even if you can today rent 500,000 PCIe Xilinx on AWS like GPUs, I’m noticing all the latest records for RSA numbers were performed on pure CPU implementations with the latest 1 being on CADO-NFS. Their creators stated that GPUs wouldn’t be of help in any parts because it would break it’s capacities to abort early on unnecessary cases.
Question :
What would be the price to factor something like
0xdc4e445b69fe9483216d0fa85492b4656287bfb2fb4da5b65f0b86cc2c073f3ee24a038d3d0e88c78b722b466c5ca1c89792c368ed182a5a13df919cac7fe335173cd04f23769d5ef027290f34a86e8fcab014f1a19d395b0662c5c52424a38796dd6f2394047d716abb6f48cc46abee6e2be3168348b456d5878cbec0b57d0f

today in order to forge signatures without considering labor designs costs outside the case of the ASIC ?
And with which setup (pure CPU or FPGA or ASIC) would be the less costly to achieve it if rented ?
Disclaimer :
I was just offered a 10% of damage bounty that I agree to share by a casino should I prove with details the feasibility to break the modulus above in the span of a few months.

**Tags:** cc.complexity-theory, cr.crypto-security, nt.number-theory, factoring, primes
> **Comments:**
> **username_0**: **I was aware of previous question**, but in my case, I indeed can’t apply the alternatives answer.  
> **username_1**: This seems to me like a very applied question that is way out of scope and most contributors here would struggle to answer, since it requires non-theoretical knowledge such as hardware and implementation specifics, costs, etc. Nonetheless, it seems like an interesting question that you could perhaps ask in the cryptography SE ( https://crypto.stackexchange.com/ ).  
> **username_2**: Duplicate of https://crypto.stackexchange.com/questions/109810/how-could-a-1024-bits-rsa-modulus-be-most-economically-factored-within-months-to  

---

## 0 answers

