Guillaume Dumas on Senthorus Blog

Inside the RSA-260 Factorization: GPU-Accelerated GNFS and the Role of Devin

Sat, 12 Sep 2026 00:00:00 +0000

When Eric Lu announced the factorization of RSA-260 on September 3, 2026, he published a valid factor but almost nothing about how it had been found. My previous RSA-260 article therefore separated two questions: could the result be verified, and what method had produced it? Only the first had a firm answer.

The Missing Method Is No Longer Missing

On September 9, Lu published a detailed account through Cognition. The second question now has an answer, at least according to the team that performed the computation: RSA-260 was factored with the General Number Field Sieve (GNFS), using a heavily modified, GPU-accelerated version of CADO-NFS developed and operated with multiple Devin agents.

There was no quantum computer and, by Lu’s own account, no new factoring algorithm:

“I report essentially no algorithmic advancements”
Eric Lu, Cognition

That distinction matters. A better algorithm could change how factoring difficulty grows with key size. A better implementation reduces the practical cost of the same mathematics. Cognition reports the second kind of advance: established GNFS techniques were adapted to modern GPU memory systems and otherwise fragmented computing capacity.

This follow-up focuses on the information that was missing from the first announcement: the software, the resources, the role of Devin, and the limits of the larger security claims.

What Cognition Actually Built

GNFS is not one monolithic calculation. It is a pipeline combining polynomial selection, relation sieving, filtering, sparse linear algebra, and square-root extraction. Cognition did not replace that sequence. It changed where much of the work ran and optimized almost every stage around it.

The starting point was CADO-NFS, a mature open-source implementation. Its modular design gave the Devin agents established interfaces, reference outputs, and CPU programs against which GPU replacements could be tested.

According to Lu, the modified pipeline included:

gps1, a GPU adaptation of CADO-NFS’s first polynomial-selection stage, incorporating kernel techniques from msieve
glas, a GPU lattice siever replacing the CPU-based las
optimized coordination, deduplication, filtering, merging, and replay programs
a GPU-oriented block Wiedemann implementation for sparse linear algebra
a GPU-accelerated square-root stage and new run scripts

The central component was the lattice siever. It searches for billions of useful mathematical relations that can later be combined. The work divides naturally into independent units, but each unit performs many reads and writes at irregular memory locations.

That pattern is difficult for GPUs, which work best when many threads follow similar instructions and access predictably arranged data. The challenge was not to compile CPU code for CUDA. It was to reorganize the workload until the GPU’s much greater memory bandwidth outweighed the cost of branching and scattered access.

The mathematics remained GNFS. The operational system around it changed substantially.

Why Spare AI Compute Was a Good Fit

Cognition says the project began while its research team was improving the allocation of disaggregated compute. Large AI workloads prefer tightly connected groups of machines inside NVLink-equipped racks. Real scheduling leaves gaps: one node may remain idle, a job may require an even number of machines, or capacity may be reserved for failover.

Those gaps represented a single-digit percentage of Cognition’s cluster. They were awkward for training jobs, but well suited to relation sieving.

Sieving is described as embarrassingly parallel because billions of small work units can run on separate machines with little coordination. A low-priority unit can be interrupted and rescheduled without invalidating the rest of the computation. The siever could therefore fill small scheduling holes left by larger AI workloads.

Lu says the factorization ran at “no marginal cost” (Cognition). This does not mean that the hardware, energy, or computation was free. It means the run reportedly used capacity that Cognition already owned and could not assign productively to higher-priority jobs at those moments.

The RSA-260 Run by the Numbers

Lu says the first prompt asking Devin to build a GPU lattice siever was issued on August 13. Polynomial selection began on August 18, and the factors were produced on September 3. The recorded run took about 15.6 days, while the broader engineering effort lasted roughly three weeks.

Stage	Reported compute	Share	Main output
Polynomial selection	643 GPU-days	13.1%	Candidate polynomials
Lattice sieving	3,813 GPU-days	77.5%	13.85 billion raw relations
Linear algebra	467 GPU-days	9.5%	Dependencies in a 656-million-row sparse matrix
Total	4,923 GPU-days	100%	About 13.5 GPU-years of aggregate work

The reported stage totals reproduce Cognition’s rounded market estimate:

gpu_days = 643 + 3_813 + 467
market_price_per_gpu_hour = 3.50
market_equivalent = gpu_days * 24 * market_price_per_gpu_hour

print(gpu_days) # 4923
print(round(gpu_days / 365, 1)) # 13.5 GPU-years
print(f"${market_equivalent:,.0f}") # $413,532

Cognition summarizes this as about 4,900 GPU-days and $400,000 at market prices. The latter is a market-equivalent compute estimate, not a bill or a complete project budget. It excludes the distinction between owned spare capacity and rented GPUs, and says nothing about hardware acquisition, power, cooling, human work, or Devin’s development cost.

GPU-days are aggregate work, not elapsed time. Parallel execution compressed the run into just over two weeks, with available capacity varying across B200, GB200, and GB300 systems.

What Happened Inside the Pipeline

The detailed timings reveal where the computation succeeded and where it remained inefficient.

Polynomial selection consumed far more work than planned. Lu attributes the 643 GPU-days to misread early benchmarks and unproductive search ranges. The total is therefore not presented as a theoretical minimum.

Sieving remained the dominant expense. It ran for about 7.9 days, generating 13.85 billion raw relations. After removing roughly 40% duplicates, 8.30 billion unique relations remained. The team upgraded the live siever twice, reporting gains of approximately 14% to 17% on the measured GPU types.

Filtering transformed those relations into a sparse binary matrix of about 656 million rows by 656 million columns, with 98.4 billion non-zero entries. The values represent whether relevant prime exponents are even or odd, so the linear algebra operates over GF(2), using only zero and one.

The block Wiedemann stage then searched the matrix for dependencies. Unlike sieving, its workers had to stay available together and communicate. Higher-priority jobs repeatedly pre-empted allocations, making checkpointing and job placement essential.

Even square-root extraction failed at first. A roughly 176-billion-bit intermediate product overflowed an internal mpz_t limb counter. Lu says Devin rebuilt the component three times, the final GPU-accelerated version completed its main calculation in 88 minutes.

This is what a record computation looks like in practice: measurements, failures, restarts, validation checks, parameter changes, and resource decisions, not one elegant command.

What Devin Did, and What Still Required a Human

Cognition presents the result as evidence that an AI software-engineering agent can contribute to specialized computational research. Its report supports a substantial role for Devin, but not the simpler story of an autonomous AI independently deciding to factor RSA-260 and completing the project alone.

Lu first asked Devin to create a drop-in GPU replacement for las. According to his account, an initial version surpassed the CPU reference after about nine hours. Over the following weeks, parallel Devin sessions optimized components, benchmarked changes, debugged failures, tuned parameters, prepared scripts, and managed cluster jobs. An average of three sessions ran concurrently, with a maximum of eighteen.

What did Devin still need a human for? Lu’s concise answer is “still a lot” (Cognition). He reports sending 3,328 messages across 192 of the 233 sessions used for the project. His role included defining priorities, establishing comparable benchmarks, detecting unproductive directions, organizing results, and deciding when evidence was trustworthy enough to proceed.

Verification remained central. While RSA-260’s linear algebra was running, the team completed an end-to-end factorization of a smaller 344-digit special-form number. It also checked stored linear-algebra states with CADO-NFS’s existing tools. One check failed after about fourteen hours, forcing the affected interval to be rerun.

The practical lesson is balanced. Agents can accelerate implementation and experimentation, but faster iteration increases the need for reference code, measurable objectives, independent checks, and informed human supervision. CADO-NFS supplied the stable, human-designed decomposition that made parallel agent work possible.

A Tenfold Cost Claim, Not a Mathematical Breakthrough

Cognition calls glas the highest-performance GPU lattice siever and estimates that its pipeline cuts factoring costs by about ten compared with the previous public state of the art.

This is a performance and cost claim, not a change to GNFS’s theoretical complexity. The gain comes from GPUs, software optimization, scheduling, and pricing assumptions. Factoring cost still rises extremely quickly as the modulus grows.

There is also no earlier public RSA-260 run for a direct comparison. Cognition scales the CPU cost of the RSA-250 record to estimate what RSA-260 would have required with the earlier approach, then compares that projection with its GPU accounting.

The publication includes detailed parameters, timings, relation counts, and matrix dimensions. At publication time, however, it does not link to the modified pipeline’s source code. The factors are independently verifiable, and the performance advantage is a detailed claim by the team, not yet an independently reproduced result.

What the RSA-1024 Estimate Really Means

The most security-relevant extrapolation concerns RSA-1024. Using standard GNFS scaling, Lu estimates that a 1,024-bit modulus would require about 78 times the RSA-260 computation. At the same assumed price of $3.50 per GPU-hour, the appendix gives $32.3 million, rounded to $30 million in the main article.

That is not an observed attack cost. It assumes that GNFS follows the heuristic scaling model, that this implementation remains usable at the larger scale, and that the same market price is meaningful. It also applies to one chosen modulus, not a reusable universal break.

The estimate suggests that a GPU-rich organization might contemplate attacking one legacy RSA-1024 key. It does not mean Cognition has factored RSA-1024 or that an organization without the software, expertise, and cluster access could reproduce the estimate.

Nor does it change current guidance. NIST already disallows RSA moduli below 2,048 bits for generating digital signatures and for RSA-based key establishment. Cognition refines the economics of an obsolete size. It does not redefine modern RSA hygiene.

Why RSA-2048 Remains Out of Reach

Cognition’s extrapolation places RSA-2048 about a billion times beyond RSA-1024 under the same GNFS model. A projection over such a distance is not a precise budget, but the order of magnitude is the point: a tenfold engineering improvement does not bridge a billionfold gap.

The conclusion of the previous RSA-260 article therefore remains intact. This record matters for computational number theory, legacy-key economics, and AI-assisted performance engineering. It is not evidence of a practical classical attack against correctly generated RSA-2048 keys.

That assessment would change if someone found a fundamentally better factoring algorithm. Cognition explicitly reports no such discovery.

Facts, Measurements, and Projections

The disclosure is easiest to interpret when its different kinds of evidence remain separate:

Statement	Status	Basis
The factors multiply to RSA-260	Independently verifiable	Direct arithmetic, shown in the previous article
GPU-accelerated GNFS based on CADO-NFS was used	Reported methodology	Lu’s technical account and parameters
The run consumed about 4,900 GPU-days	Reported measurement	Cognition’s stage accounting
The compute is worth about $400,000	Cost estimate	GPU-days multiplied by an assumed market price
The pipeline is about ten times cheaper	Comparative claim	GPU result compared with a scaled CPU baseline
RSA-1024 could cost about $30 million	Projection	Heuristic GNFS scaling from this run
RSA-2048 is not meaningfully threatened	Security conclusion	Remaining scaling gap and no new algorithm

A verified factorization does not automatically verify every performance estimate or extrapolation published alongside it.

Conclusion: Engineering Leverage, Not Cryptographic Collapse

The previous RSA-260 article ended with an open question about the method. Cognition now fills that gap: classical GNFS, a substantially modified CADO-NFS pipeline, modern GPUs, opportunistic scheduling, and multiple Devin agents directed by Eric Lu.

The result is significant because it shows how much leverage can still be extracted from established mathematics through better hardware use, performance engineering, open-source foundations, and AI-assisted iteration. It also shows the limits of the autonomous-agent narrative: Devin reportedly wrote and optimized substantial parts of the system, while human prioritization, benchmark design, judgment, and verification remained essential.

For security teams, the practical response is modest but important: identify and retire any remaining RSA keys below 2,048 bits, confirm that key-generation and crypto-agility plans are sound, and avoid treating this record as evidence that RSA-2048 has suddenly become breakable.

The measured boundary moved, especially for legacy key sizes and GPU-rich adversaries. Modern RSA did not collapse with it. The factorization is verified, the resource figures are team-reported measurements, and the costs for larger keys remain projections.

Sources and Further Reading

RSA-260 Has Been Factored: What It Really Means for Modern Cryptography

Sun, 06 Sep 2026 00:00:00 +0000

RSA-260 Has Fallen: What Actually Happened

On September 3, 2026, engineer Eric Lu (@penlume) published a 130-digit number on X, followed by only two words: “divides RSA-260”

The number is one of the two prime factors of RSA-260, a 260-decimal-digit integer that had remained unfactored since the RSA Factoring Challenge began in 1991. Dividing by the published factor reveals the other prime, multiplying them reconstructs the challenge number exactly.

The result moves the public record for factoring a general RSA-style number from 829 to 862 bits and closes a 35-year-old challenge.

It is also easy to misunderstand. RSA-260 is not a production key, and the result does not mean current 2048-bit keys can suddenly be broken. Its broader significance depends on how the factorization was obtained, a detail not yet disclosed by Eric Lu.

Update: Cognition Explains the Factorization

On September 9, 2026, Eric Lu published a detailed account on Cognition’s blog, explaining how RSA-260 was factored. According to the report, the computation used the General Number Field Sieve (GNFS) through a heavily modified, GPU-optimized version of CADO-NFS. Lu reports essentially no algorithmic advances: the gains came from performance engineering, without a quantum computer or a new mathematical shortcut.

This disclosure supersedes the earlier uncertainty about the method described below. Lu’s approximately $30 million estimate for RSA-1024 remains an extrapolation, while the report provides no practical attack on RSA-2048.

Read Cognition’s full article: “Factoring RSA-260”

What Is RSA-260?

RSA-260 belongs to a collection published by RSA Laboratories to measure progress in integer factorization. Each number was created by multiplying two secret primes:

N = p × q

The public received N, while p and q were withheld. Recovering them provided a practical benchmark for algorithms, software, hardware, and distributed computing.

The name is confusing: in the original series, “260” refers to decimal digits, not bits. RSA-260 is 862 bits long, while each newly published factor has 130 decimal digits, or 431 bits.

RSA-260 is a challenge modulus, not a complete production key. A real public key also includes an exponent e. Knowing p and q allows the corresponding private exponent to be calculated. This challenge protected no production data, so its factorization breaks one mathematical target, not a deployed service.

Why Does Factoring One Number Matter?

RSA relies on a useful asymmetry: multiplying two large primes is easy, but reversing the multiplication is extremely difficult when the primes and modulus are large enough. Think of two ingredients fused into a solid block. Anyone can inspect the block, but separating it into the exact originals requires enormous work. Factoring reveals the trapdoor behind private-key operations.

Factorization records show what is practically achievable, helping researchers calibrate security estimates and identify key sizes within reach of well-funded classical projects.

The previous record, RSA-250, was completed in 2020. The 829-bit number was factored with the Number Field Sieve and CADO-NFS at a reported cost of approximately 2,700 CPU core-years. About 2,450 core-years went into the sieving phase.

A core-year measures total work, not elapsed time: thousands of comparable cores can compress millennia of aggregate computation into months. Actual performance also depends on memory, networking, hardware, and software optimization.

RSA-260 adds 33 bits, but difficulty does not grow linearly with length. It remains close enough to RSA-250 that improved classical software and hardware could plausibly explain the result without a mathematical breakthrough.

How Large RSA Numbers Are Factored in Practice

Factoring algorithms suit different targets. Trial division handles small numbers, Pollard’s rho and the Elliptic Curve Method help when one factor is relatively small. RSA challenge numbers avoid that weakness by using two large, balanced primes.

For a general number of this size, the strongest known classical approach is the General Number Field Sieve (GNFS). RSA-260’s method remains unpublished, so GNFS is an expected baseline, not a confirmed explanation.

At an operational level, a GNFS computation is a pipeline:

Polynomial selection
Find representations that make the remaining work more efficient.
Relation sieving
Distribute the expensive search for useful relations across many systems.
Filtering
Remove duplicate and unhelpful data before building the matrix.
Sparse linear algebra
Solve a huge sparse matrix, a memory intensive task.
Square root and factor extraction
Convert the final dependency into one factor: ordinary division reveals the other.

This explains the apparent paradox: finding the factors may require years of aggregate work, while checking them takes seconds.

What We Know, and What We Still Don’t Know

The published factor can be checked independently with a dependency-free Python script:

N = int(
 "2211282552952966643528108525502623092761208950247001539441374831"
 "9128822941402001986512729726569746599085900330031400051170742204"
 "5608592763579537571859542988389587092292384910067030341246205457"
 "84566413664540684214361293017694020846391065875914794251435144458199"
)

p = int(
 "4397328654844826923795068102505872571721883526553349659561256924"
 "505973939597593482272505698004801207988043088656411102133523080581"
)

assert N % p == 0
q = N // p

assert p * q == N

print(N.bit_length(), len(str(p)), len(str(q)))
# 862 130 130

Dividing RSA-260 by p gives the complementary 130-digit prime:

q = 5028695206842569864686141618253083416610081090075366674776775706538324961364412200138116378509733307971876652984898985905923678379

With both factors known, a direct multiplication is enough to verify the result:

N = int(
 "2211282552952966643528108525502623092761208950247001539441374831"
 "9128822941402001986512729726569746599085900330031400051170742204"
 "5608592763579537571859542988389587092292384910067030341246205457"
 "84566413664540684214361293017694020846391065875914794251435144458199"
)

p = int(
 "4397328654844826923795068102505872571721883526553349659561256924"
 "505973939597593482272505698004801207988043088656411102133523080581"
)

q = int(
 "5028695206842569864686141618253083416610081090075366674776775706"
 "538324961364412200138116378509733307971876652984898985905923678379"
)

assert p * q == N
print("RSA-260 factorization verified")

The arithmetic is not the uncertain part. As of September 6, 2026, these details remain undocumented:

the factoring algorithm and parameter choices
the software and version used
the hardware, total compute, and wall-clock duration
whether any new optimization or research contribution was involved

GNFS is plausible because it is established for balanced composites at this scale. Employment by an AI company is not evidence that AI found the factors, and a joking reference to “paper and pencil” is not a technical disclosure. There is no public evidence of a quantum computation either.

The missing methodology changes how the result should be interpreted:

Established GNFS plus large-scale computing would be a record and useful calibration point, but a continuation of existing progress.
A major implementation or hardware optimization could lower the cost of attacking other undersized keys.
A fundamentally better algorithm would have much broader consequences, but no evidence currently supports that scenario.

Until a reproducible report appears, the responsible conclusion is simple: the factorization is confirmed, and the claimed technique is not.

Does This Put RSA-2048 at Risk?

At 862 bits, RSA-260 is smaller than legacy 1024-bit keys already considered inadequate for new protection. NIST maps RSA-1024 to no more than 80 bits of classical security and RSA-2048 to approximately 112 bits. RSA-3072 provides about 128 bits.

Although 2048 is about 2.4 times 862, the required work is not 2.4 times greater. GNFS complexity rises extremely quickly with modulus size.

The result is also specific to one modulus. It reveals nothing about an unrelated, correctly generated key. Reused primes or weak randomness can connect keys, but those are implementation failures, not consequences of this record.

An organization still using an 862-bit key should treat this as a serious warning. For correctly generated 2048- and 3072-bit keys, it creates no new immediate attack path. Existing migration plans should continue, but RSA-260 is not itself a breach.

Conclusion - A Record, Not a Cryptographic Collapse

RSA-260 is a genuine achievement: a 260-digit challenge that stood for 35 years has been split into two 130-digit prime factors.

It does not show that RSA-2048 is broken, that a quantum computer was involved, or that AI discovered a new algorithm. Correctly generated modern keys do not require emergency rotation because of this announcement.

The practical response is simple: retire undersized RSA keys, verify key-generation quality, monitor the eventual technical disclosure, and preserve cryptographic agility.

Think of RSA-260 as one difficult lock opened after an enormous effort. It measures the frontier of classical computation. It is not a master key for every larger lock.

For now, the factorization itself is verified and the method remains the open question. That distinction is what turns a dramatic headline into an accurate security assessment.

Sources and Further Reading

Introduction to post-quantum cryptography and its implications

Thu, 30 Jul 2026 00:00:00 +0000

Quantum vs Classical Computing: Simple First Steps

When we talk about computing, the main difference between classical and quantum systems lies in how they represent and process information.

Classical computers, which underpin most modern IT infrastructure, operate on bits: simple units of data that can take the value of either 0 or 1. You might picture this as a librarian who checks one book at a time, moving quickly but always sequentially.

Quantum computers, on the other hand, rely on qubits. Unlike classical bits, qubits can exist in a state of 0, 1, or a superposition of both, allowing them to explore multiple possibilities at once. In our librarian analogy, this would be like a clerk capable of reading many books simultaneously: a kind of parallelism that classical systems cannot achieve. This gives quantum machines the potential to solve certain problems much faster than classical ones.

From a cybersecurity perspective, this is not just a fascinating scientific development but a serious concern. Many of today’s cryptographic standards, such as those based on the difficulty of factoring large prime numbers, would become vulnerable once practical quantum computing is achieved. This is why organizations like NIST are working on post-quantum cryptography to prepare security teams for the coming paradigm shift.

Why Is Quantum a Problem for Current Cryptography?

The security of modern public-key cryptography, such as RSA, Diffie-Hellman, and elliptic-curve cryptography (ECC), is based on mathematical problems that are extremely hard for classical computers to solve. Factoring a large number or solving a discrete logarithm would take astronomical amounts of time, making these systems the backbone of secure communication, digital signatures, and key exchanges.

However, the discovery of specialized quantum algorithms changes everything. Shor’s algorithm, the most famous one, can efficiently factor large numbers and solve discrete logarithms on a powerful quantum computer. If such machines become practical, the assumptions behind RSA and ECC would collapse, allowing attackers to decrypt data, forge signatures, or impersonate trusted entities.

The impact doesn’t stop there. Grover’s algorithm offers a quadratic speedup for brute-forcing symmetric encryption keys. While this doesn’t break symmetric cryptography entirely, it effectively reduces the security strength of current key sizes, meaning we need to increase key lengths (for example, doubling AES keys).

The biggest threat lies with public-key algorithms, which enable authentication and key exchange across the internet. This is where post-quantum cryptography (PQC) comes in. PQC focuses on developing cryptographic methods based on problems that are hard for both classical and quantum computers.

The goal is not to rebuild security from scratch, but to replace vulnerable algorithms with quantum-resistant alternatives for signatures, encryption, and key exchange.
Organizations like NIST are leading this effort, pushing forward the standardization of PQC algorithms so that organizations can start transitioning now, well before quantum computing poses a real-world threat to global cybersecurity.

Available Solutions: What’s Already Moving from Research to Standards

The cryptography community has been preparing for the quantum era long before practical quantum computers became a reality.
Anticipating the threat to existing public-key systems, researchers have spent years designing and analyzing new algorithm families capable of withstanding quantum attacks.

To coordinate this effort, the U.S. National Institute of Standards and Technology (NIST) launched a global, multi-round competition in 2016, inviting academics, industry experts, and governments to propose and evaluate potential replacements.
After several years of testing, cryptanalysis, and performance evaluation, NIST announced a small set of algorithms that will form the foundation of post-quantum cryptography (PQC) standards.

Two main families stand out in these efforts:

Lattice-based cryptography: relies on the difficulty of finding short vectors in high-dimensional lattices. These schemes are efficient, scalable, and currently among the most practical and widely recommended approaches to PQC.
Hash-based cryptography: built on the one-way properties of cryptographic hash functions. Hash-based signature schemes are conservative and simple in principle. Although they often have larger signature sizes, they provide strong and well-understood security guarantees.

From this process, NIST selected four algorithms for standardization and deployment:

CRYSTALS-Kyber, for key establishment
CRYSTALS-Dilithium, for digital signatures
FALCON, for digital signatures with compact outputs
SPHINCS+, a hash-based digital signature scheme

These four represent the leading edge of quantum-resistant cryptography and are expected to become the backbone of secure communication in a post-quantum world.

Credit: N. Hanacek/NIST

How Organizations Can Prepare?

Preparing for the post-quantum era doesn’t require access to a quantum computer. The most effective steps security teams can take today are practical measures that lay the groundwork for a smooth transition. The goal is to build awareness, flexibility, and resilience into your cryptographic infrastructure before the standards fully mature.

Here are eight concrete actions IT and security leaders can start implementing now:

Inventory your cryptography
Map out where public-key algorithms are in use across your environment: TLS handshakes, VPNs, code-signing systems, firmware updates, S/MIME, SSH keys, PKI infrastructures, and certificates. Visibility is critical, as you can’t protect what you don’t know exists.
Classify data and lifetimes
Identify sensitive data that needs to remain confidential for years or decades, such as intellectual property, medical records, or government archives. Adversaries could be harvesting encrypted traffic today to decrypt later, a concept called “store now, decrypt later.” Long-lived secrets deserve priority protection.
Adopt crypto agility
Design systems so algorithms can be swapped or added without disruptive refactoring. Modular TLS stacks, configurable key management services, and dual-stack or layered deployments make future migrations less painful.
Start hybrid deployments
Begin experimenting with hybrid key exchange: combining a classical algorithm (e.g., ECDH) with a PQC algorithm. This ensures an attacker would need to break both to succeed. Hybrid deployments reduce risk and give teams hands-on experience. Many vendors already offer hybrid libraries and prototypes.
Track vendor roadmaps and standards
Monitor NIST publications, FIPS updates, and announcements from cloud providers, OS vendors, and open-source libraries like OpenSSL or OpenSSH. Aligning with vendor support and emerging standards ensures smoother adoption.
Test in staging
Integrate PQC-enabled libraries into test environments and measure their real-world impact. Check performance, key sizes, signature sizes, and interoperability. Lattice-based schemes are generally efficient but come with different tradeoffs compared to RSA or ECC.
Update policies and procurement
Require suppliers to report cryptographic dependencies, ask about PQC roadmaps during RFPs, and add clauses mandating crypto agility in new contracts. This ensures your ecosystem evolves alongside your own readiness.
Train your team
Educate developers, operations teams, and leadership with targeted briefings. Everyone should understand both the risks and the migration strategy. This builds confidence and avoids bottlenecks later in the transition.

By taking these steps, organizations can begin their quantum-readiness journey without needing to become quantum researchers themselves. The key is positioning your infrastructure so that when NIST standards are finalized and vendor tooling matures, you’ll be ready to move quickly and securely.

Conclusion – Short and Practical

Quantum computers pose a real threat to today’s public-key cryptography, but post-quantum cryptography (PQC) offers a path forward. NIST has already standardized algorithms like Kyber, Dilithium, FALCON, and SPHINCS+ to help secure communications against future quantum attacks.

As Benjamin Lesieux, developer at Alice and Bob, notes:

“We will have quantum computers powerful enough to break RSA or ECC by the end of the 2030s. It’s impossible to achieve zero risk. Lattice-based cryptography is considered safe, but we can never be certain it’s unbreakable. That’s why it’s crucial to keep following innovations and scientific publications.”

The message is clear: don’t wait. Start by inventorying your cryptography, classify long-lived data, build systems with crypto agility, and test PQC options, ideally in hybrid mode.
Think of current cryptography as a padlock and quantum computers as a developing master key. PQC is the next-generation lock you’ll want in place before the threat arrives.

Sources and Further Reading

INCYBER Forum Japan: Senthorus at the Heart of Japan's Cybersecurity Conversation

Fri, 02 Jan 2026 00:00:00 +0000

Where Cybersecurity Meets Strategy in Tokyo

At Senthorus, our mission is to stay ahead of threats and translate cybersecurity into a business reality. This December, two of our SOC analysts had the privilege of traveling to Tokyo to attend the very first Japanese edition of the INCYBER Forum. For them, it was the perfect opportunity to combine two passions: Cybersecurity and Japan.

Japan today stands at a critical turning point in its digital defense. The past years have seen a rise in highly disruptive cyber incidents, such as the ransomware attack that paralyzed the Port of Nagoya in 2023. On July 4th, the port was forced to halt operations after its terminal management system, the Nagoya United Terminal System (NUTS), was crippled by a LockBit 3.0 ransomware attack. The incident paralyzed container loading and unloading, with full recovery taking about two days as terminals gradually resumed operations.

Recognizing the gravity of such threats, Japan’s government elevated cybersecurity to a national security priority in its revised National Security Strategy. Alongside large-scale investments in digital sovereignty and international partnerships, these developments highlight a country determined to strengthen resilience in the face of growing risks.

“Cyber defense is no longer optional. It is Japan’s next frontier.”
From InCyber Forum Edito

Senthorus SOC analysts Guillaume DUMAS (left) and Adam LARABI (right), with Alexis NARDONE (middle), Director of Forward Global (Event organizer)

The INCYBER Forum: A Global Hub for Cybersecurity

The INCYBER Forum (formerly International Cybersecurity Forum) is an established event first organized in 2007 and has since become a major international gathering dedicated to digital security and trust.

Its core mission: to bring together governments, industry leaders, solution providers, and academics around the same table to share insights and shape the future of cybersecurity.

The forum has expanded beyond its European roots: in 2022, it launched in Canada, and this year it marked a new milestone: its very first edition in Japan.

The INCYBER Forum in Japan

The inaugural INCYBER Forum Japan took place on December 4, 2025, at The Prince Park Tower in Tokyo. Organized by Forward Global, Nikkei Inc., and Dentsu Soken, the event gathered key players from Japan’s government, private sector, and research institutions.

The structure of the event reflected its triple ambition:

A trade exhibition where some 40 partners and vendors showcased the latest solutions in cybersecurity, offering opportunities to connect directly with end users.
A conference program featuring more than 30 speakers covering topics from risk management and incident response to identity protection, cybercrime prevention, and defense strategy.
Leadership and operational structure involving key international and local figures: the event was chaired by Mr. Atsushi ANDO, Director General for Active Cyber Defense and Cyber Intelligence at the National Cyber Office, with strategic and operational leadership provided by Mr. Shigeru KITAMURA, Executive Director of the DENTSU SOKEN Center for Economic Security Research (DCER) and former Secretary General of the National Security Secretariat, alongside Mr. Guillaume TISSIER, General Director of the INCYBER Forum at Forward Global.

For Senthorus, it was not just an occasion to observe, but an opportunity to engage with peers worldwide, exchange perspectives, and better understand Japan’s unique cybersecurity landscape.

Speakers and Workshops: Key Insights

While the full agenda was rich and diverse, several highlights stood out:

Government perspectives on Japan’s national cybersecurity strategy, especially critical infrastructure protection and international cooperation.
Industry-led discussions on ransomware trends, digital identity security, and supply chain protection.
Workshops focused on operational best practices, from incident response to threat intelligence sharing.

The diversity of participants, ranging from Japanese institutions to international experts, illustrated the global, interconnected nature of today’s cyber challenges.

On the Main Stages

The main stages hosted keynote sessions organized by Forward Global, Nikkei Inc., and the Dentsu Soken Center for Economic Security Research. It served as a platform for leaders from politics, industry, and major institutions to address critical cybersecurity issues such as active cyber defense, government policy, and economic security.

Notable sessions included:

Mr. Toshikazu OKUYA, Ministry of Economy, examined the growing convergence of economic and cyber security, highlighting policy tools and public-private cooperation to protect critical industries, supply chains, and economic sovereignty.
Mr. Shigeru KITAMURA, Former Secretary General of National Security Secretariat and National Security Advisor to the Cabinet, focused his session named Cyber Intelligence Sharing and Security Clearance on the need for trust and secure information exchange between public and private sectors. He underlined how intelligence sharing enhances situational awareness and enables faster, more effective responses to sophisticated cyber threats.
Mr. Norihiko ISHIHARA, CEO of VLC Security Co., Ltd., Member of the Cybergym Advisory Board, explored in his session named Latest Developments in AI-Driven Cyber Offense and Defense how artificial intelligence is reshaping both attack techniques and defensive capabilities. He highlighted the growing use of AI for automation, reconnaissance, and evasion on the offensive side, while emphasizing its parallel role in improving detection, correlation, and response within modern security operations.

Mr. Norihiko ISHIHARA during his conference

These sessions provided deep insights into Japan’s cybersecurity priorities, strategies, and operational best practices from both national and industrial perspectives.

The forum concluded with a closing keynote by Mr. François FILLON, Former French Prime Minister, who reflected on the brutalization of international relations and its implications for global stability. His remarks emphasized how increasing geopolitical polarization and the erosion of structured dialogue between states are reshaping international dynamics, including in cyberspace. He highlighted the limitations of simplified narratives and stressed the importance of strategic nuance and balanced alliances in an increasingly fragmented world.

This broader geopolitical perspective provided a fitting conclusion to the forum, underlining the close interconnection between cybersecurity, diplomacy, and global power relations, while also opening the outlook toward the 2026 edition of INCYBER in France.

Mr. François FILLON during his conference

Exhibition Area: A Showcase of Innovation and Expertise

The exhibition area was one of the highlights of the forum, offering the opportunity to engage directly with a wide range of cybersecurity players. International and Japanese vendors such as GMO Internet Group, PwC, Abnormal Security, Cybergym, Filigran, VLC Security, and NEC Security presented their solutions, covering domains from threat detection and identity protection to cyber range training and intelligence-driven defense.

Walking through the stands allowed for in-depth discussions on concrete operational challenges with solution providers, comparison of different approaches, and a clearer understanding of how cybersecurity tools are adapted to the specific needs of the Japanese market. These exchanges, both technical and strategic, illustrated the maturity of the ecosystem and the strong willingness of Japanese and international actors to collaborate across borders.

Exhibition area, where vendors and partners showcased solutions and engaged with attendees throughout the day. (Credit: @INCYBER_Japan)

Conclusion: Why INCYBER Japan Matters

The Japanese edition of the INCYBER Forum comes at a pivotal moment as Japan seeks to turn cybersecurity awareness and policy into effective action amid rising threats and strategic transformation. As Japan’s Prime Minister Ms. Sanae TAKAICHI emphasized, the country is at a turning point in strengthening its cybersecurity capabilities.

“To ensure a coordinated response to change from both the public and private sectors, the government intends to develop a general policy based on the law on strengthening cyber response capabilities […]. In this context of increasing security tensions, the first INCYBER Forum held in Japan comes at a particularly timely moment.” From Ms. Sanae TAKAICHI, Prime Minister of Japan

For our analysts, attending INCYBER Forum Japan was a way to witness firsthand how Japan is transforming its cybersecurity strategy at a crucial moment. The forum offered invaluable insights but also confirmed something we at Senthorus strongly believe: effective cybersecurity depends on collaboration across borders, industries, and disciplines.

As Japan strengthens its defenses and forges new partnerships, events like this will play a key role in aligning strategy with operational realities. For MSSPs like Senthorus, they are also reminders that our work in SOCs is part of a larger global effort to protect the digital world.

Credits

Photos:
Guillaume DUMAS and Adam LARABI

Sources

Guillaume Dumas on Senthorus Blog

Inside the RSA-260 Factorization: GPU-Accelerated GNFS and the Role of Devin

The Missing Method Is No Longer Missing

What Cognition Actually Built

Why Spare AI Compute Was a Good Fit

The RSA-260 Run by the Numbers

What Happened Inside the Pipeline

What Devin Did, and What Still Required a Human

A Tenfold Cost Claim, Not a Mathematical Breakthrough

What the RSA-1024 Estimate Really Means

Why RSA-2048 Remains Out of Reach

Facts, Measurements, and Projections

Conclusion: Engineering Leverage, Not Cryptographic Collapse

Sources and Further Reading

RSA-260 Has Been Factored: What It Really Means for Modern Cryptography

RSA-260 Has Fallen: What Actually Happened

What Is RSA-260?

Why Does Factoring One Number Matter?

How Large RSA Numbers Are Factored in Practice

What We Know, and What We Still Don’t Know

Does This Put RSA-2048 at Risk?

Conclusion - A Record, Not a Cryptographic Collapse

Sources and Further Reading

Introduction to post-quantum cryptography and its implications

Quantum vs Classical Computing: Simple First Steps

Why Is Quantum a Problem for Current Cryptography?

Available Solutions: What’s Already Moving from Research to Standards

How Organizations Can Prepare?

Conclusion – Short and Practical

Sources and Further Reading

INCYBER Forum Japan: Senthorus at the Heart of Japan's Cybersecurity Conversation

Where Cybersecurity Meets Strategy in Tokyo

The INCYBER Forum: A Global Hub for Cybersecurity

The INCYBER Forum in Japan

Speakers and Workshops: Key Insights

On the Main Stages

Exhibition Area: A Showcase of Innovation and Expertise

Conclusion: Why INCYBER Japan Matters

Credits

Sources

INCYBER Forum – Japan Edition

INCYBER Forum – History

Nagoya Port Attack

Ms. Sanae TAKAICHI declaration