RSA-260 Has Been Factored: What It Really Means for Modern Cryptography

RSA-260 Has Fallen: What Actually Happened

On September 3, 2026, engineer Eric Lu (@penlume) published a 130-digit number on X, followed by only two words: “divides RSA-260”

Original Tweet from Eric LU

The number is one of the two prime factors of RSA-260, a 260-decimal-digit integer that had remained unfactored since the RSA Factoring Challenge began in 1991. Dividing by the published factor reveals the other prime, multiplying them reconstructs the challenge number exactly.

The result moves the public record for factoring a general RSA-style number from 829 to 862 bits and closes a 35-year-old challenge.

It is also easy to misunderstand. RSA-260 is not a production key, and the result does not mean current 2048-bit keys can suddenly be broken. Its broader significance depends on how the factorization was obtained, a detail not yet disclosed by Eric Lu.

What Is RSA-260?

RSA-260 belongs to a collection published by RSA Laboratories to measure progress in integer factorization. Each number was created by multiplying two secret primes:

N = p × q

The public received N, while p and q were withheld. Recovering them provided a practical benchmark for algorithms, software, hardware, and distributed computing.

The name is confusing: in the original series, “260” refers to decimal digits, not bits. RSA-260 is 862 bits long, while each newly published factor has 130 decimal digits, or 431 bits.

RSA-260 is a challenge modulus, not a complete production key. A real public key also includes an exponent e. Knowing p and q allows the corresponding private exponent to be calculated. This challenge protected no production data, so its factorization breaks one mathematical target, not a deployed service.

Why Does Factoring One Number Matter?

RSA relies on a useful asymmetry: multiplying two large primes is easy, but reversing the multiplication is extremely difficult when the primes and modulus are large enough. Think of two ingredients fused into a solid block. Anyone can inspect the block, but separating it into the exact originals requires enormous work. Factoring reveals the trapdoor behind private-key operations.

Factorization records show what is practically achievable, helping researchers calibrate security estimates and identify key sizes within reach of well-funded classical projects.

The previous record, RSA-250, was completed in 2020. The 829-bit number was factored with the Number Field Sieve and CADO-NFS at a reported cost of approximately 2,700 CPU core-years. About 2,450 core-years went into the sieving phase.

A core-year measures total work, not elapsed time: thousands of comparable cores can compress millennia of aggregate computation into months. Actual performance also depends on memory, networking, hardware, and software optimization.

RSA-260 adds 33 bits, but difficulty does not grow linearly with length. It remains close enough to RSA-250 that improved classical software and hardware could plausibly explain the result without a mathematical breakthrough.

How Large RSA Numbers Are Factored in Practice

Factoring algorithms suit different targets. Trial division handles small numbers, Pollard’s rho and the Elliptic Curve Method help when one factor is relatively small. RSA challenge numbers avoid that weakness by using two large, balanced primes.

For a general number of this size, the strongest known classical approach is the General Number Field Sieve (GNFS). RSA-260’s method remains unpublished, so GNFS is an expected baseline, not a confirmed explanation.

At an operational level, a GNFS computation is a pipeline:

Polynomial selection
Find representations that make the remaining work more efficient.
Relation sieving
Distribute the expensive search for useful relations across many systems.
Filtering
Remove duplicate and unhelpful data before building the matrix.
Sparse linear algebra
Solve a huge sparse matrix, a memory intensive task.
Square root and factor extraction
Convert the final dependency into one factor: ordinary division reveals the other.

High-level General Number Field Sieve pipeline

This explains the apparent paradox: finding the factors may require years of aggregate work, while checking them takes seconds.

What We Know, and What We Still Don’t Know

The published factor can be checked independently with a dependency-free Python script:

N = int(
    "2211282552952966643528108525502623092761208950247001539441374831"
    "9128822941402001986512729726569746599085900330031400051170742204"
    "5608592763579537571859542988389587092292384910067030341246205457"
    "84566413664540684214361293017694020846391065875914794251435144458199"
)

p = int(
    "4397328654844826923795068102505872571721883526553349659561256924"
    "505973939597593482272505698004801207988043088656411102133523080581"
)

assert N % p == 0
q = N // p

assert p * q == N

print(N.bit_length(), len(str(p)), len(str(q)))
# 862 130 130

Dividing RSA-260 by p gives the complementary 130-digit prime:

q = 5028695206842569864686141618253083416610081090075366674776775706538324961364412200138116378509733307971876652984898985905923678379

With both factors known, a direct multiplication is enough to verify the result:

N = int(
    "2211282552952966643528108525502623092761208950247001539441374831"
    "9128822941402001986512729726569746599085900330031400051170742204"
    "5608592763579537571859542988389587092292384910067030341246205457"
    "84566413664540684214361293017694020846391065875914794251435144458199"
)

p = int(
    "4397328654844826923795068102505872571721883526553349659561256924"
    "505973939597593482272505698004801207988043088656411102133523080581"
)

q = int(
    "5028695206842569864686141618253083416610081090075366674776775706"
    "538324961364412200138116378509733307971876652984898985905923678379"
)

assert p * q == N
print("RSA-260 factorization verified")

The arithmetic is not the uncertain part. As of September 6, 2026, these details remain undocumented:

the factoring algorithm and parameter choices
the software and version used
the hardware, total compute, and wall-clock duration
whether any new optimization or research contribution was involved

GNFS is plausible because it is established for balanced composites at this scale. Employment by an AI company is not evidence that AI found the factors, and a joking reference to “paper and pencil” is not a technical disclosure. There is no public evidence of a quantum computation either.

The missing methodology changes how the result should be interpreted:

Established GNFS plus large-scale computing would be a record and useful calibration point, but a continuation of existing progress.
A major implementation or hardware optimization could lower the cost of attacking other undersized keys.
A fundamentally better algorithm would have much broader consequences, but no evidence currently supports that scenario.

Until a reproducible report appears, the responsible conclusion is simple: the factorization is confirmed, and the claimed technique is not.

Does This Put RSA-2048 at Risk?

At 862 bits, RSA-260 is smaller than legacy 1024-bit keys already considered inadequate for new protection. NIST maps RSA-1024 to no more than 80 bits of classical security and RSA-2048 to approximately 112 bits. RSA-3072 provides about 128 bits.

Although 2048 is about 2.4 times 862, the required work is not 2.4 times greater. GNFS complexity rises extremely quickly with modulus size.

The result is also specific to one modulus. It reveals nothing about an unrelated, correctly generated key. Reused primes or weak randomness can connect keys, but those are implementation failures, not consequences of this record.

An organization still using an 862-bit key should treat this as a serious warning. For correctly generated 2048- and 3072-bit keys, it creates no new immediate attack path. Existing migration plans should continue, but RSA-260 is not itself a breach.

Conclusion - A Record, Not a Cryptographic Collapse

RSA-260 is a genuine achievement: a 260-digit challenge that stood for 35 years has been split into two 130-digit prime factors.

It does not show that RSA-2048 is broken, that a quantum computer was involved, or that AI discovered a new algorithm. Correctly generated modern keys do not require emergency rotation because of this announcement.

The practical response is simple: retire undersized RSA keys, verify key-generation quality, monitor the eventual technical disclosure, and preserve cryptographic agility.

Think of RSA-260 as one difficult lock opened after an enormous effort. It measures the frontier of classical computation. It is not a master key for every larger lock.

For now, the factorization itself is verified and the method remains the open question. That distinction is what turns a dramatic headline into an accurate security assessment.