Factor RSA-280 (928 bits), the next RSA challenge number above the RSA-896 record
Difficulty 22: two records fell in September 2026 by porting the number field sieve to GPUs, and the cost formula puts RSA-280 at about 2.4 times RSA-896, so it is compute and orchestration on a known algorithm, slightly below the next SVP dimension (25). Application value 28: evidence for retiring RSA-1024; deployed RSA-2048 keys are untouched. Leverage 10: no other result depends on it.
The problem
Split the 280-digit challenge number RSA-280 into its two prime factors, beating the current factoring record.
- 1RSA-896 fell in September 2026
- 2RSA-280 is the next larger number
- 3Run the number field sieve on GPUs
- 4Multiply the factors to check
The task. RSA-280 is a 280-digit (928-bit) number published in the 1991 RSA Factoring Challenge. It is the product of two secret primes of similar size; the task is to find them. Multiplying two 140-digit primes takes a computer microseconds, but undoing the multiplication is the hard problem that RSA encryption relies on.
Where the record stands. The largest RSA challenge number factored so far is RSA-896 (896 bits), on 19 September 2026, by Stephen A. Weis with assistance from Claude, using a GPU version of the open-source CADO-NFS on up to 2,048 H100 GPUs: about 30 GPU-years in 10 days. Two weeks earlier Eric Lu at Cognition factored RSA-260 (862 bits) with about 4,900 GPU-days. RSA-280 is the smallest unfactored challenge number above the record. A possible confusion: RSA-270 also has 270 decimal digits like RSA-896, but it is a different, 895-bit number; it is still unfactored, but factoring it would not extend the record.
Path to understanding
foundations → problemThe research entries this problem rests on, in the order to read them. Each links to its explainer.
- Start with
- Step 2
- Step 3
- The general number field sieve and RSA factoring recordsAlgorithm · host
- Then
- Factor RSA-280 (928 bits), the next RSA challenge number above the RSA-896 recordThe problem
State of the art
RSA-250 (829 bits) was factored in February 2020 with CADO-NFS on CPU clusters. In September 2026 two groups moved the general number field sieve to GPUs: Eric Lu at Cognition factored RSA-260 (862 bits) on 3 September with about 4,900 GPU-days (643 for polynomial selection, 3,813 for sieving, 467 for linear algebra) on B200/GB200/GB300 GPUs, an estimated USD 400,000 at market prices; Stephen A. Weis, with assistance from Claude, factored RSA-896 (896 bits) on 19 September with a GPU port of CADO-NFS on up to 256 preemptible nodes of 8 H100 GPUs, about 30 GPU-years over 10 days, with about 29 billion unique relations and a final matrix of about 1.48 billion rows. Both authors state that no algorithmic advance was involved. The heuristic cost formula predicts that RSA-280 costs roughly 2.4 times RSA-896 (an estimate from the formula alone, ignoring the term). The factorisations of RSA-260 and RSA-896 listed on the RSA numbers page multiply out to the published moduli.
Realistic applications
A 928-bit factorisation would show that RSA moduli well above 896 bits fall to GPU fleets of commercial size, strengthening the case for retiring RSA-1024, which the cost formula puts at roughly 30 times RSA-896. Deployed RSA-2048 keys are far beyond reach.
What counts as solved
Two primes whose product equals RSA-280, published with the polynomial, sieving parameters, relation counts, matrix size, software and compute used; verified by multiplication and primality tests.
How it gets verified
Bound / recordA numeric bound or record checked from a certificate or recomputation.
Quantity: the largest RSA challenge number with a public factorisation; record RSA-896 (896 bits, Weis, 2026-09-19). Certificate for RSA-280: the two factors and as decimal integers; the checker computes , compares it with the published RSA-280 value, and runs a primality proof (ECPP or BPSW plus a certificate) on each factor, which takes seconds. Reports should state polynomial, special-q range, unique relations, matrix dimension, software (e.g. CADO-NFS commit) and total GPU- or core-years, so that the cost can be compared with RSA-260 (about 4,900 GPU-days) and RSA-896 (about 30 H100 GPU-years).
Claims under verification
+ add a claimWhere the work is
The number field sieve is established; success depends on GPU implementations of sieving and linear algebra and on a large compute budget.
Bottlenecks
ranked by votes- #1ComputeSieving and linear algebra budget
RSA-896 took about 30 H100 GPU-years; the cost formula puts RSA-280 at roughly 2.4 times that, and the block Wiedemann stage needs a tightly coupled machine with enough memory for a matrix of well over a billion rows.
Community grades
Sign in to add your own grade.
Connected problems
No connections yet.