In mathematics, the RSA numbers are a set of large semiprimes (numbers with exactly two prime factors) that were part of the RSA Factoring Challenge. The challenge was to find the prime factors of each number. It was created by RSA Laboratories in March 1991 to encourage research into computational number theory and the practical difficulty of factoring large integers. The challenge was ended in 2007.
History RSA Laboratories (which is an initialism of the creators of the technique, Rivest, Shamir and Adleman) published a number of semiprimes with 100 to 617 decimal digits. Cash prizes of varying size, up to (and prizes up to awarded), were offered for factorization of some of them. The smallest RSA number was factored in a few days. Most of the numbers have still not been factored and many of them are expected to remain unfactored for many years to come.
, the smallest 24 as well as the 26th of the 54 listed numbers have been factored.
While the RSA challenge officially ended in 2007, people are still attempting to find the factorizations. According to RSA Laboratories, "Now that the industry has a considerably more advanced understanding of the cryptanalytic strength of common symmetric-key and public-key algorithms, these challenges are no longer active." Some of the smaller prizes had been awarded at the time. The remaining prizes were retracted.
The first RSA numbers generated, from RSA-100 to RSA-500, were labeled according to their number of decimal digits. Later, beginning with RSA-576, binary digits are counted instead. An exception to this is RSA-617, which was created before the change in the numbering scheme. The numbers are listed in increasing order below.
Overview
Rank Name Digits Bits Factor date 1 RSA-100 100 330 1991-04-01 2 RSA-110 110 364 1992-04 3 RSA-120 120 397 1993-06 4 RSA-129 129 426 1994-04 5 RSA-130 130 430 1996-04-10 6 RSA-140 140 463 1999-02-02 7 RSA-150 150 496 2004 8 RSA-155 155 512 1999-08-22 9 RSA-160 160 530 2003-04-01 10 RSA-170 170 563 2009-12-29 11 RSA-576 174 576 2003-12-03 12 RSA-180 180 596 2010-05-08 13 RSA-190 190 629 2010-11-08 14 RSA-640 193 640 2005-11-02 15 RSA-200 200 663 2005-05-09 16 RSA-210 210 696 2013-09 17 RSA-704 212 704 2012-07-02 18 RSA-220 220 729 2016-05-13 19 RSA-230 230 762 2018-08-15 20 RSA-232 232 768 2020-02-17 21 RSA-768 232 768 2009-12-12 22 RSA-240 240 795 2019-11 23 RSA-250 250 829 2020-02-28 24 RSA-260 260 862 2026-09-03 25 RSA-270 270 895 26 RSA-896 270 896 2026-09-19 27 RSA-280 280 928 28 RSA-290 290 962 29 RSA-300 300 995 30 RSA-309 309 1,024 31 RSA-1024 309 1,024 32 RSA-310 310 1,028 33 RSA-320 320 1,061 34 RSA-330 330 1,094 35 RSA-340 340 1,128 36 RSA-350 350 1,161 37 RSA-360 360 1,194 38 RSA-370 370 1,227 39 RSA-380 380 1,261 40 RSA-390 390 1,294 41 RSA-400 400 1,327 42 RSA-410 410 1,360 43 RSA-420 420 1,393 44 RSA-430 430 1,427 45 RSA-440 440 1,460 46 RSA-450 450 1,493 47 RSA-460 460 1,526 48 RSA-1536 463 1,536 49 RSA-470 470 1,559 50 RSA-480 480 1,593 51 RSA-490 490 1,626 52 RSA-500 500 1,659 53 RSA-617 617 2,048 54 RSA-2048 617 2,048
Table of solved RSA numbers ++ First solverdatealgorithmcompute powercalendar timeppmpqs by Mark Manasse and Arjen K. Lenstraapprox. 7 MIP-YearsRSA-1101992-04-14ppmpqs by Arjen K. Lenstraone month on 5/8 of a 16K MasParRSA-1201993-06-09ppmpqs835 mips years run by Arjen K. Lenstra (45.503%), Bruce Dodson (30.271%), Thomas Denny (22.516%), Mark Manasse (1.658%), and Walter Lioen and Herman te Riele (0.049%)RSA-1291994-04-26ppmpqsapproximately 5000 mips years run by Derek Atkins, Michael Graff, Arjen K. Lenstra, Paul Leyland, and more than 600 volunteersRSA-1301996-04-10General Number Field Sieve with lattice sieving implementations by Bellcore, CWI, and Saarbruecken; and blocked Lanczos and square root by Peter L. Montgomerysieving: estimated 500 mips years, run by Bruce Dodson (28.37%), Peter L. Montgomery and Marije Elkenbracht-Huizing (27.77%), Arjen K. Lenstra (19.11%), WWW contributors (17.17% ), Matt Fante (4.36%), Paul Leyland (1.66%), Damian Weber and Joerg Zayer (1.56%) matrix (67.5 hours on the Cray-C90 at SARA, Amsterdam) and square root (48 hours per dependency on an SGI Challenge processor) run by Peter L. Montgomery and Marije Elkenbracht-HuizingRSA-1401999-02-02GNFS with line (by CWI; 45%) and lattice (by Arjen K. Lenstra; 55%) sieving, and a polynomial selection method by Brian Murphy and Peter L. Montgomery; and blocked Lanczos and square root by Peter L. Montgomerypolynomial selection: 2000 CPU hours on four 250 MHZ SGI Origin 2000 processors at CWI sieving: 8.9 CPU-years on about 125 SGI and Sun workstations running at 175 MHZ on average, and on about 60 PCs running at 300 MHZ on average; approximately equivalent to 1500 mips years; run by Peter L. Montgomery, Stefania Cavallar, Herman J.J. te Riele, and Walter M. Lioen (36.8%), Paul Leyland (28.8%), Bruce Dodson (26.6%), Paul Zimmermann (5.4%), and Arjen K. Lenstra (2.5%).
matrix: 100 hours on the Cray-C916 at SARA, Amsterdam
square root: four different dependencies were run in parallel on four 250 MHZ SGI Origin 2000 processors at CWI; three of them found the factors of RSA-140 after 14.2, 19.0 and 19.0 CPU-hourseleven weeks (including four weeks for polynomial selection, one month for sieving, one week for data filtering and matrix construction, five days for the matrix, and 14.2 hours to find the factors using the square root)RSA-1551999-08-22GNFS with line (29%) and lattice (71%) sieving, and a polynomial selection method written by Brian Murphy and Peter L. Montgomery, ported by Arjen Lenstra to use his multiple precision arithmetic code (LIP); and blocked Lanczos and square root by Peter L. Montgomerypolynomial selection run by Brian Murphy, Peter Montgomery, Arjen Lenstra and Bruce Dodson; Dodson found the one that was used sieving: 35.7 CPU-years in total, on about one hundred and sixty 175-400 MHz SGI and Sun workstations, eight 250 MHz SGI Origin 2000 processors, one hundred and twenty 300-450 MHz Pentium II PCs, and four 500 MHz Digital/Compaq boxes; approximately equivalent to 8000 mips years; run by Alec Muffett (20.1% of relations, 3057 CPU days), Paul Leyland (17.5%, 2092 CPU days), Peter L. Montgomery and Stefania Cavallar (14.6%, 1819 CPU days), Bruce Dodson (13.6%, 2222 CPU days), Francois Morain and Gerard Guillerm (13.0%, 1801 CPU days), Joel Marchand (6.4%, 576 CPU days), Arjen K. Lenstra (5.0%, 737 CPU days), Paul Zimmermann (4.5%, 252 CPU days), Jeff Gilchrist (4.0%, 366 CPU days), Karen Aardal (0.65%, 62 CPU days), and Chris and Craig Putnam (0.56%, 47 CPU days)
matrix: 224 hours on one CPU of the Cray-C916 at SARA, Amsterdam square root: four 300 MHz R12000 processors of a 24-processor SGI Origin 2000 at CWI; the successful one took 39.4 CPU-hours and the others took 38.3, 41.9, and 61.6 CPU-hours9 weeks for polynomial selection, plus 5.2 months for the rest (including 3.7 months for sieving, about 1 month for data filtering and matrix construction, and 10 days for the matrix)
Solved individual RSA numbers
RSA-100 RSA-100 has 100 decimal digits (330 bits). Its factorization was announced on April 1, 1991, by Arjen K. Lenstra. Reportedly, the factorization took a few days using the multiple-polynomial quadratic sieve algorithm on a MasPar parallel computer.
The value and factorization of RSA-100 are as follows:
RSA-100 = 1522605027922533360535618378132637429718068114961380688657908494580122963258952897654000350692006139
RSA-100 = 37975227936943673922808872755445627854565536638199 × 40094690950920881030683735292761468389214899724061
RSA-100 is often used to benchmark new factorization software or new hardware.
As of December 2009, it took four hours to repeat this factorization using the program Msieve on a 2200 MHz Athlon 64 processor.
As of June 2015, the number could be factorized in 72 minutes on overclocked to 3.5 GHz Intel Core2 Quad q9300, using GGNFS and Msieve binaries running by distributed version of the factmsieve Perl script.
As of June 2025, the number was factored in 108 seconds on 32 Epyc 9174 server cores using YAFU's implementation of the self initializing quadratic sieve.
As of January 2026, the number was reported to have been factored in 4 minutes and 57 seconds on an NVIDIA RTX 5070 Ti, the first such factorization on a complete quadratic sieve factorization pipeline on GPU.
RSA-110 RSA-110 has 110 decimal digits (364 bits), and was factored in April 1992 by Arjen K. Lenstra and Mark S. Manasse in approximately one month.
The number can be factorized in less than four hours on overclocked to 3.5 GHz Intel Core2 Quad q9300, using GGNFS and Msieve binaries running by distributed version of the factmsieve Perl script.
The value and factorization are as follows:
RSA-110 = 35794234179725868774991807832568455403003778024228226193532908190484670252364677411513516111204504060317568667
RSA-110 = 6122421090493547576937037317561418841225758554253106999 × 5846418214406154678836553182979162384198610505601062333
RSA-120 RSA-120 has 120 decimal digits (397 bits), and was factored in June 1993 by Thomas Denny, Bruce Dodson, Arjen K. Lenstra, and Mark S. Manasse. The computation took under three months of actual computer time.
The value and factorization are as follows:
RSA-120 = 227010481295437363334259960947493668895875336466084780038173258247009162675779735389791151574049166747880487470296548479
RSA-120 = 327414555693498015751146303749141488063642403240171463406883 × 693342667110830181197325401899700641361965863127336680673013
RSA-129 RSA-129, having 129 decimal digits (426 bits), was not part of the 1991 RSA Factoring Challenge, but rather related to Martin Gardner's Mathematical Games column in the August 1977 issue of Scientific American.
RSA-129 was factored in April 1994 by a team led by Derek Atkins, Michael Graff, Arjen K. Lenstra and Paul Leyland, using approximately 1600 computers from around 600 volunteers connected over the Internet. A US$100 token prize was awarded by RSA Security for the factorization, which was donated to the Free Software Foundation.
The value and factorization are as follows:
RSA-129 = 114381625757888867669235779976146612010218296721242362562561842935706935245733897830597123563958705058989075147599290026879543541
RSA-129 = 3490529510847650949147849619903898133417764638493387843990820577 × 32769132993266709549961988190834461413177642967992942539798288533
The factorization was found using the multiple polynomial quadratic sieve algorithm.
The factoring challenge included a message encrypted with RSA-129. When decrypted using the factorization the message was revealed to be "The Magic Words are Squeamish Ossifrage".
In 2015, RSA-129 was factored in about one day, with the CADO-NFS open source implementation of number field sieve, using a commercial cloud computing service for about $30.
RSA-130 RSA-130 has 130 decimal digits (), and was factored on April 10, 1996, by a team led by Arjen K. Lenstra and composed of Jim Cowie, Marije Elkenbracht-Huizing, Wojtek Furmanski, Peter L. Montgomery, Damian Weber and Joerg Zayer.
The factorization was found in the third trial.
The value and factorization are as follows:
RSA-130 = 1807082088687404805951656164405905566278102516769401349170127021450056662540244048387341127590812303371781887966563182013214880557
RSA-130 = 39685999459597454290161126162883786067576449112810064832555157243 × 45534498646735972188403686897274408864356301263205069600999044599
The factorization was found using the Number Field Sieve algorithm and the polynomial
5748302248738405200 x5 + 9882261917482286102 x4 - 13392499389128176685 x3 + 16875252458877684989 x2 + 3759900174855208738 x1 - 46769930553931905995
which has a root of modulo RSA-130.
RSA-140