One of the largest numbers ever used to test the limits of RSA cryptography has been factored.
On September 3, engineer Eric Lu published a 130-digit number with a remarkably short message: it “divides RSA-260.” The number was one of the two prime factors of RSA-260, a 260-digit number that had remained unfactored for decades.
That makes RSA-260 the largest of the original RSA challenge numbers known to have been factored.
But despite the headlines, this does not mean modern RSA encryption has been broken.
What does “factored” actually mean?
Every whole number can be broken down into prime numbers.
For example:
15 = 3 × 5
Multiplying 3 and 5 together is trivial. Going backwards is also easy because 15 is small.
Now imagine doing the same thing with a number containing 260 decimal digits.
RSA-260 is the product of two enormous prime numbers. Multiplying those primes together is easy for a computer. Given only the resulting number, however, discovering the original primes can be extraordinarily difficult.
That difference is at the heart of RSA cryptography.
Why RSA depends on factoring being difficult
RSA is a public-key cryptographic system. In simplified terms, a public key contains a very large number produced from two secret prime numbers.
Anyone can know the large number.
But the two primes used to create it must remain secret.
If an attacker can efficiently factor the large number and recover those primes, they can reconstruct information needed to break the corresponding RSA key.
The important word is efficiently.
There are algorithms for factoring integers. The problem is that the computational effort grows dramatically as the numbers become larger.
RSA takes advantage of that difficulty.
So what is RSA-260?
RSA-260 isn’t a password or a key protecting some important website.
It comes from the RSA Factoring Challenge, a collection of increasingly difficult numbers published by RSA Laboratories beginning in 1991.
The idea was straightforward: publish large numbers made from two secret primes and challenge researchers to factor them.
Over the years, improvements in algorithms, software and computing power allowed progressively larger challenge numbers to fall.
RSA-250, a 250-digit number containing 829 bits, was factored in 2020.
RSA-260 is larger: 260 decimal digits, or 862 bits.
Its factorization therefore pushes the public record for this kind of general-purpose RSA-style factorization further.
Does this mean RSA is broken?
No.
The crucial distinction is key size.
RSA-260 is 862 bits long. Modern RSA deployments generally use keys of at least 2,048 bits.
That difference is much larger than it might appear.
Factoring difficulty does not increase linearly with the number of bits. Moving from an 862-bit number to a 2,048-bit one makes the problem enormously harder with the algorithms and conventional computers available today.
So the lesson isn’t that somebody can now factor a 2,048-bit RSA key.
They can’t, based on anything demonstrated by RSA-260.
Instead, the result shows something cryptographers have known for a long time: as algorithms improve and computing resources increase, key sizes that once looked formidable eventually become attainable.
How was it done?
This is one of the most interesting unanswered questions.
Lu initially published the factor itself rather than a detailed technical explanation of how he found it.
Previous record-scale factorizations have required sophisticated algorithms and substantial computing resources. RSA-250, for example, was factored using the Number Field Sieve and required a large distributed computational effort.
Until the computational method and resources behind RSA-260 are fully documented, it is difficult to know exactly what the new record tells us about progress in factoring technology.
That distinction matters.
A record achieved primarily through more computing power would mean something different from one enabled by a major algorithmic breakthrough.
What about quantum computers?
RSA does face a more fundamental theoretical threat from quantum computing.
A sufficiently powerful fault-tolerant quantum computer could use Shor’s algorithm to factor large integers far more efficiently than known classical methods.
Such machines do not currently exist at the scale required to break modern RSA keys.
But the possibility is serious enough that governments and technology companies are already moving toward post-quantum cryptography, which is designed to remain secure against both conventional and quantum computers.
RSA-260 was not evidence that this quantum threat has arrived.
It was a classical factoring achievement.
Why it matters
RSA-260 is best understood as a new marker on a very long-running computational race.
A mathematical problem that was deliberately chosen to be extraordinarily difficult has now been solved.
That does not suddenly make today’s encrypted internet vulnerable. But it provides another data point showing how the boundary between computationally impossible and computationally possible keeps moving.
For cryptography, that moving boundary is exactly why security margins matter.