RSA numbers

In mathematics, the RSA numbers are a set of large semiprimes that were part of the RSA Factoring Challenge. The challenge was to find the prime factors of each number. It was created by RSA Laboratories in March 1991 to encourage research into computational number theory and the practical difficulty of factoring large integers. The challenge was ended in 2007.
RSA Laboratories published a number of semiprimes with 100 to 617 decimal digits. Cash prizes of varying size, up to US$200,000, were offered for factorization of some of them. The smallest RSA number was factored in a few days. Most of the numbers have still not been factored and many of them are expected to remain unfactored for many years to come., the smallest 23 of the 54 listed numbers have been factored.
While the RSA challenge officially ended in 2007, people are still attempting to find the factorizations. According to RSA Laboratories, "Now that the industry has a considerably more advanced understanding of the cryptanalytic strength of common symmetric-key and public-key algorithms, these challenges are no longer active." Some of the smaller prizes had been awarded at the time. The remaining prizes were retracted.
The first RSA numbers generated, from RSA-100 to RSA-500, were labeled according to their number of decimal digits. Later, beginning with RSA-576, binary digits are counted instead. An exception to this is RSA-617, which was created before the change in the numbering scheme. The numbers are listed in increasing order below.

RSA-100

RSA-100 has 100 decimal digits. Its factorization was announced on April 1, 1991, by Arjen K. Lenstra. Reportedly, the factorization took a few days using the multiple-polynomial quadratic sieve algorithm on a MasPar parallel computer.
The value and factorization of RSA-100 are as follows:
RSA-100 = 1522605027922533360535618378132637429718068114961380688657908494580122963258952897654000350692006139
RSA-100 = 37975227936943673922808872755445627854565536638199
× 40094690950920881030683735292761468389214899724061
RSA-100 is often used to benchmark new factorization software or new hardware.
As of December 2009, it took four hours to repeat this factorization using the program Msieve on a 2200 MHz Athlon 64 processor.
As of June 2015, the number could be factorized in 72 minutes on overclocked to 3.5 GHz Intel Core2 Quad q9300, using GGNFS and Msieve binaries running by distributed version of the factmsieve Perl script.
As of June 2025, the number was factored in 108 seconds on 32 Epyc 9174 server cores using YAFU's implementation of the self initializing quadratic sieve.
As of January 2026, the number was reported to have been factored in 4 minutes and 57 seconds on an NVIDIA RTX 5070 Ti, the first such factorization on a complete quadratic sieve factorization pipeline on GPU.

RSA-110

RSA-110 has 110 decimal digits, and was factored in April 1992 by Arjen K. Lenstra and Mark S. Manasse in approximately one month.
The number can be factorized in less than four hours on overclocked to 3.5 GHz Intel Core2 Quad q9300, using GGNFS and Msieve binaries running by distributed version of the factmsieve Perl script.
The value and factorization are as follows:
RSA-110 = 35794234179725868774991807832568455403003778024228226193532908190484670252364677411513516111204504060317568667
RSA-110 = 6122421090493547576937037317561418841225758554253106999
× 5846418214406154678836553182979162384198610505601062333

RSA-120

RSA-120 has 120 decimal digits, and was factored in June 1993 by Thomas Denny, Bruce Dodson, Arjen K. Lenstra, and Mark S. Manasse. The computation took under three months of actual computer time.
The value and factorization are as follows:
RSA-120 = 227010481295437363334259960947493668895875336466084780038173258247009162675779735389791151574049166747880487470296548479
RSA-120 = 327414555693498015751146303749141488063642403240171463406883
× 693342667110830181197325401899700641361965863127336680673013

RSA-129

RSA-129, having 129 decimal digits, was not part of the 1991 RSA Factoring Challenge, but rather related to Martin Gardner's Mathematical Games column in the August 1977 issue of Scientific American.
RSA-129 was factored in April 1994 by a team led by Derek Atkins, Michael Graff, Arjen K. Lenstra and Paul Leyland, using approximately 1600 computers from around 600 volunteers connected over the Internet. A US$100 token prize was awarded by RSA Security for the factorization, which was donated to the Free Software Foundation.
The value and factorization are as follows:
RSA-129 = 114381625757888867669235779976146612010218296721242362562561842935706935245733897830597123563958705058989075147599290026879543541
RSA-129 = 3490529510847650949147849619903898133417764638493387843990820577
× 32769132993266709549961988190834461413177642967992942539798288533
The factorization was found using the Multiple Polynomial Quadratic Sieve algorithm.
The factoring challenge included a message encrypted with RSA-129. When decrypted using the factorization the message was revealed to be "The Magic Words are Squeamish Ossifrage".
In 2015, RSA-129 was factored in about one day, with the CADO-NFS open source implementation of number field sieve, using a commercial cloud computing service for about $30.

RSA-130

RSA-130 has 130 decimal digits, and was factored on April 10, 1996, by a team led by Arjen K. Lenstra and composed of Jim Cowie, Marije Elkenbracht-Huizing, Wojtek Furmanski, Peter L. Montgomery, Damian Weber and Joerg Zayer.
The factorization was found in the third trial.
The value and factorization are as follows:
RSA-130 = 1807082088687404805951656164405905566278102516769401349170127021450056662540244048387341127590812303371781887966563182013214880557
RSA-130 = 39685999459597454290161126162883786067576449112810064832555157243
× 45534498646735972188403686897274408864356301263205069600999044599
The factorization was found using the Number Field Sieve algorithm and the polynomial
5748302248738405200 x⁵ + 9882261917482286102 x⁴
- 13392499389128176685 x³ + 16875252458877684989 x²
+ 3759900174855208738 x¹ - 46769930553931905995
which has a root of 12574411168418005980468 modulo RSA-130.

RSA-140

RSA-140 has 140 decimal digits, and was factored on February 2, 1999, by a team led by Herman te Riele and composed of Stefania Cavallar, Bruce Dodson, Arjen K. Lenstra, Paul Leyland, Walter Lioen, Peter L. Montgomery, Brian Murphy and Paul Zimmermann.
The value and factorization are as follows:
RSA-140 = 21290246318258757547497882016271517497806703963277216278233383215381949984056495911366573853021918316783107387995317230889569230873441936471
RSA-140 = 3398717423028438554530123627613875835633986495969597423490929302771479
× 6264200187401285096151654948264442219302037178623509019111660653946049
The factorization was found using the Number Field Sieve algorithm and an estimated 2000 MIPS-years of computing time.
The matrix had 4671181 rows and 4704451 columns and weight 151141999

RSA-150

RSA-150 has 150 decimal digits, and was withdrawn from the challenge by RSA Security. RSA-150 was eventually factored into two 75-digit primes by Aoki et al. in 2004 using the general number field sieve, years after bigger RSA numbers that were still part of the challenge had been solved.
The value and factorization are as follows:
RSA-150 = 155089812478348440509606754370011861770654545830995430655466945774312632703463465954363335027577729025391453996787414027003501631772186840890795964683
RSA-150 = 348009867102283695483970451047593424831012817350385456889559637548278410717
× 445647744903640741533241125787086176005442536297766153493419724532460296199

RSA-155

RSA-155 has 155 decimal digits, and was factored on August 22, 1999, in a span of six months, by a team led by Herman te Riele and composed of Stefania Cavallar, Bruce Dodson, Arjen K. Lenstra, Walter Lioen, Peter L. Montgomery, Brian Murphy, Karen Aardal, Jeff Gilchrist, Gerard Guillerm, Paul Leyland, Joel Marchand, François Morain, Alec Muffett, Craig Putnam, Chris Putnam and Paul Zimmermann.
The value and factorization are as follows:
RSA-155 = 10941738641570527421809707322040357612003732945449205990913842131476349984288934784717997257891267332497625752899781833797076537244027146743531593354333897
RSA-155 = 1026395928297411057720541965739916759007165678080380668033419335217907113077
79
× 1066034883801684548209272203600128786792079585759892915222706082371930628086
43
The factorization was found using the general number field sieve algorithm and an estimated 8000 MIPS-years of computing time.
The polynomials were 119377138320*x^5 - 80168937284997582*y*x^4 - 66269852234118574445*y^2*x^3 + 11816848430079521880356852*y^3*x^2 + 7459661580071786443919743056*y^4*x - 40679843542362159361913708405064*y^5 and x - 39123079721168000771313449081*y ; 124722179 relations were collected in the sieving stage; the matrix had 6699191 rows and 6711336 columns and weight 417132631.

RSA-160

RSA-160 has 160 decimal digits, and was factored on April 1, 2003, by a team from the University of Bonn and the German Federal Office for Information Security. The team contained J. Franke, F. Bahr, T. Kleinjung, M. Lochter, and M. Böhm.
The value and factorization are as follows:
RSA-160 = 2152741102718889701896015201312825429257773588845675980170497676778133145218859135673011059773491059602497907111585214302079314665202840140619946994927570407753
RSA-160 = 4542789285848139407168619064973883165613714577846979325095998470925000415733
5359
× 4738809060383201619663383230378895197326892292104095794474135464881202849390
9367
The factorization was found using the general number field sieve algorithm.