RSA-896: Inside an 896-Bit Factorization

At first glance, RSA-896 is a wall of digits. A report dated September 19, 2026 presents it as a factorization assisted by Claude, an artificial intelligence assistant: one 896-bit integer split into two large factors. The announcement is compact, but the idea reaches from elementary multiplication to distributed computational number theory. The reported factors matter because multiplying them reconstructs the public number that RSA was designed to make difficult to reverse. (saweis.net)

An 896-bit label is easy to misread. A bit is a binary digit, so RSA-896 does not mean 896 decimal digits. The challenge number is about 270 decimal digits long, while each factor is about 135 digits. RSA challenge numbers were created as fixed test targets for measuring the practical difficulty of integer factorization. (en.wikipedia.org)

A key is built around a hidden product

Rivest–Shamir–Adleman, usually shortened to RSA, is a public-key cryptosystem. That means one key can be published while a related private key remains secret. The system begins by choosing two large prime numbers, which are numbers divisible only by 1 and themselves, then multiplying them:

N = p × q

The result, N, is called the modulus. It appears in the public key. The difficulty comes from reversing the operation: given only N, recover the hidden primes p and q.

Those primes are not an incidental detail. They make it possible to calculate Euler’s totient, a function that counts the numbers below N that share no factor with N:

φ(N) = (p - 1)(q - 1)

RSA also uses a public exponent e and a private exponent d. They are related by the modular equation:

e × d ≡ 1 mod φ(N)

The symbol ≡ means “has the same remainder as.” Once p and q are known, finding φ(N) and the private exponent is routine. Without them, an attacker faces the factorization problem.

Trying every possible divisor would be hopeless. The square root of an 896-bit number is roughly a 448-bit number, so a naive search would still face an enormous range of candidates. The successful approach does not test each possible factor one at a time.

Why the General Number Field Sieve matters

For an ordinary RSA-style semiprime, the classical algorithm associated with this scale is the General Number Field Sieve, or GNFS. A sieve is a method for filtering a huge search space so that computation focuses on candidates with useful mathematical properties. GNFS is not one clever trick; it is a long pipeline in which each stage prepares data for the next.

1. Polynomial selection chooses mathematical expressions that behave well when evaluated around the target number.
2. Sieving searches large ranges for pairs of values whose associated numbers break into small prime factors. Such numbers are called smooth because their entire factorization uses relatively small primes.
3. Filtering and linear algebra remove redundant data and build a large sparse matrix. The calculation looks for dependencies among rows of that matrix, often using arithmetic modulo 2.
4. The square-root step turns one of those dependencies into two different-looking squares with the same remainder modulo N. Their difference has a useful greatest common divisor, or GCD, with N, revealing a factor.

The process feels indirect because it is indirect. Instead of discovering p by guessing, GNFS collects many small clues and combines them until the hidden structure becomes visible. The standard description of the method includes polynomial selection, sieving, filtering, matrix computation, and a final square-root calculation. (eprint.iacr.org)

The public RSA-896 report does not describe which algorithm produced its result. GNFS is the expected classical reference point for a target of this type, but that should not be confused with a published method record. Knowing the factors is one result; documenting how much computation produced them is another.

Where AI fits into the work

The phrase “with Claude” is interesting because it points to a newer style of technical collaboration. An AI assistant can draft sieve code, explain compiler errors, compare parameter choices, generate batch scripts, inspect logs, or help diagnose why a matrix job stopped producing useful dependencies.

That assistance does not remove the expensive middle of the computation. A serious factorization still requires large amounts of arithmetic data, storage, memory, and processing time. A fluent explanation from a language model is not evidence that the factors are correct. Exact multiplication, primality checks, and independent reproduction remain the important tests.

The September 19 report gives the claimed factors but not a complete laboratory notebook: there are no software versions, polynomial parameters, relation counts, matrix dimensions, hardware details, elapsed times, or checksums. That does not make the digits meaningless. It does mean the announcement is best read as a concise factorization report rather than a full performance study.

Verification starts with multiplication

The first check is pleasantly ordinary. Place the exact decimal strings from the report into three files, then run arbitrary-precision integer arithmetic:

from pathlib import Path
from sympy import isprime

n = int(Path('n.txt').read_text)
p = int(Path('p.txt').read_text)
q = int(Path('q.txt').read_text)

assert p * q == n
assert isprime(p)
assert isprime(q)

The first assertion proves that the proposed factors multiply to the published modulus. The next two check that the factors are prime. That distinction matters: a composite pair can multiply to N without being a complete prime factorization. A formal record would also use a proof-capable primality checker and an independent implementation, ideally run by someone who did not produce the original factors.

Once the factorization is accepted and the public exponent is known, the private exponent can be reconstructed:

phi = (p - 1) * (q - 1)
d = pow(e, -1, phi)

That consequence applies only to a public key using the same modulus N. Factoring RSA-896 does not reveal the private keys for unrelated RSA deployments.

A milestone, not a universal RSA break

An 896-bit RSA modulus is far below modern key-size targets. NIST’s published security-strength table associates a 2048-bit RSA modulus with approximately 112 bits of security and a 3072-bit modulus with approximately 128 bits. An 896-bit modulus is not a reasonable choice for a new system. (nvlpubs.nist.gov)

Does RSA-896 mean RSA-2048 is broken? No. A challenge factorization is one fixed target, while real systems use different moduli. The General Number Field Sieve grows subexponentially rather than linearly, and moving from 896 bits to 2048 bits changes the practical cost by an enormous amount. The result marks a point on the factoring curve, not a universal shortcut.

RSA-896 is valuable because it makes an abstract security assumption concrete. A 270-digit wall collapses into p × q, but only after algorithms, machines, careful engineering, and verification cooperate. The lasting lesson is not that an AI can talk its way through RSA. It is that any serious computational claim must end where the arithmetic can be independently checked.