On: 768-bit RSA, now officially not enough

[jrockway]

Brute forcing a 768-bit key would require multiple, potentially billions, of such factorizations, correct?

No. There is only one possible factorization of an RSA public key. RSA public keys are, by definition, the product of exactly two primes.

Once you have factored the public key, it is trivial to derive the private key from the two factors.

RSA is only secure because it is hard to factor numbers. This work shows that it's just hard, not impossible.

[nathanb → jrockway]

I see...thank you for correcting my false assumption.