Comparing the difficulty of factorization and discrete logarithm: a 240-digit experiment

TL;DR

This paper presents new records in factoring RSA-240 and computing discrete logarithms over 795-bit primes, demonstrating comparable difficulty and improved efficiency over previous benchmarks, with implications for cryptographic security.

Contribution

It provides the first direct comparison of factorization and discrete logarithm difficulty at the same key size, using optimized algorithms and hardware.

Findings

Discrete logarithm is not much harder than factorization at similar sizes.

Computations were significantly less expensive than previous estimates.

Factorization of RSA-250 is also reported.

Abstract

We report on two new records: the factorization of RSA-240, a 795-bit number, and a discrete logarithm computation over a 795-bit prime field. Previous records were the factorization of RSA-768 in 2009 and a 768-bit discrete logarithm computation in 2016. Our two computations at the 795-bit level were done using the same hardware and software, and show that computing a discrete logarithm is not much harder than a factorization of the same size. Moreover, thanks to algorithmic variants and well-chosen parameters, our computations were significantly less expensive than anticipated based on previous records.The last page of this paper also reports on the factorization of RSA-250.