Blog

Categories:

16. 2. 2026

Security Cryptography

Comparison of Digital and Quantum Computers, Part 2: Factorization

Everyone in the IT field is interested in how big a threat quantum computers are to cryptography and how to deal with the problem. This series of articles tries to explain this problem in a popular way. After the Introduction, we can look at the problem of factorization.

The RSA Algorithm and the Factorization Problem

Let's start with the factorization problem. The best way to attack this algorithm is provided by the so-called GNFS (General Number Field Sieve). This provides a list of pairs of numbers. If we multiply these numbers together, we should get the desired product. Then, we need to test the given pairs of numbers for primality. If we want to find out the approximate number of operations, we need to know the complexity of the GNFS algorithm itself, which can be calculated based on information about the length of n the factored number. We give this length in bits.

$M(n) \approx \left( 8 \bullet \exp\left( 3,4 \bullet n^{\frac{1}{3}} \bullet \left( \ln n \right)^{\frac{2}{3}} \right) \right)$

An important part is determining the number of number pairs. This data is usually in units of pairs, the exception is the situation when the primality verification fails for some reason during generation. This data therefore works as a kind of indicator. Based on further tests, the aforementioned indicator can warn, for example, about an inappropriate choice of testing algorithm. So, ideally, we will get one result, or five results. If there are more than ten, there has probably been a failure somewhere and it is advisable to check the entire mechanism.
In any of these cases, a test for primality of the expected pairs follows. Since the number of tests is small, there is no significant change in complexity. However, the correct choice of testing algorithms is important. Among the applicable ones are the following:

AKS (Agrawal–Kayal–Saxena primality test, cyclotomic AKS test), which is used only for smaller bit ranges due to its high computational complexity. This test is impractical for numbers above 256b. The advantage is its deterministic output, the test has a complexity of approximately O(n⁶)
Baillie-PSW is based on the Miller-Rabin test and the complementary Lukas test. It has no range restrictions, it is a heuristic test with a complexity of approximately O(n log n log[log n]).
ECPP (Elliptic Curve Primality Proving/Elliptic Curve Primality testing) tests are based on the work of Shafi Goldwasser and are applicable up to the range of 10⁵+1 bit. This is again a deterministic This is again a deterministic test with complexity of O(n⁴)
Miller-Rabin is a probabilistic test, usable with keys up to about 4kb in size. The problem is the probabilistic output, to ensure adequate conclusiveness it is necessary to implement more than tens of tests. As a rule, 40-100 passes are used, the total complexity of the algorithm is O(kn log²n log[log n]) where k is the number of bases.

So we know how many logical operations are needed, but how to convert this into instructions for a 64b CPU? Based on the requirements, it is necessary to solve the creation of the matrix (120 instructions per step) and then the analysis of the matrix content (5 instructions per step). Then the results must be tested for primality. This calculation applies to numbers that fit into the processor registers. As soon as the prime numbers are larger, the calculation begins to become more complicated. Of course, the number of operations for creating the matrix increases in a similar way and slightly for analyzing it. From this, it is possible to approximately determine the total number of instructions.
In a similar way, we can also find the total memory requirement. The amount of memory required to create the GNFS matrix is approximately:

$M(n) \approx \left( 8 \bullet \exp\left( 3,4 \bullet n^{\frac{1}{3}} \bullet \left( \ln n \right)^{\frac{2}{3}} \right) \right)$

Based on the above approximate calculations, we have estimates that we can use to calculate the required machine time, the related power consumption and the amount of memory needed to complete the given task. The task will be to factorize the key in order to find out what is within the capabilities of individuals, organizations or our civilization, or what is completely beyond our capabilities. For our own calculation, we will consider a hypothetical computer with 10 cores at a frequency of 1GHz, without hyperthreading, the power consumption of this computer will be an ideal 100 W. Based on the previous information, the following results are obtained:

n-bit	Complexity	Factorization	Instructions	Memory (B)	Time (years)	Energy (J)
512	2^75.2	1.757∙10¹⁹	2.19∙10²¹	6.75∙10¹²	6.96∙10⁵	2.19∙10¹⁵
1024	2^101.6	1.316∙10²⁶	1.64∙10²⁸	2.58∙10¹⁷	5.21∙10¹²	1.64∙10²²
2048	2^136.4	1.533∙10³⁵	1.91∙10³⁷	2.86∙10²³	6.07∙10²¹	1.91∙10³¹
2540	2^149.3	3.527∙10³⁸	4.40∙10⁴⁰	4.99∙10²⁵	1.39∙10²⁵	4.40∙10³⁵
3072	2^161.7	5.805∙10⁴¹	7.25∙10⁴³	6.95∙10²⁷	2.30∙10²⁸	7.25∙10³⁷
4096	2^182.2	1.289∙10⁴⁷	1.61∙10⁴⁹	2.55∙10³¹	5.11∙10³³	1.61∙10⁴³
7168	2^229.3	2.539∙10⁵⁹	3.17∙10⁶¹	4.01∙10³⁹	1.00∙10⁴⁶	3.17∙10⁵⁵
8192	2^242.1	5.708∙10⁶²	7.13∙10⁶⁴	6.88∙10⁴¹	2.26∙10⁴⁹	7.13∙10⁵⁸
13550	2^296.9	1.178∙10⁷⁷	1.47∙10⁷⁹	2.40∙10⁵¹	4.66∙10⁶³	1.47∙10⁷³
37100	2^444.2	3.952∙10¹¹⁵	4.94∙10¹¹⁷	1.16∙10⁷⁷	1.56∙10¹⁰²	4.94∙10¹¹¹
76608	2^591.4	1.342∙10¹⁵⁴	1.67∙10¹⁵⁶	5.64∙10¹⁰²	5.32∙10¹⁴⁰	1.67∙10¹⁵⁰

Unfortunately, the reality will be extremely different. If there is not enough memory, access to data during the calculation will be slowed down due to the need to access the data storage. This is an expansion of the order of 10³ for NVMe disks, 10⁴ for SSD disks and 10⁷ for HDD - spinning disks. At the same time, memory in the order of TB is needed for the 512b number itself. The memories themselves have a consumption that corresponds to another approximately 100W per 1.5 TB. This corresponds to a small increase in power consumption in decimal places. Furthermore, especially when analyzing a matrix that is huge in size, the data does not fit in the processor cache. This leads to so-called cache-misses, i.e. these are memory-intensive operations. However, any such access needs to reload the memory contents into the cache, together with problems with branch prediction in the code, this will mean a loss of approximately 200 cycles. No calculations will be performed during this time. Overall, this can result in a slowdown of approximately 5 orders of magnitude (10⁵ to 10⁹ depending on the technologies used).
Are we capable of carrying out such an attack? We can look at it from several perspectives:

AMD have produced an estimated billions of processors in their entire history (we can consider 50 years), so we are in the order of 10⁹ . Since the first processors had a single core for several decades and only after 2006 did multiple cores begin to be used, it is possible to consider an average of 2.5 cores per processor. The considered available performance will reduce the time accordingly, but in the overall range this performance will rather eliminate the small fluctuation caused by problems with the availability of large data in the processor cache.
If we consider only time, the universe was created 18 billion years ago. This corresponds to the order of 10¹⁰, so we are not able to perform such a calculation fast enough.
If we consider only the required power input, we can think as follows. The entire human civilization had an electrical power input of around 30,000 TWh in 2025, i.e. in the order of 10¹⁶ Wh. The sun provides us with a source with a capacity of 10¹⁷ W (what we receive on the Earth's surface), so if we wanted to freeze, we could use the energy. In the case of harnessing the entire sun, we are talking about a source with a power of 10²⁶ W. The central black hole of our galaxy is then capable of providing 10²⁹ W and the entire galaxy approximately 10³⁷ W. It is clear that even these sources are not sufficient.

To be continued in the section Algorithms Using the Discrete Logarithm Problem

References:

Sage Math script - RSA Factorization
Source: https://cryptosession.info/ke-stazeni
A Tale of Two Sieves
Source: https://www.ams.org/
On Polynomila Selection for the General Number Field Sieve
Source: https://www.ams.org/

Autor článku:

Jan Dušátko

Jan Dušátko has been working with computers and computer security for almost a quarter of a century. In the field of cryptography, he has cooperated with leading experts such as Vlastimil Klíma or Tomáš Rosa. Currently he works as a security consultant, his main focus is on topics related to cryptography, security, e-mail communication and Linux systems.

1. Introductory Provisions

1.1. These General Terms and Conditions are, unless otherwise agreed in writing in the contract, an integral part of all contracts relating to training organised or provided by the trainer, Jan Dušátko, IČ 434 797 66, DIČ 7208253041, with location Pod Harfou 938/58, Praha 9 (next as a „lector“).
1.2. The contracting parties in the general terms and conditions are meant to be the trainer and the ordering party, where the ordering party may also be the mediator of the contractual relationship.
1.3. Issues that are not regulated by these terms and conditions are dealt with according to the Czech Civil Code, i.e. Act No.89/2012 Coll.
1.4. All potential disputes will be resolved according to the law of the Czech Republic.

2. Creation of a contract by signing up for a course

2.1. Application means unilateral action of the client addressed to the trainer through a data box with identification euxesuf, e-mailu with address register@cryptosession.cz or register@cryptosession.info, internet pages cryptosession.cz, cryptosession.info or contact phone +420 602 427 840.
2.2. By submitting the application, the Client agrees with these General Terms and Conditions and declares that he has become acquainted with them.
2.3. The application is deemed to have been received at the time of confirmation (within 2 working days by default) by the trainer or intermediary. This confirmation is sent to the data box or to the contact e-mail.
2.4. The standard time for registration is no later than 14 working days before the educational event, unless otherwise stated. In the case of a natural non-business person, the order must be at least 28 working days before the educational event.
2.5. More than one participant can be registered for one application.
2.6. If there are more than 10 participants from one Client, it is possible to arrange for training at the place of residence of the intermediary or the Client.
2.7. Applications are received and processed in the order in which they have been received by the Provider. The Provider immediately informs the Client of all facts. These are the filling of capacity, too low number of participants, or any other serious reason, such as a lecturer's illness or force majeure. In this case, the Client will be offered a new term or participation in another educational event. In the event that the ordering party does not agree to move or participate in another educational event offered, the provider will refund the participation fee. The lack of participants is notified to the ordering party at least 14 days before the start of the planned term.
2.8. The contract between the provider and the ordering party arises by sending a confirmation from the provider to the ordering party.
2.9. The contract may be changed or cancelled only if the legal prerequisites are met and only in writing.

3. Termination of the contract by cancellation of the application

3.1. The application may be cancelled by the ordering party via e-mail or via a data mailbox.
3.2. The customer has the right to cancel his or her application for the course 14 days before the course takes place without any fees. If the period is shorter, the subsequent change takes place. In the interval of 7-13 days, an administrative fee of 10% is charged, cancellation of participation in a shorter interval than 7 days then a fee of 25%. In case of cancellation of the application or order by the customer, the possibility of the customer's participation in an alternative period without any additional fee is offered. The right to cancel the application expires with the implementation of the ordered training.
3.3. In case of cancellation of the application by the trainer, the ordering party is entitled to a full refund for the unrealized action.
3.4. The ordering party has the right to request an alternative date or an alternative training. In such case, the ordering party will be informed about all open courses. The alternative date cannot be enforced or enforced, it depends on the current availability of the course. If the alternative training is for a lower price, the ordering party will pay the difference. If the alternative training is for a lower price, the trainer will return the difference in the training prices to the ordering party.

4. Price and payment terms

4.1. By sending the application, the ordering party accepts the contract price (hereinafter referred to as the participation fee) indicated for the course.
4.2. In case of multiple participants registered with one application, a discount is possible.
4.3. The participation fee must be paid into the bank account of the company held with the company Komerční banka č. 78-7768770207/0100, IBAN:CZ5301000000787768770207, BIC:KOMBCZPPXXX. When making the payment, a variable symbol must be provided, which is indicated on the invoice sent to the client by the trainer.
4.4. The participation fee includes the provider's costs, including the training materials. The provider is a VAT payer.
4.5. The client is obliged to pay the participation fee within 14 working days of receipt of the invoice, unless otherwise stated by a separate contract.
4.6. If the person enrolled does not attend the training and no other agreement has been made, his or her absence is considered a cancellation application at an interval of less than 7 days, i.e. the trainer is entitled to a reward of 25% of the course price. The overpayment is returned within 14 days to the sender's payment account from which the funds were sent. Payment to another account number is not possible.
4.7. An invoice will be issued by the trainer no later than 5 working days from the beginning of the training, which will be sent by e-mail or data box as agreed.

5. Training conditions

5.1. The trainer is obliged to inform the client 14 days in advance of the location and time of the training, including the start and end dates of the daily programme.
5.2. If the client is not a student of the course, he is obliged to ensure the distribution of this information to the end participants. The trainer is not responsible for failure to comply with these terms and conditions.
5.2. By default, the training takes place from 9 a.m. to 5 p.m. at a predetermined location.
5.3. The trainer can be available from 8 a.m. to 9 a.m. and then from 17 a.m. to 6 p.m. for questions from the participants, according to the current terms and conditions.
5.4. At the end of the training, the certificate of absorption is handed over to the end users.
5.5. At the end of the training, the end users evaluate the trainer's approach and are asked to comment on the evaluation of his presentation, the manner of presentation and the significance of the information provided.

6. Complaints

6.1. If the participant is grossly dissatisfied with the course, the trainer is informed of this information.
6.2. The reasons for dissatisfaction are recorded in the minutes in two copies on the same day. One is handed over to the client and one is held by the trainer.
6.3. A statement on the complaint will be submitted by e-mail within two weeks. A solution will then be agreed within one week.
6.4. The customer's dissatisfaction may be a reason for discontinuing further cooperation, or financial compensation up to the price of the training, after deduction of costs.

7. Copyright of the provided materials

7.1. The training materials provided by the trainer in the course of the training meet the characteristics of a copyrighted work in accordance with Czech Act No 121/2000 Coll.
7.2. None of the training materials or any part thereof may be further processed, reproduced, distributed or used for further presentations or training in any way without the prior written consent of the trainer.

8. Liability

8.1. The trainer does not assume responsibility for any shortcomings in the services of any third party that he uses in the training.
8.2. The trainer does not assume responsibility for injuries, damages and losses incurred by the participants in the training events or caused by the participants. Such costs, caused by the above circumstances, shall be borne exclusively by the participant in the training event.

9. Validity of the Terms

9.1 These General Terms and Conditions shall be valid and effective from 1 October 2024.

Blog

Comparison of Digital and Quantum Computers, Part 2: Factorization

The RSA Algorithm and the Factorization Problem

References:

Autor článku:

Podobné články