The RSA-896 Mirage: Anatomy of a Factoring Claim That Doesn't Compute
The claim arrived with zero validation metrics. RSA-896 — factored. With AI assistance. A single bound from the previous public record of 829 bits straight to 896, a 67-bit leap that defies every historic precedent in computational number theory. No polynomials published. No sieve parameters. No matrix dimensions. No core-years. No named institution. No independent reproduction. Just a headline, a vague nod to “AI assistance,” and the implicit suggestion that RSA itself is entering its final chapter.
I have spent the better part of a decade reading cryptographic and on-chain claims for a living. Every rug pull has a fingerprint; I just read it. This headline is covered in them — and the fingerprints point to a familiar species of garbage: AI-generated technical misinformation, dressed in the language of breakthrough.
Before anyone adjusts a security policy, reallocates a portfolio, or posts a panicked thread, anchor to what the public ledger actually shows. The standing record for factoring a general semiprime is RSA-250: a 829-bit, 250-decimal-digit modulus, factored in February 2020 by a distributed academic team running CADO-NFS, an implementation of the General Number Field Sieve (GNFS). The preceding record, RSA-240 at 795 bits, fell only two months prior, in December 2019. Observe the cadence. Thirty-four bits of separation between two records produced roughly a decade apart in aggregate effort. Factoring records creep forward like glaciers. They do not sprint.
RSA Laboratories terminated its factoring challenge in 2007. Prizes were withdrawn; the surviving challenge numbers were formally retired. RSA-896 — that specific published modulus from the old challenge list — was never factored during the challenge’s lifetime, and no credible record shows it falling since. A claim that “RSA-896” has been factored therefore smuggles in a second, unstated claim: that someone cracked a specific, well-known, retired challenge number. Alternatively — and far more plausibly — the headline is trading on confusion between bit-length and decimal digits, or describing a self-constructed 896-bit soft number with no cryptographic significance.
Disclosure norms in this field are not optional decorations. The RSA-240 and RSA-250 teams published complete parameter sets: polynomial selection details, sieve regions, matrix sizes, hardware configurations, and total computational expenditure. That is how the cryptographic community validates a result and builds on it. The article under dissection published none of that. Zero mechanics. One conclusion. This is not how a breakthrough behaves. It is how a rumor behaves.
Let me take the claim on its own terms and examine what known mathematics permits. Start with the arithmetic. GNFS remains the state of the art for factoring semiprimes beyond 200 decimal digits. Its heuristic expected complexity is L_n[1/3, 1.923] — sub-exponential, but brutally steep. Plugging 896 bits against 829 bits into that formula yields a workload ratio of roughly seven to eight to one. RSA-250 consumed thousands of core-years of sieving, massive distributed storage for relation collection, and a linear algebra phase that demanded high-memory supercomputing infrastructure. Scaling that by a factor of eight means national-laboratory-level resources or a global distributed campaign running for years. This is a computational industrial project. It is not an “AI ran it overnight” anecdote.
The AI-assistance framing becomes actively deceptive at this point, because the known integration points for machine learning in GNFS are narrow and marginal. Neural networks have been proposed for polynomial selection, finding the pair of polynomials that make the sieve more efficient. They have been used experimentally for parameter tuning and relation filtering. These are heuristic sub-step optimizations. They yield percentage-level improvements in specific phases, not order-of-magnitude reductions across the pipeline. There is no peer-reviewed neural method that factors general 200+ digit semiprimes. Learning-based approaches demonstrate results on smooth numbers and toy scales; RSA moduli are constructed specifically to defeat them. An AI-driven 67-bit jump is not merely unsupported. It is contradicted by current theoretical understanding. This matters because “AI assistance” functions as a credibility transfer — borrowing the genuine aura of AlphaProof or FunSearch while citing no comparable system.
The historical record argues with equal decisiveness. Decomposition milestones have advanced incrementally for three decades because they are bound by real computational economics. RSA-140, 155, 200, 768, 240, 250 — each step is a hard-won fraction of a digit class, not a categorical leap. A 67-bit jump, from an anonymous source, with zero supporting parameters, is statistically indistinguishable from fiction.
The source profile completes the forensic picture. The outlet is a crypto-adjacent news aggregator. The author field reads “unknown.” No preprint server, no institutional announcement, no primary source. In my work tracing wallet clusters and wash-trading patterns, I have learned that anonymity plus urgency plus emotional stakes is the signature of fabrication. In 2022, days before the Terra collapse, my on-chain monitoring flagged a 90% staking yield drop and anomalous Anchor outflows — the warning was real, quantified, verifiable. Nobody needed to take my word; the data spoke. Here, the data is silent. They buried the truth in the gas fees of 2020. Today, the absence of truth is hidden behind an absence of verifiable detail. The pattern is identical; only the medium changed.
Now let me argue the other side, because refusing to engage with the “what if” is its own form of intellectual laziness. Suppose, hypothetically, that an 896-bit semiprime truly was factored, with or without AI assistance. What actually breaks? Almost nothing of operational consequence. Production RSA is dominated by 2048-bit keys — 617 decimal digits — with 3072-bit and 4096-bit increasingly common in high-security PKI contexts. The GNFS complexity gap between 896 bits and 2048 bits is not a difference of degree; it is a difference of cosmic scale, roughly 10^30 times harder in expectation. Factoring an 896-bit number would be a notable academic landmark and a footnote in history. It would not crack a single production TLS certificate or blockchain validator key in use today.
The deeper error — and I suspect a deliberate one — is the conflation of three distinct threat axes. Classical factoring records are a scientific benchmark. Quantum computing is the actual long-term threat to RSA, via Shor’s algorithm. PQC migration is a regulatory infrastructure process driven by harvest-now-decrypt-later risk and institutional inertia, not by any individual factoring event. NIST has already standardized ML-KEM and ML-DSA. The migration timeline runs a decade or longer. A fabricated factoring headline does not accelerate that timeline. It pollutes it. Every false alarm makes it marginally harder for the public to recognize the genuine quantum milestone when it finally lands.
For the blockchain sector specifically — the readership this outlet serves — modern networks run on elliptic curve cryptography: secp256k1 for Bitcoin and most EVM chains, Ed25519 for Solana and a growing cohort of modern protocols. Factoring RSA semiprimes, real or imagined, has zero bearing on the security of these signature schemes. That will not stop the FUD from circulating in crypto channels, where this headline found its natural habitat. But the data is unambiguous: the ledger is indifferent to an unverifiable headline.
Volatility is the noise; liquidity is the signal. In the information domain, amplification is the noise; verification is the signal. The ledger remembers what the analysts forget — every credible security result in three decades has arrived with receipts attached. This one arrived naked.
Track three signals over the next quarter. One: watch IACR and NIST for any statement — confirmation, rebuttal, or silence. Silence from the institutions that validate cryptographic results is itself the verdict. Two: demand the disclosure package from any source that repeats the claim — polynomial pair, sieve parameterization, matrix dimensions, hardware inventory, core-years consumed, and the institutions involved. No disclosure, no result. Three: calibrate expectations to the field’s actual trajectory. The next plausible factoring record, if and when it falls, lands in the 840 to 850-bit range — not in a fantasy skip to 896.
The ledger remembers what the analysts forget. Right now it reads RSA-250, February 2020, 829 bits. Everything else is noise with better marketing. The question is not whether RSA-896 fell. The question is whether you will wait for evidence before you reallocate your fear.