TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Did Schnorr destroy RSA? Show me the factors

287 pointsby sweisabout 4 years ago

23 comments

tyingqabout 4 years ago
Isn&#x27;t it typical to release the paper first, for peer vetting, ahead of any actual working proof?<p>It seems like the only reason for the <i>&quot;put up or shut up&quot;</i> reactions is that <i>&quot;destroys RSA&quot;</i> comment in the submitted abstract...which isn&#x27;t in the actual paper.
评论 #26334729 未加载
评论 #26336067 未加载
评论 #26334974 未加载
评论 #26335603 未加载
评论 #26334722 未加载
评论 #26335846 未加载
评论 #26334831 未加载
评论 #26334750 未加载
评论 #26336133 未加载
评论 #26334726 未加载
评论 #26346138 未加载
评论 #26338885 未加载
paobabout 4 years ago
Here we have Léo Ducas testing Schnorr&#x27;s new method in Sage: <a href="https:&#x2F;&#x2F;github.com&#x2F;lducas&#x2F;SchnorrGate" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;lducas&#x2F;SchnorrGate</a><p>Apparently, &quot;[t]his suggest that the approach may be sensible, but that not all short vectors give rise to factoring relations, and that obtaining a sufficient success rate requires much larger lattice dimension than claimed in [Sch21].&quot;
评论 #26345485 未加载
NoKnowledgeabout 4 years ago
This take is rather naive. Those RSA factoring records were done by a large international team of researchers, using well established algorithms and decades of work on implementing those methods as fast as possible.<p>The blog post says the paper mentions 8.4e10 operations for factoring, but I can&#x27;t find that number in the paper anywhere. The post then states: &quot;The 800-bit claims would be 36 bits of work.&quot; I don&#x27;t know what that means.<p>[edit]: the numbers are in the new version (<a href="https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2021&#x2F;232" rel="nofollow">https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2021&#x2F;232</a>). I was looking at the old version uploaded yesterday.
评论 #26335532 未加载
评论 #26334968 未加载
评论 #26335058 未加载
评论 #26335456 未加载
chrisco255about 4 years ago
For those of us less familiar with cryptography and RSA in general: what are the implications if RSA is broken? What are the mitigations that would need to occur in its place?
评论 #26334991 未加载
评论 #26334800 未加载
评论 #26337878 未加载
评论 #26334773 未加载
评论 #26334935 未加载
评论 #26338192 未加载
评论 #26335816 未加载
评论 #26334850 未加载
abetuskabout 4 years ago
OK, here is a brief overview for people:<p>To factor a number N (assumed to essentially be the product of two very large primes), find a &#x27;short&#x27; lattice vector [0] using LLL [1] (and BKZ reduction? [2]) that finds many relations of the form:<p><pre><code> (u_i) = p_i,0 * p_{i,1} * ... * p_{i,n-1} (u_i - v_i * N) = q_{i,0} * q_{i,1} * ... * q_{i,n-1} </code></pre> where p,q are small primes.<p>Numbers that have all their factors less than some prime, B, are said to be &quot;B-smooth&quot;. In the above, both (u_i) and (u_i - v_i * N) are p_{i,n-1}-smooth and q_{i,n-1}-smooth, respectively.<p>Construct many u_i and (u_i - v_i * N), so much so that you can create a product of primes, r_i, of the form:<p><pre><code> r_0^{2 b_0} * r_1^{2 b_1} * ... * r_{n-1}^{2 b_{n-1}} = 1 mod N </code></pre> where each b_i are integers.<p>Since all exponents (2<i>b_i) are even, we have the potential to find the square root of 1 which has the potential to resolve to two different numbers since N is composite. One of those is the product of r_i^{b_i} and the other is -1. Since y^2 = 1 mod N, we get (y-1)</i>(y+1) = 0 mod N. If (y-1) or (y+1) are not 0, then then must share a factor of N and we&#x27;ve successfully factored.<p>The trick is, of course, finding the smooth numbers. To do this, a lattice basis is made such that you find a short integer relation of the form<p><pre><code> a_0 ln(p_0) + a_1 ln(p_1) + ... + a_{n-1} ln(p_{n-1}) ~= ln(N) </code></pre> where ~= means &quot;approximately equal to&quot;.<p>u is chosen as the product of primes of all a_i &gt; 0 and v is chosen to be the product of all primes where a_i &lt; 0. The hope is that (u - v*N) is also p_{n-1}-smooth, which, as far as I understand, most of the math in the paper is trying to justify.<p>The main innovation here, as far as I can tell, is that Schnorr is fiddling with the &#x27;weighting&#x27; of the main diagonal when constructing the lattice basis. I interpret this as basically trying to randomize the initial lattice basis so that the chances of getting a different integer relation (for eventual construction of u,v) is more probable.<p>I&#x27;ve been confused about this for over a decade as variants of this algorithm, and Schnorr&#x27;s work in general, have been well published. For example, there&#x27;s a paper from 2010 on &quot;A Note on Integer Factorization Using Lattices&quot; by Antonio Vera which discusses Schnorr&#x27;s [3] construction.<p>Is Schnorr trying to shout louder so people will listen or is there something else fundamentally flawed with this type of algorithm?<p>Just a word of warning, LLL solves polynomial factorization in polynomial time (given a polynomial with integer coefficients, find it&#x27;s factor polynomials also with integer coefficients) [4] and has been used to break other (now very old) cryptosystems [5]. If there&#x27;s a candidate algorithm to solve integer factoring, lattice reduction (LLL, PSLQ, etc.) are it.<p>I know of fplll that&#x27;s a stand alone (FOSS) implementation of LLL and some extensions (BKZ, etc.) [6].<p>[0] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Lattice_reduction" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Lattice_reduction</a><p>[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Lenstra%E2%80%93Lenstra%E2%80%93Lov%C3%A1sz_lattice_basis_reduction_algorithm" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Lenstra%E2%80%93Lenstra%E2%80%...</a><p>[2] <a href="https:&#x2F;&#x2F;www.newton.ac.uk&#x2F;files&#x2F;seminar&#x2F;20140509093009501-202978.pdf" rel="nofollow">https:&#x2F;&#x2F;www.newton.ac.uk&#x2F;files&#x2F;seminar&#x2F;20140509093009501-202...</a><p>[3] <a href="https:&#x2F;&#x2F;arxiv.org&#x2F;pdf&#x2F;1003.5461.pdf" rel="nofollow">https:&#x2F;&#x2F;arxiv.org&#x2F;pdf&#x2F;1003.5461.pdf</a><p>[4] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Factorization_of_polynomials#Factoring_univariate_polynomials_over_the_integers" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Factorization_of_polynomials#F...</a><p>[5] <a href="https:&#x2F;&#x2F;web.eecs.umich.edu&#x2F;~cpeikert&#x2F;lic13&#x2F;lec05.pdf" rel="nofollow">https:&#x2F;&#x2F;web.eecs.umich.edu&#x2F;~cpeikert&#x2F;lic13&#x2F;lec05.pdf</a><p>[6] <a href="https:&#x2F;&#x2F;github.com&#x2F;fplll&#x2F;fplll" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;fplll&#x2F;fplll</a>
评论 #26336464 未加载
评论 #26336002 未加载
评论 #26338430 未加载
hertzratabout 4 years ago
If someone wasn’t a cryptographer, but does occasional security tasks at work, what is the takeaway? RSA needs to be 4096 or higher now, or that similar techniques in the future might make RSA a bad choice altogether?
评论 #26338420 未加载
评论 #26342134 未加载
tgsovlerkhgselabout 4 years ago
Devil&#x27;s advocate: Posting the factors requires implementation work, then optimization, then a manageable but possibly still not trivial amount of resources and time - and likely a lot of trial and error. It is perfectly conceivable that a paper would be published before the implementation is actually better than a slower but heavily optimized approach. (I don&#x27;t even try to understand the paper, but I&#x27;ve seen a mention that it&#x27;s a storage tradeoff, which may make it a very different kind of optimization problem.)<p>Do we know that the paper is definitely from Schnorr? (Edit: The article claims its provenance is confirmed). The &quot;destroys the RSA cryptosystem&quot; claim is now part of the paper. While anyone can make mistakes, I would expect such claims to be at least somewhat carefully checked before releasing them.<p>Either way, I expect that we&#x27;ll see either a retraction&#x2F;correction or factors within weeks.
hn_throwaway_99about 4 years ago
This was my exact argument: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26323951" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26323951</a><p>Should be trivial to show a working proof on a smaller-than-usual RSA number if &quot;this <i>really</i> destroys RSA&quot;.
gojomoabout 4 years ago
I can imagine a certain pure-theorist mindset being confident enough in their reasoning, but not yet their coding, to report this first. Or, strategically holding definitive proof back as a hammer to deploy once the doubters reveal themselves.<p>Why not let others do the rote reduction-to-practice?<p>Why not create an example where your theory was correct, &amp; your reputation was on the line, that took a little while to resolve – but when it does, it does so definitively in your favor, so you are more trusted in future pre-definitive-verification pronouncements?<p>(I don&#x27;t know enough about Schnorr-the-person to know if this fits his personality, but I can imagine such personalities.)
dangabout 4 years ago
This was heavily discussed yesterday. (Edit: this next bit was out of date:) It seems the provenance of the paper and the &#x27;destroy&#x27; claim are unclear.<p><i>“This destroys the RSA cryptosystem”</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26321962" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26321962</a> - March 2021 (140 comments)
评论 #26335473 未加载
unnouinceputabout 4 years ago
An example, by hand, from the paper author, where he is using this algorithm to factor a number would be great. Even a small number that&#x27;s easy to factor by brute force would be enough to actually proof that his claims are true. We&#x27;ll do code implementation and run it against RSA challenge numbers, and see if this is a prank or the real deal.
yipbubabout 4 years ago
Crypto noob question: Wouldn&#x27;t it be prudent to switch to something like ECDSA(heardsay that it is stronger) if there was even a hint that it was possible?<p>If a major government got wind that such work was going on, wouldn&#x27;t it be prudent to publish before you are disappeared? I assume high-profile crypto research people are spied on.
racecar789about 4 years ago
I know a lot of programming languages, but I have never wrapped my head around math notation.<p>Question for someone who is familiar math notation...was the abstract of this article easy to understand?<p>For me, the abstract seems like code but no commentary explaining what each bloc does. But I could be mistaken.
评论 #26335068 未加载
评论 #26335081 未加载
评论 #26335490 未加载
评论 #26335664 未加载
评论 #26335037 未加载
natchabout 4 years ago
&gt; the provenance of the paper has been confirmed: it is indeed Schnorr.<p>What I read is that someone contacted Schnorr <i>over email</i> to get this confirmation.<p>I’m not saying the confirmation is wrong. And I’m not saying email cannot convey information.
评论 #26335241 未加载
评论 #26335480 未加载
tandrabout 4 years ago
What does &quot;36 bits of work&quot; mean, sorry?
评论 #26334868 未加载
评论 #26334900 未加载
评论 #26334911 未加载
sodality2about 4 years ago
Factors or gtfo
评论 #26337940 未加载
shashasha2about 4 years ago
Is prime factorisation used in SHA256 ? Would I be able to solo mine from my CPU again ?
评论 #26340843 未加载
评论 #26340719 未加载
jagger27about 4 years ago
That&#x27;s really all there is to it. Pudding, proof, etc.
TacticalCoderabout 4 years ago
I am no cryptographer. I did implement, from the paper, Yao&#x27;s &quot;socialist millionaire&quot; cryptographic protocol but... It was only a few lines of code and a very simple (to understand, not to come up with) paper.<p>Now I just looked at that Schnorr paper and, well, I can tell you that I&#x27;m not going to be the one implementing it : (
senderistaabout 4 years ago
I wonder if Schnorr is going senile like Atiyah.
anoniskoabout 4 years ago
Reminiscent of Craig Wright&#x27;s claim to be Satoshi.<p>It doesn&#x27;t matter what you claim with words if you can&#x27;t back it up with cryptographic evidence.<p>Shut up and prove you&#x27;ve done (or can do) the work.
评论 #26334957 未加载
评论 #26335316 未加载
bhoustonabout 4 years ago
The first thing this will be used for is stealing Bitcoin and other cryptocurrency I predict. So watch out for your wallets.
评论 #26336008 未加载
评论 #26336972 未加载
jMylesabout 4 years ago
I&#x27;m skeptical. The paper is too tough for me to digest without spending days&#x2F;weeks&#x2F;lifetimes focusing on it (and there are many who can do it much faster obviously). But I think that if RSA is materially broken, we&#x27;ll know it from movements in the ground (eg, sudden mysterious forged signatures) by the time a paper is published.<p>I don&#x27;t think that such a secret can be kept for more than a few minutes with immediately proceeding to runtime weaponization.