RSA-260 Factored: What It Means for Your Encryption Keys

On September 3, 2026, Eric Lu—an engineer at Cognition—posted a 130-digit integer on X with two words: “divides RSA-260.” No paper. No methodology. No press release. Just a number that, when multiplied by its companion prime, equals a 260-digit semiprime that had resisted factorization for 35 years. The Hacker News community responded with 1,627 upvotes and 1,279 comments. Within minutes, Wikipedia’s RSA numbers page was updated. The RSA-260 challenge, published in 1991, is now closed.

A Record Nobody Expected This Week

RSA-260—862 bits, 260 decimal digits—is now the largest RSA Factoring Challenge number ever cracked, surpassing RSA-250 (829-bit), which fell in February 2020. That earlier breakthrough required roughly 2,700 CPU core-years, a team spanning multiple institutions, and produced a full published writeup of every algorithmic stage. Lu’s announcement contains none of that. One number. Full stop.

The contrast is jarring. For RSA-250, researchers from INRIA and partner universities spent years running CADO-NFS across distributed compute—sieving, filtering, matrix solving—and documented it exhaustively. For RSA-260, community estimates suggest the General Number Field Sieve (GNFS) would require approximately 7,000 core-years at this scale. However, Lu has disclosed nothing about algorithm, hardware, or runtime. Whether this was a solo GNFS run, an institutional effort conducted privately, or something entirely novel remains unknown. Consequently, that silence is the second story inside the first.

Related: JDK 27 Ships Sept 15: Post-Quantum TLS and What to Do

The Security Math: RSA-260 Factored Doesn’t Mean RSA Is Dead

RSA-260’s 862-bit length provides approximately 74 bits of security. Modern RSA-2048 provides 107 bits. That 33-bit difference translates to roughly 10 billion times more computational work to factor—a gap that no foreseeable advance in classical computing closes anytime soon. Emmanuele Thomé, an INRIA researcher who contributed to the RSA-250 factorization, called Lu’s result “certainly feasible, not exactly low-hanging fruit—more of a curiosity than a realistic threat to modern encryption.” He’s right. RSA-2048 is safe.

RSA-1024, however, is not. It sits between RSA-829 (cracked 2020) and RSA-862 (cracked this week), and it is unambiguously broken territory for any well-resourced attacker. Red Hat blocked sub-2048-bit RSA by default in RHEL 9.1. OpenSSH has deprecated RSA-1024 for years. Nevertheless, legacy systems—IoT firmware, old enterprise certificate authorities, VPN concentrators provisioned in the 2010s—still carry 1024-bit keys. Moreover, those devices did not get the memo.

What You Should Audit Right Now

RSA-260 being factored is a useful prompt to run a crypto inventory. The risk isn’t your browser’s TLS connection—it’s the SSH key you generated in 2013, the firmware signing certificate that hasn’t been rotated since the product shipped, or the code-signing key buried in a CI pipeline from a previous job. Furthermore, these are the entries that fail audits and enable breaches.

Two quick checks to start with:

# Check your SSH key strength
ssh-keygen -l -f ~/.ssh/id_rsa

# Check TLS certificate key size on a domain
openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -text | grep "Public-Key"

If either returns anything below 2048 bits, rotate immediately. For new SSH key generation, use Ed25519—it’s faster, smaller, and immune to RSA factoring attacks entirely. Additionally, NIST’s IR 8547 deprecates RSA-2048 for long-term use by 2030 and recommends 3072-bit RSA for keys generated today. Post-quantum migration timelines remain unchanged: CNSA 2.0 compliance for US federal systems acquiring new hardware kicks in by January 2027. Therefore, RSA-260 doesn’t accelerate that deadline, but it’s a concrete reminder of why the deadline exists.

The Methodology Nobody Has Seen

Normal cryptographic milestones come with papers. RSA-250 came with a paper. RSA-768 (cracked 2009) came with a paper. In contrast, Lu’s post contains a 130-digit integer and nothing else—which is either extraordinary confidence or deliberate withholding. Community speculation on Hacker News ranges from a private GNFS implementation on rented cloud compute, to AI-assisted polynomial selection, to specialized integer factorization hardware. The viral story that “Lu sampled random primes by hand for seven months” started as a coworker’s joke. In fact, it’s mathematically impossible: finding the correct 130-digit prime by random sampling carries a probability of roughly 1 in 10^127—worse odds than the heat death of the universe.

When, or whether, Lu publishes methodology matters. If he used a novel algorithm or an unexpectedly efficient GNFS implementation, it shifts the timeline for when larger RSA numbers become practical targets. If it’s a straightforward GNFS run on undisclosed hardware, the story is mostly about resources. Either way, the record stands—and the RSA Factoring Challenge frontier just moved forward by 33 bits.

Key Takeaways

• RSA-260 (862-bit) was factored on September 3, 2026 by Eric Lu, an engineer at Cognition—the largest RSA challenge number ever cracked, surpassing RSA-250 from 2020
• Modern RSA-2048 is not threatened: the security gap between 862-bit and 2048-bit is roughly 10 billion times more computation, an enormous margin under classical algorithms
• RSA-1024 is definitively broken territory—audit your SSH keys, TLS certificates, firmware signing certs, and code-signing pipelines for sub-2048-bit RSA today
• Lu has disclosed no methodology, hardware, or runtime—unprecedented for a cryptographic milestone at this scale, and the mystery is part of the story
• Post-quantum migration timelines remain unchanged: NIST deprecates RSA-2048 by 2030; start your crypto inventory now