What is the current state of integer factoring, and how does this determine RSA key sizes?

The largest number factored (as of 2020) is 829 bits (250 decimal digits). BSI recommends RSA moduli of at least 3000 bits (since 2023), providing a large safety margin.

* In 17 years the record grew only from 576 to 829 bits, leaving a 2000+ bit margin below RSA-3072 — factoring difficulty rises super-exponentially. *

Factoring milestones:

Key insight about factoring progress:

• Even with much greater computational resources, improvements in mathematical methods yield only a few more decimal digits — progress is painfully slow
• The mathematical methods matter more than raw computing power
• Each additional bit roughly doubles the difficulty

BSI Recommendation (since 2023):

• Minimum RSA modulus: 3000 bits (practically 3072 bits)
• That's ~924 decimal digits — about $10^{1000}$
• Safety margin: $3072 - 829 = 2243$ bits beyond what's been factored

For comparison: The number factored in 2020 is a wall of digits. RSA-3072 uses a number that is more than 3x longer — and because factoring difficulty grows super-exponentially, 3072 bits is astronomically harder than 829 bits.

Tip: Factoring ⇒ breaking RSA is proven. Breaking RSA ⇒ factoring is believed but NOT proven — there might theoretically be a way to compute e-th roots mod N without factoring.

Go deeper:

• RSA numbers — including RSA-250 (Wikipedia) — the 2020 record factorisation in detail.
• Integer factorization records (Wikipedia) — the slow march of the record over the decades.
• BSI TR-02102-1 — Cryptographic Mechanisms (PDF) — the recommendation that sets 3000 bits as the floor.