# RSA Bounties We want to encourage research in bounties related to RSA, as some Ethereum-related projects (VDF, DARK using RSA) make use of relatively recent assumptions that we believe are as difficult as the RSA problem and IFP, but of course this is unproven ## Assumptions to be checked - RSA Adaptive root problem: Computing random prime roots of chosen elements in RSA groups with unknown factorization is hard [Necessary for Wesolowski]; implies Low order assumption - RSA Low order problem: Finding an element with low order in an RSA group with unknown factorization is hard [Necessary for Pietrzak] - Strong RSA assumption [RSA Accumulators] ## Suggested bounties It is very unlikely that the assumptions will be outright broken. Also, a lot of research has been done on IFP (Integer Factorization Problem), so even if any really cool ideas came about on say, the adaptive root problem, it might not initially compete with factorization on pure computational terms. So the idea should be to have a ramp of bounties that can be claimed for incremental progress on the problem. - Most interesting paper published (*) on low order assumption ($1,000) - Most interesting paper published (*) on adaptive root assumption ($1,000) - Any algorithm that is solves low order or adaptive through any method that is independent of IFP, and is faster than any known algorithm that is independent of IFP (*) ($3,000) - An algorithm that solves adaptive root faster than IFP ($10,000) - reducing adaptive root to Strong RSA, RSA, Diffie-Hellman, or pseudo-free group ($10,000) - Other unknown reductions from adaptive root or low order to one of the other assumptions ($3,000) (*) To be judged by a cryptographer chosen by the EF Should we post these per-problem, possibly with different prizes, or one for all? ### Concrete instances Current general case factorization record: RSA-768 https://eprint.iacr.org/2010/006.pdf ca. 15,000 years on AMD Opteron 2.2 GHz in 2009; assuming 5 cents per core hour that comes to ca. 6.5M$ computing cost, likely current cores will do it 5-10x faster though so assume the cost is lower The challenge for setting bounties is that any new algorithm might not give such a great advantage over IFP that it can be economically applied to very large RSA modules. We should therefore probably at least have entry-level instances of sizes that can currently be attacked by factoring but it would be uneconomical to do so. Suggestions - 625 Bit: 1 ETH - This is ca. 100x easier than factoring RSA-768, but should still be uneconomical to do factorization just to win 1 ETH (to be confirmed) - 768 Bit: 4 ETH - 1024 Bit: 8 ETH - 2048 Bit: 16 ETH Again, the question is whether we should have one bounty per assumption or split the bounties