Integer Factorization as a Service Fair Market Price

[factorn]

I am curious to know, what would be the fair market price to request folks factor integers for you? Earlier this year someone started a thread where they needed help to factor a 512-bit RSA key to prove a point to their employer to use bigger size RSA keys for some particular application. An observation that was made multiple times by folks who had the know-how and computational power to do this task relatively quickly was that there was no incentive for folks to just factor a random integer someone requested. This got me wondering, at what price point would folks feel incentivized to factor integers at various bitsizes.



Say for the following bit sizes:


350-bits
400-bits
450-bits
500-bits
512-bits
550-bts
600-bits

[xilman]

Originally Posted by factorn

I am curious to know, what would be the fair market price to request folks factor integers for you? Earlier this year someone started a thread where they needed help to factor a 512-bit RSA key to prove a point to their employer to use bigger size RSA keys for some particular application. An observation that was made multiple times by folks who had the know-how and computational power to do this task relatively quickly was that there was no incentive for folks to just factor a random integer someone requested. This got me wondering, at what price point would folks feel incentivized to factor integers at various bitsizes.



Say for the following bit sizes:


350-bits
400-bits
450-bits
500-bits
512-bits
550-bts
600-bits

A 512-bit key takes a few cpu days (depending on cpu) so the power cost and hardware amortization is tiny. The major cost, in my view, is paying me to set everything up, baby-sit as necessary, and return the result.

I haven't done the arithmetic yet but a WAG suggests that I may do them for 50-100 EUR/GBP/USD each.

[VBCurtis]

The purpose of the factorizations plays a larger role than the cash offered. If client refused to state the purpose for the factorizations, I would personally be rather expensive to hire. If the purpose was clearly legal and somewhat interesting, I might charge 3-4x the power cost, in the vicinity of $10/machine-day.

500 bits is just over a machine-day for me (16-core machine), around 10kwh of power.
512 bits is about two machine-days, 18-20 kwh.
550 bits is just over four times harder than 512, 80-90kwh and 8-10 days.
600 is around 8 times harder than 550, ~700 kwh and 10 weeks.

Anything under 500 can be done by anyone smart enough to install linux, copy/paste a git download command from CADO website, and run "make". Hardware requirements are small, like 8 or 12GB memory is the most stringent. A client not smart enough to do those things makes me question why they want factors at all.

[LaurV]

That would be the costs in electricity and computer parts deprecation, considering the juice prices in my area, dollar-to-baht exchange rate, the hardware I have, and the state-of-the-fart* factoring tools I use.

350 bits - 105.4 digits -    0.10 USD - less than 15 minutes
400 bits - 120.5 digits -    0.63 USD - less than 1 hour
450 bits - 135.5 digits -    4.13 USD - less than 8 hours
500 bits - 150.6 digits -   31.75 USD - less than 3 days
512 bits - 154.2 digits -   57.14 USD - less than a week
550 bits - 165.6 digits -  269.84 USD - less than a month
600 bits - 180.7 digits - 2174.20 USD - less than 6 months

(the last one may be optimistic, 600 bits means like 180+ digits, my largest factorization which I attempted alone was 173 (?!) digits GNFS and 180 digits SNFS).

This doesn't include my work, which could cost everything from zero to hero, according to the goal of the factorization. Mostly, I factored for free here around, as the most people on this forum did, when the goal was clear and not smelly. Say, add one or few hundred bucks if it smells, depending on the odor

-----------
*state-of-the-fart means with my favorite tools, which are not necessarily the newest state-state-of-the-art like CADO (which, by the way, I never used, and I don't know how to use), but the things I know, like Yafu, which is "set and forget", so my work involvement is minimal, or resumes to babysitting, like Paul said. However, larger factorization may need more work, tweaking msieve, use GPU for getting a better poly, whatever fancy things, and may cost higher.

[Denial140]

Originally Posted by VBCurtis

The purpose of the factorizations plays a larger role than the cash offered. If client refused to state the purpose for the factorizations, I would personally be rather expensive to hire.

To throw another opinion into the hat, if I decided to offer this there would likely be a rather steep increase in price around 512 bit cofactors...

[retina]

How much for RSA-1024?

And for RSA-2048?

[VBCurtis]

Originally Posted by retina

How much for RSA-1024?

And for RSA-2048?

Let's do some really rough estimating for RSA-1024, 'cause it's fun:

RSA-250 was factored in under 3000 CPU-years. Converting to my previous reply's units, that's around 100 machine years (using a 4+ghz Ryzen rather than 2.1 ghz Xeon used by the team that factored RSA-240 and RSA-250).

Each ten digits is roughly 4x more computation, so RSA-260 might take 400 machine-years, RSA-270 1600 machine-years, RSA-280 6400 m-yr, RSA-290 26000 m-yr, RSA-300 100k machine years, RSA-1024 350k machine years.

All of those cycles require 192GB ram per sieve process, so let's triple the hourly cost to account for the workstation-grade hardware that takes. About 20% of those cycles (filtering and matrix solving) require big-big memory, let's again double the hourly cost for those cycles.

My personal machine-year costs $3000 or so. Let's say $10k per machine-year for the sieving, at 300k years: That's around $3B. Another 50k years of post-processing at $20k per machine-year is $1B.

So, let's say $4 billion or so at the high end.

However, my machine-year costs were only about 1/3 electricity. If we're talking millions or billions, my time is now a salary rather than an hourly rate and relatively negligible cost, and hardware rent is close to zero (AWS rental rates are close to my personal cost of power, including the power use). So, we can cut the cost estimate by 2/3rds, to $1.3B- if we can rent machines with sufficient RAM.

A more optimistic estimate for difficulty scaling is 3x per ten digits, let's say 10x per 20 digits:
Now RSA-270 is 1000 machine-years, RSA-290 is 10000, and RSA-308 is a bit under 100k machine-years. That puts the optimistic estimate around $400M, a sum feasible for a government to spend in the unlikely case a useful foreign gvmt secret was "protected" by RSA-1024.

tl;dr: $400M to $4B.

[Xyzzy]

Just have them pay ½ up front!

[PhilF]

Originally Posted by VBCurtis

So, we can cut the cost estimate by 2/3rds, to $1.3B

Where's Ben when we need him?

[Uncwilly]

Originally Posted by PhilF

Where's Ben when we need him?

Busy working in 168M.

[retina]

Originally Posted by VBCurtis

Let's do some really rough estimating for RSA-1024, 'cause it's fun:

<snip>

tl;dr: $400M to $4B.

Very cheap.

So RSA-2048 will obviously be $8e8 to $8e9, right, twice the cost. Let's do it.

Something something exponential something. Please don't spoil my dream.