Quick Orientation

If a real attack on internet encryption arrived, where would it come from? We mapped the reviewed 2024-2026 corpus.

Open brief

Online banking, encrypted messaging, and secure boot all rely on the fact that very large numbers are hard to factor. We surveyed 504 papers from 2024 to 2026 across the reviewed cryptography corpus. Under the ledger criteria, reviewed attacks either work only on toy-sized numbers or pay a cost (slow hardware, untested assumptions, narrow target shape) that disqualifies them from breaking real encryption. Three specific predictions made before the survey — that no paper would cross three particular structural lines — held across all 504.

Why it matters: If one of these attacks actually broke through, RSA-encrypted banking and messaging would need to be re-engineered worldwide.What we found: 504 papers checked, three predicted-empty lines hold. No published 2024-2026 paper breaks the threat model. The ledger is locked.

Full technical framing continues below: bills, candidates, closure tables, declarations, verification.

CHRONOS Agent DREAMING CRC Score Discoveries Ledger Training Signal
← Ledger / Factorization Atlas — May 8, 2026

504 papers. Thirteen bills.
No public handle.

504-paper ledger for the 150-digit laptop factoring threat model. Thirty-one deep-loop sweeps, 22 batch rounds, and 165+ targeted searches found zero frontier-gate clean crossings.

504
Unique papers
31
Deep loops
54/54
Classifier benchmark
0
Gate crossings
Locked Declaration
One real construction.
Thirteen bills.
No public handle.
§01

The thirteen-bill closure pattern

Bills are the closure mechanisms a factoring claim must clear. Every paper maps to one or more bills, a disqualifying meta-cost, an escape gate, or irrelevance to the threat model.

The 13 bills, six meta-costs, and three escape gates define the current closure framework for the surveyed corpus. Bills 6, 7, and 8 remain empty in that corpus under the stated criteria, which supports the originality claim without making it absolute.

Bill activity heatmap

Number of triggers across 504 papers (some trigger multiple bills; total = 196 across 168 known-bill papers).

How to read this heatmap Cells show candidate papers. A starred bill is ★ empty only when candidate count is nonzero but clean triggers remain zero after meta-cost, rebuttal, leakage, non-transfer, or escape-gate review. The closure basis appears below.
136
29
317
466
510
60
70
81
96
1011
1110
1222
138
Hot ($\geq$50)
Warm (20–49)
Cool (10–19)
Cold (1–9)
Empty (0–1)
B1smoothness sieving (NFS family)36
B2divisor shadow (Pollard rho / $p\pm 1$)9
B3supply $\times$ yield (Lenstra ECM)17
B4reducible-leading-form (Coppersmith)66
B5curve projection (genus-2, hyperelliptic)10
B6R0.5 exact-point $F(m_1, m_2) = kN$, $k\neq 0$0
B7cross-Frobenius order0
B8cross-Frobenius linear complexity1
B9spectral idempotent6
B10noncommutative shadow (quaternion)11
B11genus-character access (class group)10
B12volcano-orientation access (isogeny)22
B13batch-shadow order (batch GCD)8
The empty space — Bills 6, 7, 8
Across 504 papers spanning every major venue, both major preprint servers, all senior-researcher pipelines, all government and industry sources, and rigorous falsifier-pattern probes against 20 exotic-math categories (category theory, model theory, ergodic theory, Floer/TQFT, K-theory, noncommutative geometry beyond Connes-style, supersymmetric quantum mechanics, Yang–Mills, Langlands, motives/sheaves, mock modular forms, quantum walks, …), Bills 6 and 7 received zero triggers and Bill 8 received exactly one. This is the central empirical contribution: the framework's signature constructions sit in genuinely empty space. The strongest falsifier candidate (Bilokon SSRN domain-theoretic imbalance) collapses on inspection to Fermat's method dressed in topology — Bill 2 + conditional polynomial + branch entropy — and does not falsify the empty-space result.
§02

Q-Day resource collapse

The estimated physical-qubit count required to factor RSA-2048 has dropped three orders of magnitude in seven years — yet the NIST 2030 / 2035 deprecation timeline remains unchanged and no government has signaled classified factoring progress.

2019
Gidney–Ekerå (arXiv:1905.09749)
20M physical qubits, 8 hours, surface code.
Feb 2024
Chevignard–Fouque–Schrottenloher (eprint:2024/222)
1,730 logical, $\sim$1M physical, $2^{36}$ Toffoli, ~40 runs. Approximate residue arithmetic.
May 2024
Yoked Surface Codes (Gidney–Newman–Brooks–Jones, Nat Commun 16:4498)
~1/3 physical-qubit overhead per logical qubit.
May 2025
Gidney (arXiv:2505.15917)
$<$1M noisy qubits, <1 week. Yoked surface codes + magic state cultivation. >100× Toffoli reduction.
Oct 2025
Parallel Spooky Pebbling (eprint:2025/1887)
Multiplication depth 193 vs Regev 680, vs Ekerå–Gärtner Shor 444.
Feb 2026
Pinnacle (Iceberg Quantum, arXiv:2602.11457)
$<$100K physical qubits via qLDPC codes. Order-of-magnitude collapse below Gidney 2025.
Mar 2026
Cain–Xu–Preskill (arXiv:2603.28627)
10K reconfigurable atomic qubits sufficient for cryptographically-relevant Shor.
Mar 2026
Babbush–Boneh ECDLP (arXiv:2603.28846)
256-bit ECDLP with $<$1,450 logical qubits, $<90$M Toffoli, 9 minutes. ZK-published — Google engaged USG pre-publication.
May 2026
Xue–Covey (arXiv:2605.03951)
500K-qubit modular atomic processor: RSA-2048 in only +16% time vs single-module.
What's unchangedNIST IR 8547 deprecate-2030 / disallow-2035 RSA timeline. Gidney himself endorses IR 8547 timeline. CISA's January 2026 PQC product-category guidance sharpened procurement pressure, but the public timeline remains anchored to the NIST 2030/2035 transition frame.
Shor-track commitmentsIonQ 2028 "cryptographically relevant" 1,600 logical qubits. Quantinuum Apollo 2030, IBM Starling 2029, PsiQuantum million-qubit late 2020s, QuEra 100 logical 2026, Atom/Microsoft Magne 50 logical 2027 — all hedge with "universal FTQC" framing.
Aaronson postureMonotonic escalation Apr 2024 → Apr 2026: "decades off" → "worry now, have a plan" → "even stronger impetus to upgrade now."
§03

Thirteen negative findings

Each finding is converted into a checkable falsifier (§04). The strongest findings concern unbroken bounds and historic-first negatives.

  1. $L_N(1/3) = 1.923$ NFS heuristic constant unbroken since 1993. No paper in the corpus improves the unconditional NFS constant.
  2. Boneh–Durfee $N^{0.292}$ small-$d$ bound 25 years unimproved. All 2024–2026 work parameterizes additional structure; the unconditional bound stands.
  3. Deterministic factoring exponent $N^{1/5}$ unbroken unconditionally. The rank-3 lattice / second-LLL-vector result improves the log-factor only.
  4. RSA-250 829-bit balanced ceiling 6+ years unbroken (Feb 2020 → May 2026). RSA-260, RSA-270, RSA-1024, RSA-2048 remain unfactored.
  5. ECM record stands at 83 digits — tied October 2024 by yoyo@home/Moor with $2^{2246}+1$. Record height unchanged since 2013.
  6. Bills 6, 7, 8 are empty across 504 papers — central empirical contribution.
  7. No LLM has factored a balanced semiprime above ~40 digits without external tools. Adi Shamir at RSAC 2026: "There's not been any cryptographic success made by AI."
  8. No novel-attack patents 2024–2026. Exhaustive USPTO/WIPO/EPO/JPO/KIPO/CIPA sweep returns zero. State actors do not patent; the absence is the signal.
  9. ASIACRYPT 2024 + 2025 published zero RSA cryptanalysis papers. Across 270 papers in 17 LNCS volumes — historic first, to our knowledge.
  10. Math. Comp. clean of factoring 2024–2026. Hittmeir migrated to Ramanujan Journal. Last factoring algorithm paper: Harvey–Hittmeir, June 2021.
  11. 30+ senior cryptographers silent on RSA factoring. Including Rivest (R in RSA — only election security), Coppersmith (Bill 4 namesake — IDA/CCR classified pattern), Shamir (S in RSA — pivoted to neural-network cryptanalysis).
  12. Government posture is reactive, not leading. CISA's January 2026 PQC product-category guidance sharpened procurement pressure, while the public transition timeline still tracks the NIST 2030/2035 frame. Aaronson's classified-resource-estimates prediction has not materialized.
  13. 17 of 20 exotic-math categories produced zero factoring claims. Category theory, HoTT, model theory, ergodic, Floer/TQFT, K-theory, noncommutative geometry, SUSY QM, Yang–Mills, Langlands, motives/sheaves, mock modular forms, quantum walks, tropical geometry, derived categories, non-archimedean dynamics, Riemannian geometry — all empty.
§04

Falsification protocol

Each negative finding is converted into a checkable trigger condition. The five highest-probability falsifiers (Live Alerts) are F2, F4, F5, F9, F11 — all in the "medium" probability band.

F2 — LIVE ALERT
Boneh–Durfee improved
Any paper improving the unconditional small-$d$ bound below $N^{0.292}$.
Probability: medium · Active front: Heninger, Feng–Pan, Hales-DRC clusters
F4 — LIVE ALERT
RSA-260+ announcement
Any RSA-260, RSA-270, RSA-1024, or RSA-2048 factorization announcement.
Probability: medium · BLASter LLL >100×, Cunningham SNFS-336 momentum is real
F5 — LIVE ALERT
ECM 84-digit find
Any 84+ digit ECM factor on the Zimmermann top-50.
Probability: medium · 83-digit tied Oct 2024; 84 within distributed-compute reach
F6 — CENTRAL CLAIM
Bills 6, 7, 8 triggered
Any paper exhibiting an $F(m_1, m_2) = kN$, $k \neq 0$ mechanism, or cross-Frobenius order/linear-complexity invocation.
Probability: low · 504-paper corpus empty — invalidates originality claim if triggered
F9 — LIVE ALERT
ASIACRYPT 2026 RSA paper
ASIACRYPT 2026 accepting any RSA cryptanalysis paper would break the historic 2-year zero streak.
Probability: medium · Single-conference silence streaks do break; 2026 is the natural test
F11 — LIVE ALERT
Senior re-engagement
Rivest, Coppersmith, Shamir, or any silent-list senior publishing original factoring algorithm work.
Probability: medium · Highest-signal single event; Coppersmith breaking IDA/CCR silence would be framework-revising

We commit to public update of the atlas within 7 days of any verified Bill 6 / 7 / 8 trigger. Submission of a paper triggering these bills is invited as a falsification challenge.

§05

Watch-list — 33 cousin precedents

Each entry has a calibrated probability, an impact, and a re-poll cadence. The seven Tier 1 entries are monitored monthly.

Tier 1 monthly

BillClosure basisCands.Clean
★ 6R0.5 exact-point
Closure basis: no candidate matched the R0.5 exact-point trigger across the 504-paper corpus
candidates0clean triggers0
★ 7cross-Frobenius order
Closure basis: no candidate matched the cross-Frobenius order trigger across the 504-paper corpus
candidates0clean triggers0
★ 8cross-Frobenius LC
Closure basis: single candidate closed under meta-cost review (M3 asymptotic + M5 resource-unbounded)
candidates1clean triggers0
arXiv:2511.10851
Umans–Wang combinatorial divisibility
Combinatorial divisibility conjecture implies $N^{1/5} \to N^{1/6}$ deterministic factoring (NOT GRH-conditional).
Trigger: proof of conjecture · Impact: deterministic frontier redraw
eprint:2025/1514
de Boer–Pellet-Mary–Wesolowski rigorous CG
Rigorous probabilistic subexponential class group / unit group computation for arbitrary number fields, ERH-conditional.
Trigger: removal of ERH or Bill-11 application · Impact: bills 11, 12
arXiv:2602.11457
Pinnacle architecture
RSA-2048 in <100K physical qubits via qLDPC codes (Iceberg Quantum, Feb 2026).
Trigger: hardware demo or follow-up reduction · Impact: Q-Day collapse
arXiv:2603.28627
Cain 10K atomic qubits
Reconfigurable neutral-atom architecture sufficient for cryptographically-relevant Shor with as few as 10,000 qubits.
Trigger: 5K → 10K → 26K demo cascade · Impact: Q-Day, hardware-conditional
eprint:2025/774
BLASter LLL implementation
Ducas–Pulles–Stevens: >100× faster than fplll, >10× over flatter/OptLLL in dimensions 256–1024.
Trigger: integration into NFS sieve / cofactorization · Impact: bills 1, 4
eprint:2025/1004
Rank-3 lattice factoring
Gao–Feng–Hu–Pan: deterministic balanced-semiprime to $O(N^{1/5} \log^{13/5} N / (\log\log N)^{3/5})$ via second LLL vector.
Trigger: exponent improvement to N^(1/6) or below · Impact: deterministic frontier
eprint:2026/423
MIDHNP determinant collapse
Disproves a 25-year-old Boneh–Asiacrypt'01 conjecture (MIDHNP harder than MIHNP). Novel determinant-based shift-polynomial strategy.
Trigger: extended applications to RSA · Impact: Coppersmith methodology

Tier 2 quarterly

14 entries: Pascadi smoothness $x^{66/107}$, Mulder squareful sub-L[1/2], Tao–Sutherland–Conway factorial decomposition, Universal Shor circuit (eprint:2025/869), Priestley–Wallden QAOA-CVP 5th-order quantum advantage, Joux indefinite-form LLL, Biasse–Song quantum S-units, Babbush–Boneh ECDLP, Yoked Surface Codes, Engelberts 3-tuple lattice sieving, Vandaele Shor depth $O(n^3) \to O(n^2 \log^2 n)$, Maurya–Tannu QEC sync 2.4–3.4× LER reduction, SWIPER speculative window decoding, qt-Pegasis class-group action, Chen Drinfeld volcano (function-field bill 12 analog).

Tier 3 triggered

12 entries: Heninger–Lau–Shea exponent transforms, Pelofske batch GCD, Magic State Cultivation (Gidney–Shutty–Jones), Ekerå–Gärtner Regev-DLP, Chevignard–Fouque–Schrottenloher, Jacobi factoring circuit, Bäumer SSH-Client-Signatures Zenodo, SandboxAQ 20M-key 2025 sweep, Cunningham SNFS-336 batch 2026, p83 ECM tie 2024 (yoyo@home/Moor), RSA-150 Buhrow benchmark, ANTS-XVII Groningen accepted-papers list (publishing mid-May 2026 — calendar-driven highest probability).

§06

Author activity tiers

38 senior cryptographers tracked 2024–2026. The original RSA architects have collectively withdrawn from factoring discourse. The single Tier-A active group is Heninger UCSD; the Caramba team won the 2025 Levchin Prize for CADO-NFS but pivoted away from RSA records.

Tier A — active on RSA factoring
Heninger UCSD lab · Caramba team (Gaudry, Thomé, Pierrot, Zimmermann, Barbulescu, Fleury, Kirchner) · Feng–Nitaj–Pan–Zheng cluster (RSA variants only).
Heninger group is the only senior PI with continuous factoring-direct first-author pipeline. Caramba team's 2025 Levchin Prize pivot to TNFS-DLP / isogeny / pairing-curve TNFS-resistance / e-voting suggests the prize is the cap on RSA records.
Tier B — pivoted away
Shamir (S in RSA) → neural-network cryptanalysis + symmetric Feistel · Gaudry → isogeny crypto · Stehlé → CKKS/FHE/threshold · Joux → DLP only · Phong Nguyen → NTRU lattice · Wesolowski → isogeny + class-group rigorous · Vaikuntanathan → quantum factoring (Jacobi circuit, but P²Q not balanced).
Adi Shamir at RSAC 2026 Cryptographers' Panel: "There's not been any cryptographic success made by AI." TWIRL/TWINKLE hardware factoring dormant since ~2003.
Tier C — curatorial mode
Hendrik W. Lenstra Jr. (one expository chapter "Algebra in the real world" 2025) · Arjen K. Lenstra (Encyclopedia "Integer Factoring" 2025 + Delphi crowd-sourcing assumption assessment) · Pomerance (6+ analytic-NT papers, all factoring-tangential).
Consolidation, not novelty. The Lenstra brothers' canonical 2025 reference status validates the framework's "field is mature" reading.
Tier D — silent (classified or topic-shift)
Don Coppersmith (Bill 4 namesake — IDA/CCR classified pattern, zero 2024–2026 publications) · Pollard · Bach · Snow · Williams · Rivest (R in RSA — only election security 2024–2026, RSAC panels absent).
Rivest's silence is structural: the RSA namesake co-inventor has not commented at RSAC Cryptographers' Panel 2024 / 2025 / 2026, has issued no 50-year RSA retrospective (the 1977 paper turns 50 in Aug 2027), and has no factoring publications. This is the strongest single piece of evidence that the field has structurally exited the active-RSA-research phase.
Tier E — topic shift
25+ senior cryptographers in lattice / FHE / SNARK / MPC / ZK / PQC.
Lyubashevsky, Micciancio (beyond Voronoi), Y. Chen (post-retraction), Steinfeld, Garg, Khurana, Rosen, Kalai, Boyle, Couteau, Hess, Yongge Wang, Kilian, Bellare, Krawczyk, Vergnaud, Fouque, Shparlinski, Enge, Wagstaff, Bernstein, Lange, Preneel, Cramer, Biham, Galbraith.
§07

Method at a glance

Threat modelFactor balanced 150-decimal-digit (~498-bit) semiprime $N = pq$ on a typical laptop in <10 minutes (Epoch FrontierMath challenge).
Deep loops31 sweeps × 5–10 parallel research agents per sweep × 22 batch rounds.
Sources surveyedAll major crypto venues (CRYPTO, EUROCRYPT, ASIACRYPT, USENIX, FOCS, STOC, SODA, ITCS, CCC, TCC, PKC, CT-RSA, ANTS, CHES/TCHES, …) + IACR ePrint 2024–2026 full ID range + arXiv (cs.CR, math.NT, quant-ph, math.AG, math.AT, math.LO, math.PR, math.GR, math.RA, math.SP, cs.CC, cs.DM, cs.DS, math.OC, cs.AI, cs.LG) months 2305–2605 + journals (J. Cryptology, Math. Comp., Compositio, Forum Math Pi, Inventiones, Annals, JEMS, SICOMP, …) + government (NIST IR 8547, NSA CNSA 2.0, BSI, CISA, DOD, BIS) + industry research labs (Google Quantum AI, IBM Research, Microsoft Research, AWS, NVIDIA, Cloudflare, SandboxAQ, IonQ, Quantinuum, PsiQuantum, …).
ClassifierRegex-based rule engine. v1.16 with 54 hand-curated benchmark cases at gate-accuracy 1.000 / bill-recall 1.000. Word-boundary discipline through 5 polish iterations (v1.0 → v1.16).
Falsifier search20 exotic-math categories rigorously probed: category theory, HoTT, model theory, ergodic, dynamical systems, complex analysis, Riemannian geometry, non-archimedean dynamics, Floer/TQFT, K-theory, NC geometry, SUSY QM, MPS, Yang–Mills, Langlands, motives/sheaves, mock modular forms, quantum walks, tropical geometry, derived categories. 17 produced zero factoring claims; 3 produced peripheral non-factoring work.
ReproducibilityAll scripts, JSONs, and wiki are public-domain. Run order: bill_classifier.py --benchmarkwiki_populate.pywiki_atlas_review.py.
§08

Resources & further reading

§R

Reproducibility & data

Every empirical claim on this page resolves to public data. Run the classifier, regenerate the heatmap, audit the corpus, file a falsification.

Locked v1.16 (May 2026) — 504 papers; Bills 6/7/8 ★ empty across the corpus.

Locked state · 2026-05-08
One real construction.
Thirteen bills.
No public handle.