Abstract. This paper reports on the factorization of the 768-bit number RSA-768 by the number field sieve factoring method and discusses some implications for RSA.

The difficulty of computing discrete logarithms in fields F q k depends on the relative sizes of k and q. Until recently all the cases had a sub-exponential complexity of type L(1/3), similar to the factorization problem. In 2013, Joux designed a new algorithm with a complexity of L(1/4 + ǫ) in small characteristic. In the same spirit, we propose in this article another heuristic algorithm that provides a quasi-polynomial complexity when q is of size at most comparable with k. By quasi-polynomial, we mean a runtime of n O(log n) where n is the bit-size of the input. For larger values of q that stay below the limit L q k (1/3), our algorithm loses its quasi-polynomial nature, but still surpasses the Function Field Sieve.