{"id":"f222b92e-978c-4aff-a4d9-95873ac78940","arxiv_id":"2507.06706","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":2.0,"correctness_risk":"high","formal_verification":"none","parameter_count":1,"one_line_summary":"A linear regression fit of epsilon = n/2 - alpha reproduces the trivial identity phi(n) = n - (p+q) + 1 with a fitted intercept, and the paper's claims of useful RSA approximation are unsupported.","lead":"This paper trains a linear regression on RSA semiprimes to predict a quantity derived from Euler's totient function, claiming phi(n) can be approximated with small relative error. The high R2 and small relative errors are largely artifacts of phi(n) being close to n, and no attack or proof supports the cryptanalytic claims.","discovery_kind":"incremental","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The regression reduces to a single constant intercept for p+q per bit size, so the per-modulus error in phi is |p+q+1 - 2*alpha_s|; the printed 64-bit alpha makes the claimed lower bound false in direction, and the resulting O(sqrt(n)) absolute error cannot support any demonstrated RSA attack.","rationale":"The reader's weakest-assumption analysis correctly identifies the load-bearing step: replacing the per-modulus value (p+q+1)/2 with a single fitted constant alpha_s per bit size. My stress-test reading confirms this is the central weakness, and it is even sharper than stated in the reader's verdict. The paper's own algebra makes the error exactly |p+q+1 - 2*alpha_s|, so accuracy of the leading digits of epsilon is an artifact of the n/2 term and says nothing about the error in phi. Moreover, the printed alpha_64 is smaller than the minimum possible (p+q+1)/2 for 32-bit primes, so the claimed lower bound is false in direction for all 64-bit moduli; alpha_128 is similarly implausible. This internal inconsistency reinforces rejection without requiring any external assumption about how p and q are generated.\n\nI considered whether any part of the paper survives: the algebraic identity epsilon = phi/2 - 1 is correct, and the linear relation between epsilon and n is trivial. The R2 = 1 and small relative error follow from the dominance of n/2, not from a learned approximation. No machine-checked proof, reproducible code, or independent verification is provided, and the 1024-bit results mentioned in the abstract are absent from the body. The proposed test would settle the matter directly: compute the absolute error distribution on fresh moduli and check the inequality direction. Given the internal contradiction at 64 bits, no additional external validation is needed to see that the central cryptanalytic claim is unsupported; the verdict of rejection is appropriate.","tokens_in":5994,"tokens_out":11576,"duration_ms":128952,"concrete_test":"Generate 10,000 fresh 64-bit RSA moduli with 32-bit primes and, for each, compute phi_pred = n - 2*1637177340 + 2 and phi_true = n - p - q + 1; count how many satisfy the claimed phi_pred < phi_true and record the median absolute error |p+q+1 - 2*alpha_64|. Repeat the same error computation for the printed intercepts at 128, 256, and 512 bits. If the 64-bit inequality fails or the median error scales as Theta(sqrt(n)) rather than approaching zero, the lower-bound and attack-relevance claims are refuted.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The constructive step in Section 3 is epsilon_pred = n/2 - alpha_s with one alpha_s per bit size. Since epsilon = (n - p - q - 1)/2, the implied prediction is phi_pred = n - 2*alpha_s + 2, and the per-modulus error is exactly |phi_pred - phi_true| = |p+q+1 - 2*alpha_s|. Thus the entire cryptanalytic value rests on a single constant alpha_s tracking (p+q+1)/2 for every RSA modulus of that size. Nothing in the paper justifies this: n alone admits many prime pairs whose p+q values differ by O(sqrt(n)), so for a fresh modulus the absolute error will be O(sqrt(n)) unless alpha_s happens to match that modulus's half-sum. For a 1024-bit modulus, sqrt(n) is about 2^512; the paper's 'small relative error' is roughly 2/sqrt(n), which is cryptanalytically meaningless, and no attack is specified that can exploit a lower bound with such a gap.\n\nThe reported intercepts also contradict the asserted lower bound n_s - 2*alpha_s + 2 < phi(n_s). For 64-bit moduli with 32-bit primes, (p+q+1)/2 >= 2^31 + 0.5 > 1,637,177,340 = alpha_64, so phi_pred = n - 2*alpha_64 + 2 > phi_true for every such modulus; the inequality is reversed. For 128-bit moduli, alpha_128 ~= 7.56e22 is several orders of magnitude larger than the expected half-sum of two 64-bit primes, so it is not a plausible fitted center of p+q at all. These internal inconsistencies show the central claim is unsupported by the paper's own numbers.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper claims that a linear regression model trained on RSA moduli, using the public modulus n as the only feature, can approximate Euler's totient function phi(n) with small relative error. The authors introduce a target epsilon = phi/2 - 1, fit a per-bit-size intercept alpha_s with slope fixed at 1/2, and assert the lower bound ns - 2*alpha_s + 2 < phi(ns). They report R^2 scores of 1 and small relative errors for 64-, 128-, 256-, and 512-bit moduli, and suggest that such approximations may aid RSA attacks. The paper includes a short algorithm for building predictors from training data and concludes that statistical learning could supplement cryptanalysis.","tokens_in":6389,"tokens_out":4486,"duration_ms":42906,"significance":"If the central lower-bound claim were correct, the paper would offer a genuinely surprising result: a public modulus alone would reveal a nontrivial lower bound on phi(n) with cryptanalytic value. However, the result does not survive scrutiny. The regression reduces to a single fitted constant per bit size, and the claimed bound is contradicted by the paper's own reported constants. The reported R^2 and relative errors are artifacts of the target's domination by n/2, and the absolute error is on the scale of p+q, which is not shown to aid any factorization attack. The paper's main strength is that it states explicit constants and a falsifiable claim, which makes direct verification straightforward; that transparency is valuable, but it also exposes the central error. No 1024-bit results are presented despite the abstract and data section promising them.","major_comments":[{"comment":"The regression predictor is epsilon_pred = n/2 - alpha_s, while epsilon = (n - p - q - 1)/2. Substituting gives phi_pred = n - 2*alpha_s + 2 and the per-modulus error |phi_pred - phi_true| = |p+q+1 - 2*alpha_s|. Since alpha_s is a single constant per bit size and p+q varies across moduli of the same size, the approximation error for a fresh modulus is exactly the deviation of that modulus's half-sum from alpha_s. The paper provides no proof or worst-case analysis that alpha_s tracks (p+q+1)/2; in fact, n alone admits many prime pairs whose p+q values differ by roughly sqrt(n). This is load-bearing because the claimed lower bound and any cryptanalytic application depend entirely on this unstated constancy assumption.","section":"Section 3"},{"comment":"The asserted inequality ns - 2*alpha_s + 2 < phi(ns) is contradicted by the paper's own constants for 64-bit moduli. For 64-bit RSA moduli generated from 32-bit primes, each prime is at least 2^31, so (p+q+1)/2 >= 2^31 + 0.5 > 1,637,177,340 = alpha_64. Hence phi_pred = n - 2*alpha_64 + 2 > phi_true for every such modulus, reversing the claimed direction. For 128-bit moduli, alpha_128 ~ 7.56e22 is several orders of magnitude larger than the expected half-sum of two 64-bit primes, so this fitted intercept is not a plausible center for p+q. These internal inconsistencies show that the central claim is unsupported by the manuscript's own reported numbers.","section":"Section 3, displayed lower bound"},{"comment":"The reported R^2 = 1 and small relative errors in epsilon do not support the conclusion that phi is approximated usefully. Since epsilon is approximately n/2, a regression of n/2 - alpha_s against n will always achieve near-perfect R^2 regardless of the quality of alpha_s. The meaningful error is the absolute error in phi, which is |p+q+1 - 2*alpha_s| and is on the scale of the prime sum, i.e., roughly sqrt(n). For cryptographically relevant sizes, this is orders of magnitude too large to aid any known attack, and no attack is specified that could exploit such an approximation. The conclusion that approximation-based techniques 'could serve as a supplementary tool in cryptanalysis' is therefore unsupported.","section":"Section 4, Performance Evaluation"},{"comment":"The abstract and Section 2 state that the dataset includes 1024-bit RSA moduli, but the performance evaluation in Section 4 reports results only for 64-, 128-, 256-, and 512-bit moduli, and the figures likewise stop at 512 bits. No 1024-bit results are presented anywhere. Additionally, the procedure in Section 6.1 trains on factor pairs with known epsilon values and then applies the fitted constant to new moduli; because epsilon and phi are derived from the same factorization, this is a fitted-constant prediction rather than an independent relationship between n and phi. The paper does not show how the predictor would generalize to a modulus whose factors are not in the training distribution.","section":"Section 2 and Section 4"}],"minor_comments":[{"comment":"The abstract contains a grammatically incomplete sentence: 'Although deriving phi(n) deterministically remains computationally infeasible for cryptographically relevant bit lengths, and machine learning presents a promising alternative...' The main clause is missing.","section":"Abstract"},{"comment":"The constants alpha_s are typeset inconsistently; for 256-bit and 512-bit sizes the digits are broken across lines in a way that makes the values hard to verify. The figure captions also contain typos such as '512-buts' instead of '512-bit'.","section":"Section 3 / Section 5"},{"comment":"The text refers to 'Figure 6' for the error distribution but the figure is labeled Figure 3. Several references to figures are ambiguous because multiple figures share the same number.","section":"Section 6"},{"comment":"The data generation description reports '1 million prime pairs for each of five bit sizes (32 to 512 bits)' but the manuscript does not specify the full bit-length list, the exact ranges of p and q, or how the pairs were sampled; these details are needed to reproduce the experiments.","section":"Section 2"}],"recommendation":"reject","confidential_remarks":"The paper's central claim is not merely unproven; it is contradicted by the paper's own reported constants for the 64-bit case, and the scale of the implied error makes the cryptanalytic relevance claim untenable. I see no set of local revisions that would bring the manuscript to an acceptable standard; the work would need a fundamentally different approach and, ideally, a concrete attack demonstration. Recommend rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The punchline: this paper mistakes a tautology for a cryptanalytic result. The linear model is just eps = n/2 - alpha_s, which is the elementary identity eps = (n - p - q - 1)/2 with alpha_s standing in for (p+q+1)/2. So the 'prediction' of phi is n - 2 alpha_s + 2, and its error on a fresh modulus is |p+q+1 - 2 alpha_s|. Nothing in the paper suggests a single constant can track the half-sum of the primes for an entire bit size; the reported R2 near 1 and tiny relative error are just consequences of phi being close to n. The claimed lower bound is false in direction for the 64-bit intercept, and the 128-bit intercept is orders of magnitude larger than any plausible half-sum of two 64-bit primes. There is no 1024-bit experiment, no code or data, and no attack that uses the approximation.\n\nWhat credit is due: the paper correctly identifies that eps and n are linearly related with slope 1/2, and it generates a large dataset of RSA moduli. The plots appear to show the expected line. That is the entire content.\n\nThe soft spots are not minor. The central claim is unsupported; the lower bound is asserted without proof; the numbers contradict each other; and the 'prediction' is a fitted constant, so it has no independent predictive content. The abstract's mention of 1024 bits is also not backed by any reported result.\n\nWho this is for: nobody working in RSA cryptanalysis will learn anything here, except maybe as a cautionary example of why R2 and relative error are the wrong metrics for this problem. A serious referee should not spend time on it; this is a desk reject.","headline":"A tautology dressed as cryptanalysis: the regression merely restates phi(n) = n - p - q + 1 with a fitted constant for p+q, and the claimed lower bound is contradicted by the paper's own numbers.","tokens_in":6968,"tokens_out":2328,"would_cite":false,"duration_ms":23773,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A60","68T05"],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a single linear fit on the public modulus n approximates Euler's totient phi(n) closely enough to aid certain RSA attacks.","keywords":["Euler totient approximation","RSA modulus","linear regression","cryptanalysis","machine learning","semiprime","phi lower bound"],"falsifier":"Generate a fresh set of $s$-bit RSA moduli with known prime factors, compute actual $\\varepsilon = \\varphi/2 - 1$, and compare it with $n_s/2 - \\alpha_s$ for the paper's tabulated $\\alpha_s$. If any modulus violates $n_s - 2\\alpha_s + 2 < \\varphi(n_s)$, or if the error $|p+q - 2\\alpha_s + 1|$ grows with the spread of $p$ and $q$, the central claim is refuted. The paper does not report this worst-case check.","tokens_in":5782,"feed_emoji":"🔐","tokens_out":6068,"duration_ms":63109,"temperature":0.7,"pith_summary":"The paper tries to show that Euler's totient function $\\varphi(n)$ for RSA moduli $n=pq$ can be approximated accurately by a single linear fit on the public modulus $n$. Using a parameter $\\varepsilon$ that satisfies $\\varphi = 2(\\varepsilon + 1)$, the authors fit predictors of the form $\\varepsilon_{\\text{pred}} = n/2 - \\alpha_s$, where the slope is always $1/2$ and only the intercept $\\alpha_s$ changes with bit size $s$. They report that on generated 64-, 128-, 256-, 512-, and 1024-bit moduli, the fit achieves $R^2 = 1$ and small mean absolute error, and they claim the lower bound $n_s - 2\\alpha_s + 2 < \\varphi(n_s)$. If correct, the claim would give an attacker who knows only $n$ a numerical estimate of $\\varphi$, which could help in some RSA attacks.","feed_headline":"One line fits RSA totients at five bit sizes","feed_subtitle":"The paper argues n minus twice a fitted constant is a lower bound on phi(n), aiding some RSA attacks.","key_machinery":"The central object is the hyperbola-derived parameter $\\varepsilon$, introduced through the identities $X = 2(n-\\varepsilon)(n+1)-(n-1)^2$ and $Y = 4n(n-\\varepsilon)^2$, with the totient expressed as $\\varphi_\\varepsilon(n) = 2(\\varepsilon + 1)$. The regression treats $\\varepsilon$ as the target and $n$ as the only feature; the fitted predictors $\\varepsilon_{\\text{pred}} = n_s/2 - \\alpha_s$ carry the argument, because they convert a public modulus directly into a lower-bound estimate of $\\varphi$. The per-size intercept $\\alpha_s$ is the entire learned content of the model, and the claimed lower bound $n_s - 2\\alpha_s + 2 < \\varphi(n_s)$ is what would give the approximation cryptanalytic value.","core_discovery":"The central claim is that for each bit size $s$ there exists a constant $\\alpha_s$ such that $\\varepsilon$ for every $s$-bit RSA modulus is bounded below by $n_s/2 - \\alpha_s$, and since $\\varphi = 2(\\varepsilon + 1)$, this yields $n_s - 2\\alpha_s + 2 < \\varphi(n_s)$. The fitted $\\alpha_s$ values are obtained by linear regression on one million generated semiprimes per size, with the parameter $\\varepsilon$ taken from the paper's hyperbola construction rather than from $n$ directly. The paper reports that the slope of the regression is exactly $1/2$ for all sizes, so all size-specific information is carried by the intercept $\\alpha_s$; the tabulated intercepts for 64 through 1024 bits appear in Section 3. The authors interpret the near-perfect $R^2$ scores and symmetric error distributions as evidence that the approximation is accurate on unseen moduli of the same bit size.","pith_inferences":["A consequence the paper leaves implicit: $n - \\varphi(n) + 1 = p + q$, so the same regression also estimates the prime sum, and the absolute error of that estimate is $|p + q - 2\\alpha_s + 1|$; the method's usefulness for factoring hinges on this quantity being small.","One testable extension is to fit $\\alpha_s$ on one subset of a size class and then check on held-out moduli whether $|p + q - 2\\alpha_s + 1|$ stays bounded as $p$ and $q$ vary; the paper reports MAE for $\\varepsilon$ but not this directly attack-relevant quantity.","If the claimed lower bound is true, it implies $\\alpha_s < (p+q+1)/2$ for every $s$-bit modulus, a strong structural statement about the prime distribution that could be checked empirically and would be remarkable if it held at 1024 bits."],"forward_implications":["For an RSA modulus of bit size $s$, the paper claims $\\varphi(n) > n - 2\\alpha_s + 2$, so a public $n$ alone gives a lower bound once $\\alpha_s$ is known.","Because $\\varphi = 2(\\varepsilon + 1)$, the absolute error in predicting $\\varphi$ equals twice the absolute error in predicting $\\varepsilon$; the reported MAE values are therefore the directly attack-relevant quantity.","Since the slope is fixed at $1/2$, the model cannot distinguish moduli of the same bit size except through their value of $n$; all variability in $p$ and $q$ is compressed into the intercept $\\alpha_s$.","The reported $R^2 = 1$ indicates that within the generated datasets, a line explains essentially all variance in $\\varepsilon$, meaning the remaining errors are tiny relative to $\\varepsilon$'s size."],"supporting_citations":[{"why":"Introduces the parameter $\\varepsilon$ and the identity $\\varphi_\\varepsilon(n) = 2(\\varepsilon + 1)$, which is the bridge converting $\\varepsilon$ predictions into totient approximations.","marker":"[3]"},{"why":"Provides the Fermat-factorization hyperbola geometry from which the $\\varepsilon$ parameter is derived.","marker":"[1]"},{"why":"Supplies the arithmetical properties of the hyperbola that underlie the relation between $n$ and $\\varepsilon$.","marker":"[2]"},{"why":"Defines RSA and the role of $\\varphi(n)$ in the scheme, establishing why approximating $\\varphi$ matters.","marker":"[4]"}],"fun_headline_variants":["RSA totient fit: slope exactly 1/2 across five sizes","Five bit sizes, one rule: phi lower bound from line fit","Exact 1/2 slope in phi regression for RSA moduli","Regression yields totient lower bound with 1/2 slope","Line fit sets slope to 1/2 for RSA totient approximation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a single fitted constant $\\alpha_s$ can replace the value $(p+q+1)/2$ for every RSA modulus of size $s$, so that $\\varepsilon$ is essentially $n/2 - \\alpha_s$; if $\\alpha_s$ does not track $p+q$ across moduli of the same size, the approximation error $|p+q - 2\\alpha_s + 1|$ is uncontrolled and the claimed $\\varphi$ bound fails.","fun_headline_variants_meta":{"raw":{"variants":["RSA totient fit: slope exactly 1/2 across five sizes","Five bit sizes, one rule: phi lower bound from line fit","Exact 1/2 slope in phi regression for RSA moduli","Regression yields totient lower bound with 1/2 slope","Line fit sets slope to 1/2 for RSA totient approximation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000893,"raw_usage":{"total_tokens":3836,"prompt_tokens":919,"completion_tokens":2917,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":535,"completion_tokens_details":{"reasoning_tokens":2826}},"tokens_in":535,"tokens_out":2917,"duration_ms":23527,"temperature":1.0,"reasoning_tokens":2826,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T18:57:11.918084+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Generate a fresh set of $s$-bit RSA moduli with known prime factors, compute actual $\\varepsilon = \\varphi/2 - 1$, and compare it with $n_s/2 - \\alpha_s$ for the paper's tabulated $\\alpha_s$. If any modulus violates $n_s - 2\\alpha_s + 2 < \\varphi(n_s)$, or if the error $|p+q - 2\\alpha_s + 1|$ grows with the spread of $p$ and $q$, the central claim is refuted. The paper does not report this worst-case check.","supporting_citations":[{"cited_title":"Bansimba, Regis F","cited_arxiv_id":null,"evidence_quote":"Supplies the arithmetical properties of the hyperbola that underlie the relation between $n$ and $\\varepsilon$."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines RSA and the role of $\\varphi(n)$ in the scheme, establishing why approximating $\\varphi$ matters."}],"review_version":1}