{"id":"6477f8fa-2856-4309-8725-f307cef767f6","arxiv_id":"2507.07055","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":1.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"The paper shows that factoring n=pq can be written as an integral, a matrix determinant, or a polynomial root problem, but none of these reformulations yields a practical factoring algorithm.","lead":"This paper restates integer factorization as three different math problems: finding a rectangle's sides from its area, decomposing a 2x2 matrix, and finding small roots of a polynomial. It offers reformulations, but the proposed methods are either trivial equivalences or require conditions that are never satisfied for real-world RSA numbers.","discovery_kind":"incremental","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 3.11's Coppersmith reduction is vacuous: at the factor solution the polynomial equals n, so it cannot vanish modulo any M > n; the central equivalence therefore fails.","rationale":"The reader's weakest assumption identifies exactly the same load-bearing defect: Theorem 3.11 requires n(x0,y0) ≡ 0 mod M, but n(x0,y0) = n and M > n, so this congruence is impossible. I checked the manuscript's own statements: Theorem 3.9 defines the polynomial so that its value at the factor solution is the RSA modulus n; Remark 3.1 sets M to be a modulus greater than n; and the proof of Theorem 3.11 is a bare citation with no construction avoiding the contradiction. This is an internal inconsistency, not a disagreement with external consensus, and it is fatal to the paper's central claim that factorization is equivalent to Coppersmith small-root finding. The integral and matrix sections encode the factorization directly, and Theorem 3.10 is explicitly admitted to be impractical, so Theorem 3.11 is the only place where a nontrivial algorithmic reduction is claimed. Since that reduction rests on an unsatisfiable hypothesis, the abstract's conclusion does not follow. My read therefore does not change the reader's REJECT verdict, and no separate concern replaces it.","tokens_in":17938,"tokens_out":4668,"duration_ms":52981,"concrete_test":"Take n = 55 = 5·11, with p = 5 = 6·1 − 1 and q = 11 = 6·2 − 1, so (x0,y0) = (1,2) and f(x,y) = 36xy − 6(x+y) + 1 satisfies f(1,2) = 55. Choose M = 56 > n. Compute f(1,2) mod 56 = 55 ≠ 0. More generally, for any semiprime n and any M > n, the factor solution gives f(x0,y0) = n, hence f(x0,y0) mod M = n ≠ 0. This single evaluation falsifies the vanishing hypothesis on which Theorem 3.11's Coppersmith application rests; if a different polynomial or a different congruence modulus is intended, that construction must be stated explicitly and tested on the same example.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing step is Theorem 3.11 in §3.3. It claims that for the bivariate polynomial n(x,y) from Theorem 3.9, if XY < M^{1/2−ε} for some RSA-type modulus M > n, then Coppersmith's method can compute n(x,y) ≡ 0 mod M and recover the integer solution. But by construction, at the factor solution (x0,y0) one has n(x0,y0) = n exactly. Since 0 < n < M, reducing modulo M gives n(x0,y0) ≡ n ≠ 0 mod M. Thus the polynomial does not vanish modulo M at the only root that would factor n. Coppersmith's modular-root theorem requires exactly this vanishing congruence; here the hypothesis is unsatisfiable. The proof is a one-sentence citation to [10] and supplies no alternative polynomial or construction of M that would make f vanish. The paper itself admits after Theorem 3.10 that the integer version's bound 'cannot be achieved in practice,' and Theorem 3.11 is presented as the residue-ring fix, but the congruence premise is internally inconsistent. Consequently the claimed equivalence between factorization and finding small roots of the bivariate polynomial is not established; the reduction is empty.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes three reformulations of integer factorization: (1) viewing a semiprime n = pq as the area of a rectangle whose side lengths are recovered from integral bounds; (2) expressing n as the determinant of a 2-by-2 integer matrix and attempting recovery through Gröbner basis or matrix diagonalization; and (3) representing n as one of four bivariate polynomials n(x,y) = 36xy ± 6(x±y) ± 1 and claiming that finding the small roots (x,y) is equivalent to factorization through Coppersmith's method. The background sections survey classical factoring algorithms and the paper claims several 'new vulnerabilities,' including a constant-time or logarithmic-time break when a certain discriminant is square.","tokens_in":18249,"tokens_out":4054,"duration_ms":42505,"significance":"If the central Coppersmith equivalence were valid, the paper would imply a major breakthrough in the factoring of RSA moduli. However, the load-bearing theorems contain internal inconsistencies and are not supported by the cited results. The paper does provide a broad survey of classical factorization algorithms and some worked numerical examples, and the integral reformulations are pedagogically clear, but these positive features do not establish any new algorithmic capability.","major_comments":[{"comment":"Theorem 3.11's reduction to Coppersmith's method is vacuous because its congruence premise is unsatisfiable. For any integer solution (x0,y0) with n(x0,y0)=n and M>n, one has n(x0,y0) ≡ n mod M, which is not 0. Coppersmith's modular-root theorem requires the polynomial to vanish modulo M at the root, so the condition 'n(x,y) ≡ 0 mod M' cannot be met for any RSA-type modulus M>n. The proof, which is a one-sentence citation to [10], therefore does not establish polynomial-time recovery of the factors. This invalidates the abstract's central claim that factorization is equivalent to finding small roots of the bivariate polynomial.","section":"§3.3, Theorem 3.11"},{"comment":"The condition XY < W^{1/3} stated in Theorem 3.10 is not attainable for RSA moduli. With X and Y on the order of sqrt(n)/6, the weight W = max(1, 6X, 6Y, 36XY) is on the order of n, so the condition demands XY ~ n/36 < n^{1/3}, which fails for all n > 1. The paper itself concedes after Theorem 3.10 that this bound 'cannot be achieved in practice,' and Theorem 3.11, presented as the residue-ring fix, fails for the reason given above. Thus no algorithmic consequence follows for the factoring problem the paper targets.","section":"§3.3, Theorem 3.10"},{"comment":"Theorem 3.5 contains load-bearing arithmetic errors. The discriminant of y^2+y-2n=0 is 1+8n, not 1+23n as written, and the corresponding condition should be y^2-8n-1=0 rather than the stated y^2-23n-1=0. Example 3.6 is also inconsistent: for n=25651, 8n+1=205209 is not a perfect square, yet the text claims p=227 is a factor found from this square. The example for n=22008842474653 similarly states '8n+1 = 176070739797225 is a square' but that number is also not a square. These errors invalidate the announced 'new vulnerability' for triangular RSA moduli as stated.","section":"§3.1, Theorem 3.5"},{"comment":"Theorem 3.7's proof assumes without justification that one can choose integers a,b with gcd(a,b)=n and hence ad-bc=n via Bézout's identity; this is equivalent to the factorization problem, not a consequence of Bézout's theorem. Moreover, the Gröbner-basis system (5) explicitly includes the equation ad-bc-n=0, which is the target factorization equation and is not derived from the matrix-entry equations (2). The system therefore does not reduce factorization to an algebraically simpler problem; it merely restates the target as one of the polynomial equations.","section":"§3.2, Theorem 3.7 and system (5)"}],"minor_comments":[{"comment":"There are numerous typos and inconsistent notations, including 'coppersmith' and 'coopersmith' for Coppersmith, 'Le' in Theorem 3.5, 'Triavially' in Theorem 3.7, and inconsistent capitalization of 'Gröbner'. The equation numbering in §3.2 is duplicated: (2), (3), (4), and (5) are each used more than once.","section":"Throughout"},{"comment":"The abstract contains an incomplete sentence: 'its proved that Shor's algorithm could on a quantum computer.' Also, the description of Shor's algorithm in Table 1 lists its complexity as O(b^3), but no reference or derivation is given in the text.","section":"Abstract and §2.2"},{"comment":"The last item of Example 3.6 reads '8n+1 = is a square' with the value missing, and the preceding item gives a non-square value for 8n+1 while still asserting it is a square.","section":"§3.1, Example 3.6"},{"comment":"The polynomial representation in Theorem 3.10 uses a Kronecker-delta expansion and defines n10=n01=6, but the four forms listed in Theorem 3.9 have different signs and the absolute-value expression n(x,y)=36xy+6|x±y|±1 is not a polynomial in the variables x and y. The notation should be clarified.","section":"§3.3, Theorem 3.10"},{"comment":"The reference list contains duplicate entries: [54] and [55] are the same McKee reference, and [66] and [67] are the same Goldwasser–Killian reference. Also, the list is unusually long relative to the paper's new content, and some entries (e.g., [37], [38]) are self-citations to closely related work that is not discussed in the text.","section":"References"}],"recommendation":"reject","confidential_remarks":"The paper is not ready for publication in its current form. The central Coppersmith-based claim is vacuous because the modular congruence premise is unsatisfiable, and Theorem 3.5 contains elementary arithmetic errors. The survey material is extensive but the novel contributions do not withstand scrutiny. I also note a citation-practice concern: several references appear to be self-citations to closely related work, and there are duplicate entries in the bibliography; however, my recommendation rests on the technical unsoundness of the main theorems."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: desk-reject. The three reformulations are either restatements of known facts or rest on load-bearing errors, and the main reduction to Coppersmith's method is vacuous.\n\nWhat the paper does well: the background survey of factoring algorithms is competent and reasonably well referenced. The authors also deserve credit for explicitly admitting, after Theorem 3.10, that their integer Coppersmith bound can't be achieved in practice, and for providing worked examples that make the errors checkable.\n\nBut the core content doesn't hold. The rectangle/integral view (Section 3.1) is a tautology: the bounds are chosen so that (6α±1)(6β±1)=pq; it's a restatement of the factorization, not a path to it. Theorem 3.5 is garbled: the discriminant of y^2+y−2n=0 is 1+8n, not 1+23n, and the examples misuse the sign of the square root (for n=15 the negative root gives 6, which is not a factor). The matrix section reduces to writing det N=n and then re-imposing ad−bc=n in the Gröbner system; solving that system is as hard as factoring.\n\nThe decisive problem is Theorem 3.11. It claims that if XY < M^{1/2−ε} for a modulus M>n, Coppersmith's method can compute n(x,y)≡0 mod M and recover the integer solution. But by the paper's own construction, at a factor solution (x0,y0) the polynomial equals exactly n. Since 0<n<M, n(x0,y0)≡n≠0 mod M. The congruence hypothesis of Coppersmith's theorem is therefore unsatisfiable. The proof is a one-sentence citation to [10] and offers no alternative polynomial or construction of M. This makes the claimed equivalence between factoring and small-root finding fail at the central step.\n\nI don't see anything new here: primes >3 are 6k±1, triangular numbers are classical, determinant decompositions are tautological, and Coppersmith is a known tool. The self-citations are heavy but not the issue. The paper is not credible on its own terms, and I would not spend referee time on it. It might serve as a cautionary example of how easily notation can be mistaken for reduction, but that's the most I can say.","headline":"Theorem 3.11's Coppersmith reduction fails because n(x0,y0)=n can never vanish modulo M>n; the paper is mostly tautological restatement rather than a new approach.","tokens_in":18776,"tokens_out":4059,"would_cite":false,"duration_ms":41015,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["11A51","11Y05","94A60"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that factoring an RSA modulus is equivalent to finding small roots of one of four bivariate quadratics, with Coppersmith's method recovering the factors in polynomial time when the root-size bound is met.","keywords":["integer factorization","RSA","bivariate polynomial","Coppersmith's method","semiprime","matrix decomposition","Gröbner basis","Lebesgue integral reformulation"],"falsifier":"Take a small semiprime such as $n=91=(6\\cdot1+1)(6\\cdot2+1)$ and any integer $M>91$: the congruence $n(1,2)\\equiv0\\pmod M$ fails because $n(1,2)=91$, so the polynomial equation at the factorization point has no root modulo $M$ and Theorem 3.11 cannot be instantiated. A direct check of this congruence for arbitrary $M>n$ is enough to expose the incompatibility.","tokens_in":17745,"feed_emoji":"🔑","tokens_out":14924,"duration_ms":160489,"temperature":0.7,"pith_summary":"The paper tries to establish that integer factorization can be re-encoded in three unfamiliar settings: a rectangle with known area, a 2×2 integer matrix determinant, and a two-variable quadratic equation. Its strongest claim is that when a semiprime's factor coordinates satisfy a small-root bound, Coppersmith's bivariate method recovers the factors in polynomial time, making factorization equivalent to a small-root search. This matters because RSA security relies on factorization being hard; if the equivalence held, the foundations of the cryptosystem's one-way assumption would be in question. The authors present the three viewpoints as ways to bring integral calculus, Gröbner bases, and lattice methods to bear on a classical problem.","feed_headline":"RSA factoring recast as Coppersmith's small-root problem","feed_subtitle":"If Coppersmith's bound holds, RSA factors come from solving a quadratic congruence in polynomial time.","key_machinery":"The central object is the bivariate quadratic $n(x,y)=36xy+6|x+y|+1$ or $36xy+6|x-y|-1$ (equivalently one of the four sign variants), which encodes $n=(6x+1)(6y+1)$, $n=(6x-1)(6y-1)$, or the mixed cases. Since every prime greater than 3 has the form $6k\\pm1$, this one polynomial family covers every RSA semiprime. The argument's engine is Coppersmith's theorem for small roots of bivariate polynomial equations, which promises polynomial-time recovery of a solution $(x_0,y_0)$ when the product of radius bounds $XY$ is below $M^{1/2-\\varepsilon}$; the auxiliary reformulations are the double-integral identity from Fubini's theorem and the matrix identity $N=PQ$ with $\\det N=n$, $\\det P=p$, $\\det Q=q$.","core_discovery":"The paper's central constructive claim is that every RSA modulus $n=pq$ with $p,q>3$ is the value of one of four bivariate quadratic polynomials $n(x,y)=36xy\\pm6(x\\pm y)\\pm1$, because every such prime is $6k\\pm1$. It then applies Coppersmith's bivariate small-roots theorem: if the true solution is $(x_0,y_0)$ with $|x_0|<X$, $|y_0|<Y$, and $XY<M^{1/2-\\varepsilon}$ for a modulus $M>n$, then the congruence $n(x,y)\\equiv0\\pmod M$ can be solved and the integer roots recovered in polynomial time. On the paper's own terms, this makes factoring $n$ algorithmically identical to finding small roots of $n(x,y)$; the rectangle and matrix viewpoints are presented as equivalent reformulations that prepare the same reduction.","pith_inferences":["An implicit route the authors do not develop is to choose the auxiliary modulus $M$ as a divisor of $n$ rather than a number greater than $n$; then the congruence $n(x,y)\\equiv0\\pmod M$ holds at the true factorization point, and a Coppersmith search over one factor becomes a concrete thing to test on small moduli.","Because $x=(p\\pm1)/6$ and $y=(q\\pm1)/6$, moduli with unbalanced factors have one tiny coordinate, and moduli with very close factors have small $XY$ relative to $n$; those parameter regimes are where the small-root condition might be satisfiable.","The authors' future-work hint about hyperbolas suggests a lattice-geometry reading: the solutions of $n(x,y)=C$ lie on a hyperbola, and divisors of $n-1$ constrain the coordinates, so the problem becomes one of constrained lattice-point finding that Coppersmith's method or continued-fraction techniques could attack."],"forward_implications":["If the Coppersmith reduction is sound, semiprimes whose factor coordinates satisfy $XY<M^{1/2-\\varepsilon}$ would be factored in polynomial time in the size of the inputs.","Every RSA semiprime appears as one of the four quadratic forms $36xy\\pm6(x\\pm y)\\pm1$, so the search for factors is exactly a search for integer points on those surfaces.","The determinant reformulation implies that factoring $n$ is equivalent to splitting a $2\\times2$ integer matrix into two integer matrices whose determinants multiply to $n$; Gröbner-basis and diagonalization methods can be directed at that system.","The integral reformulation says that any procedure producing the upper limits of the double integral equal to $n$ outputs the two primes directly.","If a modulus is a triangular number, $8n+1$ is a square and the smaller factor is read off in constant or logarithmic time; this special-case 'RSA broken' claim does not extend to arbitrary moduli."],"supporting_citations":[{"why":"Supplies Coppersmith's theorem on small solutions of bivariate polynomial equations, the engine behind Theorem 3.10 and Theorem 3.11.","marker":"[10]"},{"why":"Supplies Fubini's theorem used in Proposition 3.3 to turn the double integral into a product $(6\\alpha\\pm1)(6\\beta\\pm1)$.","marker":"[8]"},{"why":"Frames factorization and primality as the two fundamental problems of arithmetic, giving the paper its target.","marker":"[16]"}],"fun_headline_variants":["RSA factoring becomes Coppersmith's small-root hunt","Factoring RSA via bivariate quadratic small roots","RSA moduli as quadratic congruences: Coppersmith applies","New lens: RSA factoring as polynomial root finding","RSA cracking redux: Coppersmith's bound on quadratics"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the true solution satisfies both the small-root bound $XY < M^{1/2-\\varepsilon}$ and the congruence $n(x_0,y_0)\\equiv0\\pmod M$ with $M>n$; for typical RSA semiprimes the coordinates are too large (roughly $\\sqrt{n}/6$), and the congruence can only hold when $M$ divides $n$.","fun_headline_variants_meta":{"raw":{"variants":["RSA factoring becomes Coppersmith's small-root hunt","Factoring RSA via bivariate quadratic small roots","RSA moduli as quadratic congruences: Coppersmith applies","New lens: RSA factoring as polynomial root finding","RSA cracking redux: Coppersmith's bound on quadratics"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000665,"raw_usage":{"total_tokens":3082,"prompt_tokens":1041,"completion_tokens":2041,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":657,"completion_tokens_details":{"reasoning_tokens":1958}},"tokens_in":657,"tokens_out":2041,"duration_ms":13768,"temperature":1.0,"reasoning_tokens":1958,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T18:48:30.034720+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a small semiprime such as $n=91=(6\\cdot1+1)(6\\cdot2+1)$ and any integer $M>91$: the congruence $n(1,2)\\equiv0\\pmod M$ fails because $n(1,2)=91$, so the polynomial equation at the factorization point has no root modulo $M$ and Theorem 3.11 cannot be instantiated. A direct check of this congruence for arbitrary $M>n$ is enough to expose the incompatibility.","supporting_citations":[{"cited_title":"Coppersmith, Small Solutions to Polynomial Equations, and Low Exponent RSA Vulnerabilities, Journal of Cryptology, 10(4), 1997, pp","cited_arxiv_id":null,"evidence_quote":"Supplies Coppersmith's theorem on small solutions of bivariate polynomial equations, the engine behind Theorem 3.10 and Theorem 3.11."},{"cited_title":"Sugli integrali multipli","cited_arxiv_id":null,"evidence_quote":"Supplies Fubini's theorem used in Proposition 3.3 to turn the double integral into a product $(6\\alpha\\pm1)(6\\beta\\pm1)$."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Frames factorization and primality as the two fundamental problems of arithmetic, giving the paper its target."}],"review_version":1}