REVIEW 3 major objections 5 minor 3 references
A Geometric Square-Based Approach to RSA Integer Factorization
T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read The paper claims that a square-difference recurrence and a predictive equation can factor RSA moduli with closely spaced prime factors while eliminating brute-force iteration.
desk verdict This paper is Fermat factorization restated with a different variable name; the claimed search elimination disappears under reparametrization, and the key predictive equation contains a clear algebra error. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central machinery is the pair of formulas $D_{k+1}=D_k+2y_0+2k+1$ and $k=\sqrt{N+x^2}-y_0$, tied together by $D_k=(y_0+k)^2-N=x^2$, with $y_0=\lfloor\sqrt{N}\rfloor$. The recurrence supplies a cheap incremental update of the gap to the next square, while the predictive equation is meant to skip iteration by computing a candidate $k$ directly from $x$. The factorization condition is that $D_k$ be a perfect square, which the method tests with an integer-square check.
What would settle it
For a semiprime $N=pq$ with a known small prime gap, count the number of $x$ values the method tests before it finds an integer $\sqrt{N+x^2}$; if that count equals $(q-p)/2$, the same as stepping $k$ one by one, then the claimed elimination of brute-force enumeration has not occurred.
Extended reading notes
Core claim
For a semiprime $N=pq$ with $p<q$, set $y_0=\lfloor\sqrt{N}\rfloor$ and let $y=y_0+k$. The paper shows that the gap $D_k=(y_0+k)^2-N$ is itself a square $x^2$ exactly when $N$ splits as $(y-x)(y+x)$. The recurrence $D_{k+1}=D_k+2y_0+2k+1$ updates this gap by one odd increment, and the equation $k=\sqrt{N+x^2}-y_0$ is presented as a predictive way to obtain $k$ from a chosen $x$ instead of stepping through every $k$. The author claims this transforms factorization into a check for integer solutions of $\sqrt{N+x^2}\in\mathbb{Z}$, enabling partial or full elimination of brute-force loops for tightly spaced prime factors.
Load-bearing premise
The load-bearing premise is that checking $k=\sqrt{N+x^2}-y_0$ for integer values of $x$ lets the method skip candidates that a step-by-step scan would visit; in fact the two look at the same set of pairs.
Editorial extensions
If this is right
- For a semiprime with half-gap $x=(q-p)/2$, the method must test at most the integer values of $x$ from $1$ up to that half-gap before finding the factorization.
- When the square test succeeds, the method returns $p=y-x$ and $q=y+x$ exactly, giving a deterministic factorization rather than a probabilistic one.
- Per candidate value, the work is one addition and one integer-square test, so the runtime is dominated by the number of candidates rather than directly by the bit length of $N$.
- As the author reports, for large prime separations the candidate count grows so large that the method fails to factor a 100-digit challenge modulus in practical time.
Reading between the lines
- Beyond the paper: because $y_0+k=\sqrt{N+x^2}$, the integers $k$ and $x$ determine each other uniquely, so scanning integer $x$ values and scanning $k$ values visit exactly the same candidate set; the predictive equation is an algebraic rearrangement, not a reduction of the search space.
- Beyond the paper: any genuine speed advantage over the standard square-difference method would have to come from a faster way of testing whether $\sqrt{N+x^2}$ is an integer, not from the recurrence itself.
- A testable extension is to run the algorithm on semiprimes with known factor gaps and count the candidate $x$ values tested; the count should equal $(q-p)/2$, exhibiting linear dependence on the prime gap.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper claims to present a novel geometric square-based method for factoring RSA moduli, centered on the recurrence D_{k+1}=D_k+2y0+2k+1 and the equation k=sqrt(N+x^2)-y0. It argues that scanning integer values of x and checking whether N+x^2 is a perfect square enables 'partial or full elimination of brute-force enumeration.' The method is validated on N=187, a Python implementation is provided, and the paper honestly reports that RSA-100 could not be factored in practical time.
Significance. If the central claim were correct, a deterministic method that eliminates brute-force search for close-prime RSA moduli would be a notable contribution. The paper's algebra is transparent, the code is simple and reproducible, and the authors explicitly acknowledge the method's practical failure on RSA-100. However, the claimed efficiency gain is not supported: the x-scan is equivalent to the standard k-scan of Fermat's method, and the algorithm is a restatement of the classical difference-of-squares factorization. The paper therefore does not offer a new factoring technique, and its central contribution is a pedagogical reformulation rather than a cryptographic advance.
major comments (3)
- [Section 2, Eq. (6)] The discriminant in Eq. (6) is incorrect. Solving the quadratic in Eq. (5), k^2 + 2y0 k + (y0^2 - N - x^2) = 0, yields k = -y0 ± sqrt(N + x^2), not -y0 ± sqrt(y0^2 - x^2 + N) as printed. For the paper's own example N=187, x=3, y0=13, the printed formula gives k ≈ 5.63 rather than the true k=1. This is not a mere typo: it makes the derivation in Section 2.1 internally inconsistent, even though Eq. (8) accidentally uses the correct expression.
- [Section 2.1 and Section 6] The claim that scanning x and checking whether sqrt(N+x^2) is an integer 'significantly reduces computational overhead' and enables 'partial or full elimination of brute-force enumeration' is unsupported. From Eq. (7), x^2 = (y0+k)^2 - N, so k and x are in bijection over the same integer candidate set: every k that makes D_k a perfect square corresponds to exactly one x, and vice versa. Thus scanning x and testing whether N+x^2 is a square performs the same number of squareness tests as scanning k. The code in Section 3 is a standard Fermat recurrence, and the paper offers no complexity analysis that distinguishes the two scans.
- [Section 2] The method is a restatement of Fermat's factorization rather than a new algorithm. Equation (1) is exactly the identity N = y^2 - x^2 = (y-x)(y+x), and recurrence (3) is the standard Fermat iteration over y. The paper acknowledges functional equivalence to Fermat's method in Section 2.1 but still presents the approach as novel and predictive. Because the underlying algorithm is classical and no advantage is demonstrated, the paper does not meet the standard of a new factoring contribution.
minor comments (5)
- [Section 1] The description of GNFS as 'probabilistic' is imprecise; the number field sieve is a deterministic algorithm in principle, with randomized implementation choices. This distinction is not central to the paper and should be phrased more carefully.
- [Section 2, Eq. (1)] The notation x_k^2 presupposes that D_k is a perfect square. The definition should state that x_k is defined as sqrt(D_k) when D_k is a square, since the algorithm's test is precisely whether that condition holds.
- [Section 3] The in-code recurrence 'k += 1; D += 2*y0 + 2*k - 1' is equivalent to Eq. (3) only after an index shift; a brief comment in the code would prevent reader confusion about the off-by-one indexing.
- [Section 4] The sentence 'This confirms that the method recovers the prime factors exactly' is too strong for a single worked example; it would be more accurate to say that the example illustrates the algorithm's behavior.
- [References] Reference [3] cites a Wikipedia page for the RSA Factoring Challenge; a primary source, such as the RSA Laboratories challenge description, would be more appropriate for a formal manuscript.
Circularity Check
No significant circularity: the paper's equations are algebraic restatements of the Fermat difference-of-squares identity, but the derivation is self-contained and no fitted parameters or load-bearing self-citations are present.
full rationale
The derivation chain is self-contained. The paper defines D_k = (y0+k)^2 - N = x_k^2, then expands and rearranges this defining relation into the recurrence (3) and the closed form k = sqrt(N+x^2) - y0 in Eq. (8). Equation (8) is not an independent prediction; it is the same difference-of-squares condition rewritten. That makes the claimed 'predictive x-scan' a reparametrization of Fermat's method, which the paper explicitly acknowledges: 'This method is functionally equivalent to Fermat's method but proceeds from the opposite direction.' This is a novelty and efficiency issue, not circular reasoning: no parameter is fitted to data, no result is assumed from a citation by the same authors, and the algebra does not secretly presuppose the factorization p,q. The algebraic slip in Eq. (6) (the discriminant should be N+x^2, not y0^2-x^2+N) is a correctness issue rather than a circular step. Therefore the paper should receive a score of 0 on circularity.
Assumptions & free parameters
assumptions (2)
- domain assumption RSA modulus N is a semiprime N=pq with primes p<q and y0=ceil(sqrt(N)).
- standard math Elementary algebra: (y0+k)^2 - N = x^2 is equivalent to N=(y0+k-x)(y0+k+x).
Cite this review
Pith. "Pith review of A Geometric Square-Based Approach to RSA Integer Factorization." pith.science (2026). https://pith.science/paper/N7YJ4ZV4
@misc{pith2026250617233,
author = {Pith},
title = {Pith review of: A Geometric Square-Based Approach to RSA Integer Factorization},
year = {2026},
howpublished = {\url{https://pith.science/paper/N7YJ4ZV4}},
note = {Machine review of arXiv:2506.17233}
}
read the original abstract
We present a new approach to RSA factorization inspired by geometric interpretations and square differences. This method reformulates the problem in terms of the distance between perfect squares and provides a recurrence relation that allows rapid convergence when the RSA modulus has closely spaced prime factors. Although this method is efficient for small semiprimes, it does not yet succeed in factoring large challenges like RSA-100 in practical time, highlighting both its potential and current limitations.
Reference graph
Works this paper leans on
-
[1]
R. L. Rivest, A. Shamir, and L. Adleman, ”A method for obtaining digital signatures and public-key cryptosystems,”Communications of the ACM, vol. 21, no. 2, pp. 120–126, 1978
work page 1978
-
[2]
Riesel,Prime Numbers and Computer Methods for Factorization, Birkh¨ auser, 1994
H. Riesel,Prime Numbers and Computer Methods for Factorization, Birkh¨ auser, 1994
work page 1994
-
[3]
Available at: https://en.wikipedia.org/wiki/RSA Factoring Challenge 3
RSA Laboratories, ”The RSA Factoring Challenge”, 2020. Available at: https://en.wikipedia.org/wiki/RSA Factoring Challenge 3
work page 2020
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.