# The polynomial originally used for the RSA-155 factorization
# See "Factorization of a 512-Bit RSA Modulus" in Eurocrypt 2000, LNCS 1807
n: 10941738641570527421809707322040357612003732945449205990913842131476349984288934784717997257891267332497625752899781833797076537244027146743531593354333897
type: gnfs
# Murphy gives a skewness of 10800 (page 104 of his thesis)
# and this is also what is given in the Eurocrypt'2000 paper
# the L1-skewness as computed by polyselect would be 8301.109
skew: 10800.0
c5: 119377138320
c4: -80168937284997582
c3: -66269852234118574445
c2: 11816848430079521880356852
c1: 7459661580071786443919743056
c0: -40679843542362159361913708405064
Y1: 1
Y0: -39123079721168000771313449081
# The following bounds were used for lattice sieving. The paper says
# these bounds were chosen due to limitation of the lattice siever to
# factor base primes less than 2^24, not for optimality
rlim: 16777216
alim: 16777216
# The large prime bound originally used was 10^9, not 2^30, but
# we require a power-of-two here
lpbr: 30
lpba: 30
# Some line sieving allowed up to 3 large primes, but lattice sieving only 2
mfbr: 60
mfba: 60
rlambda: 2.2
alambda: 2.6
qintsize: 200000
# The prime factors of the discriminant, if someone wants to play with
# the number field, are
# 2^8 3^9 5^3 7 19 4463369 5854552419428551073 
# 90637238831985282234717565562083780589
# 87620962372347280167871012623827350428181877 
# 318422122650570760939842277313031606254349797027678964107679980783