Forensic Construction-Family Signatures in Solved RSA Challenge Moduli: High-Bit Conditioning, Residue Constraints, and Factor-Balance Patterns

Abstract

RSA moduli may retain arithmetic evidence of prime-selection constraints. We analyse 22 solved formal RSA Challenge moduli (44 factors), excluding RSA-129 and treating 18 original decimal-labelled entries separately from four later bit-labelled entries. Exact arithmetic and matched Monte Carlo controls show that all 44 factors begin with the binary prefix 11. This high-bit condition forces b(N) = b(p) + b(q) and, with balanced factor-bit allocation, explains equal factor-bit lengths for even-bit moduli and adjacent factor-bit lengths for odd-bit moduli. All 18 original pairs also satisfy p ≡ q ≡ 2 (mod 3), recovering a documented public exponent compatibility rule. The analysis used 620,000 accepted control pairs and 100,000 pseudo-datasets per comparison. The observed all-11 pair count was 22, compared with a size-and-label model median of 8 (Holm-adjusted p = 3.00 × 10⁻⁵); the residue-pair count was 18, compared with a high-bit model median of 4 (adjusted p = 3.00 × 10⁻⁵). For the eight adjacent-bit moduli, the frozen lower-tail comparison did not reject the documented-residue model (p = 0.1007). An independently seeded rerun reproduced the pseudo-dataset inference from the archived pools, but independent regeneration of the full control pools remains pending. The evidence supports broad high-bit conditioning and recovery of documented metadata but not a separate factor-balance signature, implementation attribution, weak-key detection, or reduced factoring resistance.

1. Introduction

RSA moduli are ordinarily evaluated through the security problem they define: given a public modulus N = pq, can an adversary recover its prime factors? Once p and q are known, a different forensic question becomes possible: what, if anything, do the factors reveal about the procedure by which they were generated? Prime-candidate formatting, congruence filters, factor-size allocation, and pair-level acceptance rules can leave persistent arithmetic structure in the factors. Such structure may remain observable long after the original software, random seeds, and operational records have disappeared [1].

The solved RSA Challenge moduli provide an unusual historical dataset for studying this question. Unlike ordinary deployed RSA public keys, the factors of the solved Challenge numbers are publicly available. Their provenance also includes two distinguishable populations: the original decimal-labelled Challenge numbers and the later bit-labelled numbers generated through a separately documented BSAFE process [2,3]. The dataset therefore permits direct factor-level analysis while requiring explicit provenance control. RSA-129 is excluded from the study population because it originated as an earlier 1977 cryptographic puzzle rather than as part of the formal RSA Factoring Challenge [4].

A construction family is a class of prime-generation and factor-selection procedures that share observable constraints, such as candidate high-bit settings, congruence conditions, and factor-size rules, without necessarily sharing the same software implementation. A construction-family signature is a reproducible arithmetic property consistent with such a class. It supports family-level inference but does not, by itself, uniquely identify a library, algorithm, device, seed, or implementation. In this terminology, a feature is a directly computed quantity, a signature is a reproducible pattern associated with a construction class, and a fingerprint is reserved for evidence that has been validated as sufficiently discriminating for implementation-level attribution.

The first form of evidence examined here is high-bit conditioning. For a positive integer x, define the normalised binary mantissa by

$$M_2\left(x\right)={\displaystyle \frac{x}{2^{b\left(x\right)-1}}}.$$

where b(x) is the bit length of x. Every retained prime factor satisfies M₂(x) ≥ 3/2, which is equivalent to binary prefix 11. Writing

$$p=M_2\left(p\right)2^{b\left(p\right)-1}, q=M_2\left(q\right)2^{b\left(q\right)-1}.$$

gives

$$N=M_2\left(p\right)M_2\left(q\right)2^{b\left(p\right)+b\left(q\right)-2}.$$

Because both normalised mantissas are at least 3/2,

$$M_2\left(p\right)M_2\left(q\right)\ge {\displaystyle \frac{9}{4}}>2, b\left(N\right)=b\left(p\right)+b\left(q\right).$$

When this identity is combined with balanced factor-bit allocation, it explains the observed division between equal factor-bit lengths for even-bit moduli and adjacent factor-bit lengths for odd-bit moduli. The bit-parity pattern is therefore treated as a consequence of more fundamental construction conditions rather than as independent evidence.

The second form of evidence is the residue constraint documented for the original decimal-labelled Challenge population:

$$p\hspace{0.25em}\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}3=q\hspace{0.25em}\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}3=2.$$

This rule made the public exponent e = 3 compatible with each factor and provides a historically documented positive control [2]. It also produces a derived consequence. With A = (p + q)/2, the difference q − p is divisible by both 2 and 3, so

$$A^2-N={\left({\displaystyle \frac{p+q}{2}}\right)}^2-pq={\displaystyle \frac{{\left(q-p\right)}^2}{4}}\equiv 0\hspace{0.25em}(\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}9).$$

The modulo-9 condition is therefore not a second independent construction-family signature; it is an algebraic consequence of the documented modulo-3 rule.

The third form of evidence is factor-balance. The analysis separates discrete factor-bit balance from continuous magnitude balance. The factor-bit difference records whether the two factors occupy equal or adjacent bit intervals, while the ratio q/p describes their relative magnitudes. Normalised AM-GM quantities are treated as transformations of that ratio, not as independent evidence. This dependency-aware treatment is necessary because several visually distinct numerical patterns can arise from the same underlying size constraints.

The central premise is that the solved RSA Challenge factors preserve layered arithmetic evidence of their construction. High-bit conditioning identifies a broad prime-generation family; the modulo-3 constraint identifies a documented rule within the original decimal-labelled population; and factor-balance patterns describe the effects of factor-size allocation and pair selection. These observations support cautious family-level provenance analysis, but they do not uniquely identify an implementation or imply reduced factoring security.

The paper addresses three research questions:

• RQ1. Which high-bit, congruence, and factor-balance properties occur in the prime factors of the 22-modulus RSA Challenge dataset?
• RQ2. Which observed patterns are direct construction evidence, which reproduce documented generation rules, and which are algebraic consequences of other constraints?
• RQ3. Which properties remain informative after comparison with controls matched for factor-bit lengths, public modulus labels, and relevant residue restrictions, and what level of provenance inference do they justify?

This paper is framed as a methodological case study in cryptographic forensics, not as a search for a previously unknown structure in the RSA Challenge moduli. It demonstrates how dependency-aware arithmetic analysis, provenance partitioning, and matched generative controls can be applied to a small historical corpus with publicly known factors. The high-bit result, recovery of the documented modulo-3 rule, and factor-balance analysis are therefore presented as illustrations of an evidential method rather than as newly discovered RSA Challenge construction rules.

The study makes five contributions:

• A provenance-controlled dataset that separates the original decimal-labelled and later bit-labelled Challenge populations rather than treating all solved moduli as outputs of one homogeneous generator.
• An exact high-bit result: all 44 retained factors begin with binary prefix 11, together with a derivation showing why this sufficient condition forces b(N) = b(p) + b(q).
• A reconstruction of the documented rule that both factors are congruent to 2 modulo-3 in all 18 original decimal-labelled pairs, together with an explicit separation of that rule from its derived residue consequences.
• A dependency-aware analysis of factor-balance that distinguishes discrete bit allocation from continuous factor imbalance and avoids counting algebraically equivalent metrics as separate signatures.
• A bounded provenance interpretation in which matched controls are used to distinguish generic generation practices from historically associated constraints, without claiming exact implementation attribution or key weakness.

Scope boundary. This study analyses construction evidence, not cryptographic weakness. None of the reported high-bit, residue, or balance properties is claimed to reduce the practical difficulty of factoring the associated moduli. Correspondence with a construction family is not treated as unique attribution to a particular implementation. Exact implementation attribution would require substantially larger labelled datasets, prospectively specified classifiers, and out-of-sample validation.

The novelty lies in the study design and evidential separation, not in the individual high-bit or modulo-3 conditions. The paper provides a provenance-controlled, corpus-wide analysis of the solved formal RSA Challenge moduli, including the 44-of-44 high-bit observation and its comparison with controls matched to factor-bit lengths, public labels, and provenance-specific constraints. These comparisons provide model-relative evidence that a size-and-label-only construction model is inadequate; they do not establish a unique historical mechanism. The study’s contribution is therefore a dependency-aware framework that distinguishes exact arithmetic observations, recovery of documented construction metadata, algebraic consequences, and bounded construction-family inferences.

The remainder of the paper is organised as follows. Section 2 reviews related work and positions the study. Section 3 describes the materials and methods. Section 4 presents the frozen comparison plan and statistical analysis, and Section 5 reports the results. Section 6 discusses the findings, Section 7 outlines the limitations and priorities for future validation, and Section 8 concludes the paper.

2. Related Work and Study Position

2.1. RSA Prime Generation and Configurable Constraints

RSA key-pair generation selects two large primes and forms N = pq [1]. Practical generators impose conditions beyond primality. FIPS 186-5 specifies RSA modulus length, public-exponent compatibility, probable-prime testing, lower bounds on the factors, and a minimum factor separation; in its probable-prime method, the two most significant bits of each candidate may be set arbitrarily [5]. OpenSSL provides a concrete library example: when add is NULL, BN_generate_prime_ex2 returns an exact-length probable prime with the two most significant bits set [6]. These sources show that high-bit conditioning can be a generic construction-family feature. They do not establish that the historical RSA Challenge generators used either procedure.

2.2. Public-Key Implementation Forensics

Large-scale studies of deployed public keys established that implementation defects can become visible in cryptographic artefacts. Heninger et al. and Lenstra et al. used batch-GCD analysis to identify RSA moduli sharing prime factors, linking the failures to weak or malfunctioning randomness [7,8]. Švenda et al. showed that distributions in public RSA keys can reveal probable software library or hardware origins and formalised origin attribution as a classification problem [9]. Nemec et al. demonstrated a stronger case in which a deterministic prime-construction structure enabled practical factorisation of affected keys [10]. Together, these studies establish the feasibility and the dual-use consequences of RSA implementation forensics.

The present study differs in two respects. First, it analyses a historical corpus for which p and q are known, making factor-level constraints directly observable. Second, it examines deliberate formatting, congruence, and pair-selection rules rather than beginning from a demonstrated deployment failure. A construction-family signature is therefore not equated with a vulnerability: a feature may be forensically informative while remaining fully compatible with strong RSA keys.

2.3. RSA Challenge Records and Known-Factor Analyses

The original RSA Challenge list documents that each decimal-labelled number was constructed from two randomly chosen primes of approximately the same length, that both primes were congruent to 2 modulo-3, that probabilistic primality testing was used, and that the factors were discarded after the product was formed [2]. The later bit-labelled list was generated through a distinct process; an archived RSA Laboratories FAQ reports that hardware-generated random bytes seeded the B_GenerateKeyPair function in RSA BSAFE 4.0, after which private key material was discarded [3]. These descriptions justify treating the two lists as separate historical populations rather than pooling them under one generation model.

The RSA numbers have primarily been studied as factorisation records. RSA-129 was factored as part of the earlier “Squeamish Ossifrage” project [4]; RSA-768 provided a major number-field-sieve record [11]; the RSA-240 and RSA-250 computations were reported in a later comparison of factorisation and discrete-logarithm difficulty [12]. Public record summaries continue to track the status of the remaining challenge numbers [13,14]. These sources establish factorisation provenance and record status, but they do not provide a dependency-aware analysis of the arithmetic constraints preserved in the known factors.

Recent work has extended RSA key analysis in two complementary directions. Janovsky et al. and Branca et al. developed origin-attribution methods using large labelled corpora of RSA keys generated by multiple cryptographic libraries, hardware security modules, smartcards, operating systems, and library versions [15,16]. Nezhadian et al. conducted a large-scale measurement of reused RSA certificates and public keys across the PKI ecosystem, documenting the persistence and distribution of duplicated and reused key material [17]. These studies demonstrate that implementation- or ecosystem-level conclusions require broad labelled or measured corpora and explicit validation. The present study addresses a different setting—a small historical known-factor corpus—and therefore limits its conclusions to construction-family compatibility rather than implementation identity.

2.4. Research Gap and Evidential Position

Three distinctions are especially important in this setting: the distinction between a directly observed property and an algebraic consequence of another property; the distinction between a documented historical rule and a mechanism inferred only from final outputs; and the distinction between a feature shared by a broad construction family and evidence capable of attributing a key to a particular implementation. The present paper organises the RSA Challenge analysis around these distinctions. Its objective is not to multiply correlated metrics but to identify the weakest construction model that explains each observed pattern and to state the corresponding evidential limit.

3. Materials and Methods

3.1. Study Population and Data Freeze

The working dataset was frozen on 13 July 2026. A modulus was eligible when it (i) belonged to the formal RSA Factoring Challenge, (ii) had a complete publicly available factorisation, (iii) could be represented as an exact tuple (N, p, q), and (iv) passed the arithmetic and label checks described in Section 3.4. Applying these criteria yielded 22 moduli and 44 factors. The population composition is shown in

Table 1. Provenance partition and analytical treatment of the study population.

Population	Included Identifiers	Analytical Treatment
Original decimal-labelled (n = 18)	RSA-100, RSA-110, RSA-120, RSA-130, RSA-140, RSA-150, RSA-155, RSA-160, RSA-170, RSA-180, RSA-190, RSA-200, RSA-210, RSA-220, RSA-230, RSA-232, RSA-240, and RSA-250	Primary historical stratum. The documented condition that both primes are congruent to 2 modulo-3 is evaluated as a positive control.
Later bit-labelled (n = 4)	RSA-576, RSA-640, RSA-704, and RSA-768	Separate BSAFE stratum. Not pooled with the original list for residue inference.
RSA-129 contrast (excluded)	RSA-129	Not part of the formal Challenge population. Retained only as an external historical contrast, not as an inferential observation.

[2,3,13,14].

3.2. Provenance Partition

The original decimal-labelled list and the later bit-labelled list were generated under different documented procedures. For the original list, the primary source states that the two primes were randomly chosen, approximately equal in length, congruent to 2 modulo-3, tested with a probabilistic primality routine, and generated using the RSA DSP product [2]. The congruence condition is therefore known historical metadata, not a post hoc conjecture. In this study, it serves as a positive control: a genuine construction rule should be recoverable from the final factors.

For the later bit-labelled list, the archived RSA Laboratories FAQ describes a BSAFE 4.0 key-pair generation process seeded from 30,000 bytes produced by a ComScire hardware random-number generator [3]. The private portions were discarded and the public moduli were exported. The source does not document the original list condition that both primes are congruent to 2 modulo-3. Accordingly, residue results from the 18 decimal-labelled pairs are not generalised to the four BSAFE pairs, and distributional comparisons are reported by provenance stratum wherever sample size permits.

3.3. Inclusion, Exclusion, and Canonical Ordering

The analysis includes only completely factored formal Challenge entries. Unsolved numbers, partially factored numbers, duplicate representations, and records lacking an exact factor pair are excluded. For every included modulus, the factors are placed in canonical order p ≤ q. RSA-129 is excluded for provenance rather than numerical convenience: it originated as the 1977 Gardner/RSA puzzle and was not generated as part of the later RSA Factoring Challenge [4]. Its values may be shown in a sensitivity or contrast analysis, but they do not contribute to counts, descriptive summaries, null-model fitting, or inferential tests for the 22-modulus study population.

3.4. Data Acquisition and Arithmetic Verification

The modulus strings for the original decimal-labelled entries were compared with the archived Challenge list [2]. Factor strings were transcribed from the public RSA-numbers compilation [14] and cross-checked against published factorisation reports where primary records were available [4,11,12]. The accompanying data file preserves N, p, q, population membership, label type, and the derived verification fields for every included row.

Verification was performed with Python 3.13.5 and SymPy 1.14.0 [18]. Exact arbitrary-precision integer arithmetic was used to test pq = N, decimal- or binary-label consistency, canonical ordering, bit lengths, and residue values. SymPy isprime supplied an independent primality screen for each published factor. This software check is treated as corroboration of the published factorisations rather than as a substitute for the original factorisation records or formal primality certificates. All numerical outputs were independently verified by the authors using the archived scripts and datasets.

Table 2. Validation checks applied to the frozen dataset.

Check	Scope	Result
Exact factor multiplication, pq = N	All included moduli	22/22 passed
Challenge label consistency	18 decimal labels and 4 binary labels	22/22 passed
Canonical ordering, p ≤ q	All included moduli	22/22 passed
Independent SymPy isprime screen	All published factors	44/44 passed
Binary prefix 11	All published factors	44/44 observed
b(N) = b(p) + b(q)	All included moduli	22/22 observed
Documented (2,2) residue modulo-3	Original decimal-labelled stratum	18/18 observed

summarises the checks.

The exact Supplementary Files accompanying this article are listed in the Supplementary Materials section and are included in the submission package.

3.5. Analysis Unit and Core Variables

The primary statistical unit is the modulus, not the individual prime. The two factors within each modulus are paired observations, and all factor-level summaries preserve that pairing. Narrative text uses prose such as “all 44 factors,” while validation and evidential tables use compact exact-count notation such as “44/44 factors.” Inferential comparisons are conducted at the pair level or by resampling complete pairs. The two historical populations are modelled separately unless a pooled analysis is explicitly justified.

For a modulus N = pq with p ≤ q, bit length is defined by

$$b\left(x\right)=1+\mathrm{f}\mathrm{l}\mathrm{o}\mathrm{o}\mathrm{r}\left({\mathrm{l}\mathrm{o}\mathrm{g}}_{2}x\right), N=pq, p\le q.$$

The normalised binary mantissa M₂(x) is defined in Section 1. High-bit conditioning is recorded both as the continuous value M₂(x) and as the binary-prefix indicator M₂(x) ≥ 3/2. Discrete factor-bit balance is measured by

$${\mathrm{\Delta }}_b\left(N\right)=b\left(q\right)-b\left(p\right).$$

Continuous factor-balance is measured primarily by

$$r\left(N\right)={\displaystyle \frac{q}{p}}\ge 1.$$

The relative AM-GM gap is retained as an interpretable transformation of the same imbalance:

$$D_{\mathrm{A}\mathrm{G}}\left(N\right)={\displaystyle \frac{A-G}{G}}={\displaystyle \frac{p+q}{2\sqrt{pq}}}-1={\displaystyle \frac{r+1}{2\sqrt{r}}}-1.$$

Because D_AG is a one-to-one function of r for r ≥ 1, it is not counted as independent evidence. Residue features are computed directly from p and q, with the original list modulo-3 condition analysed as documented construction metadata. Candidate landing indices, binary-decimal mantissa correlations, and continued-fraction diagnostics are outside the core feature set of this paper.

3.6. Matched Control Design

A contemporary control must reproduce the selection problem faced by the historical generator, not merely draw two independent primes of convenient sizes. The control design therefore separates the two provenance strata. For the original decimal-labelled population, controls match the decimal label length, observed factor-bit allocation, product acceptance, and documented condition that both primes are congruent to 2 modulo-3. For the later bit-labelled population, controls match the exact modulus bit length and observed factor-bit allocation. Any future versioned full key-generation sensitivity baseline should record its selected public exponent and rejection behaviour; because exponent metadata for the four historical BSAFE records have not been established in the frozen dataset, no exponent-specific inference is made for that stratum.

Library documentation can provide positive controls for individual mechanisms. For example, OpenSSL documents that BN_generate_prime_ex2 sets the two most significant bits when add is NULL [6]. A generic OpenSSL prime sample could therefore confirm the expected high-bit feature, but it would not reproduce complete RSA key-pair generation or uniquely attribute the historical Challenge moduli. Any implementation-specific baseline would need to record the library and version, build configuration, operating system, compiler, API path, public exponent, random-bit generator and seeding procedure, factor-size allocation, rejection rules, and sample size. An earlier underspecified pilot is not treated as confirmatory evidence in this study.

Statistical comparisons use the modulus as the sampling unit. Monte Carlo procedures preserve complete factor pairs, target configurations, and provenance strata. Effect sizes and uncertainty intervals are reported alongside nominal p-values, and exploratory tests are labelled as such. Multiplicity and algebraic dependence are addressed before interpreting any pattern as a separate construction-family signature.

3.7. Reproducibility Assets and Dataset Limitations

Data S1 contains the 22 exact tuples (N, p, q), provenance labels, label checks, bit lengths, binary prefixes, normalised mantissas, factor ratios, the relative AM-GM gap, and residue fields. Code S1 reruns the exact arithmetic checks; Code S2 computes the observed H1–H3 statistics; Protocol S1 records the frozen analysis; Protocol Amendment S1 records the definitive control implementation; and Protocol Amendment S2 records the retained replication scope. Code S3 generates the matched controls and primary inference; Code S4 independently reruns the pseudo-dataset draws; and Code S5 audits the archived control constraints. Control Data S2, Manifest S1, Results S1–S2, Control QC S1, and Table S1 preserve the generated outputs, pool summaries, and recorded hashes.

The dataset nevertheless has important limits. It is small, historical, and selected by successful factorisation. Candidate seeds, candidate sequences, sieve states, retry histories, and most original implementation details are unavailable. Multiple generation mechanisms can produce the same final constraints, so output features do not uniquely identify causal mechanisms. The four solved bit-labelled BSAFE moduli provide only a small case series, and their distributions should not be treated as a precise estimate of the full later-list generator. These limitations motivate the paper’s family-level language and its separation of exact arithmetic observations from stronger historical inferences.

Published primary factorisation reports were used where available, including reports for RSA-129, RSA-768, RSA-240, and RSA-250. For other entries, factor values were taken from the cited public compilation and checked by exact multiplication, label consistency, and probable-prime testing. These checks corroborate the published values but do not replace formal primality certificates or a complete primary-source record. The supplementary archive contains the machine-verifiable factor data, code, protocols, control pools, manifests, results, quality-control outputs, pool summaries, and SHA-256 hashes listed in the Supplementary Materials section.

3.8. Use of Generative AI Tools

OpenAI ChatGPT (GPT-5.6 Pro, accessed 13 July, 3 August, and 21 August 2026) was used to assist with manuscript restructuring, language revision, analysis-code review, and preparation of reproducibility documentation. All numerical results were generated by the versioned scripts and archived outputs described in Section 3.7; the tool was not treated as a source of empirical data or bibliographic authority. The authors reviewed the generated text, code, and interpretations and remain responsible for the final content.

4. Statistical Analysis and Frozen Comparison Plan

This section records the analysis plan governing matched-control generation and inference. The historical Challenge factors and preliminary summaries were examined during development of the earlier draft; consequently, Protocol S1 is not a preregistration, H1 and H2 are model-adequacy checks whose directions were already visible, and Challenge-only observations are not represented as prospectively confirmed discoveries. Before any new matched control was generated or inspected, however, the protocol froze the population strata, primary variables, model hierarchy, statistics, directions, multiplicity treatment, sensitivity analyses, and permissible claim language. Protocol S1 contains these decisions in machine-readable form, versioned as 1.0 and frozen on 13 July 2026.

4.1. Evidence Levels and Claim Boundaries

The analysis separates four evidential levels. Higher levels require additional information and stronger validation; a result is not promoted to a higher level merely because its numerical contrast is large.

Table 3. Evidence levels and the strongest conclusion permitted at each level.

Level	Evidence Type	Required Support	Permissible Conclusion
E1	Exact arithmetic observation	Verified values computed directly from the frozen tuples (N, p, q).	A property holds for the retained solved dataset.
E2	Documented-rule recovery	Agreement between an exact factor property and a contemporaneous construction record.	The final factors preserve a known historical rule; the recovery is a positive control rather than a new attribution.
E3	Construction-family inference	A statistic, direction, and model comparison frozen before generation or inspection of the new matched-control outputs.	The data are more or less compatible with a stated family of procedures; alternative mechanisms may remain.
E4	Implementation attribution	Large labelled multi-version library or device baselines, out-of-sample validation, and quantified classification error.	A specific implementation origin may be inferred within the validated label set. This level is outside the present study.

defines the evidential hierarchy used throughout Section 5 and Section 6.

The all-11 count and factor-bit allocation begin at E1. The original list modulo-3 rule reaches E2 because it is documented independently of the factor analysis. Only contrasts against the matched models defined below can support E3. No analysis in this paper is permitted to make an E4 claim, to identify an exact seed or candidate sequence, or to infer reduced factoring security.

4.2. Primary Features and Dependency Structure

For modulus i, the primary feature vector is

$${\mathrm{x}}_i=\left(M_2\left(p_i\right),M_2\left(q_i\right),{\Delta }_b\left(N_i\right),r_i,p_i\hspace{0.25em}\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}3,q_i\hspace{0.25em}\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}3\right).$$

The vector contains only directly computed factor properties. For continuous pair balance, the primary comparison statistic removes the known zero- or one-bit allocation step:

$$B_i=\left|{\mathrm{l}\mathrm{o}\mathrm{g}}_2{r}_i-{\Delta }_b\left(N_i\right)\right|=\left|{\mathrm{l}\mathrm{o}\mathrm{g}}_2\left({\displaystyle \frac{M_2\left(q_i\right)}{M_2\left(p_i\right)}}\right)\right|.$$

For equal-bit factors, B_i equals log₂(q_i/p_i). For adjacent-bit factors, subtracting the one-bit step compares the normalised mantissas rather than treating the planned bit length difference as imbalance. B_i is dimensionless, symmetric with respect to the two normalised mantissas, and comparable across modulus sizes. The raw absolute mantissa difference is retained only as a sensitivity statistic.

Several visually distinct quantities are deterministic consequences or one-to-one transformations of these primary features. They are reported for interpretation but are not assigned separate hypothesis tests.

Table 4. Dependency map for avoiding duplicate evidence.

Primary Condition	Derived Outcome	Reason	Treatment
Both M2 values are at least 3/2, with balanced bit allocation	b(N) = b(p) + b(q) and the equal/adjacent parity pattern	The product mantissa exceeds 2, fixing the product bit length.	Exact consequence; no additional p-value.
p ≡ q ≡ 2 (mod 3)	A2 − N ≡ 0 (mod 9)	q − p is divisible by 6 and A2 − N = (q − p)2/4.	Positive-control consequence; not an independent residue signature.
Factor ratio r = q/p	Relative AM-GM gap	The gap is a one-to-one function of r for r ≥ 1.	Descriptive transformation; not an additional test.
M2(p), M2(q), and Δb	r and normalised imbalance B	r is determined by Δb and the mantissa ratio.	B is the primary cross-stratum balance statistic; raw mantissa difference is secondary.

records the dependency rules fixed for the analysis.

Quadratic, lambda-compression, landing-index, binary-decimal correlation, and continued-fraction quantities are outside the primary feature family. Their exclusion is substantive rather than cosmetic; retaining algebraically or procedurally dependent metrics would inflate the apparent number of signatures and make the model comparisons difficult to interpret.

4.3. Matched Generative Models

Each historical modulus i defines a target configuration consisting of its provenance stratum, label type and value, and observed factor-bit lengths a_i = b(p_i) and c_i = b(q_i). Synthetic controls are generated separately for every target configuration. The base candidate sets for bit length a are

$${\mathcal{I}}_a^{\left(0\right)}=\left\{x\in \mathbb{Z}:2^{a-1}\le x<2^a,\hspace{0.25em}x\equiv 1\hspace{0.25em}(\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}2)\right\}.$$

$${\mathcal{I}}_a^{\left(H\right)}=\left\{x\in {\mathcal{I}}_a^{\left(0\right)}:x\ge 3\cdot 2^{a-2}\right\}.$$

$${\mathcal{I}}_a^{\left(HR\right)}=\left\{x\in {\mathcal{I}}_a^{\left(H\right)}:x\equiv 2\hspace{0.25em}(\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}3)\right\}.$$

Candidates are sampled independently and uniformly from the applicable admissible integer set and passed through one fixed probable-prime screen. A pair is accepted only when its product has the same label as the historical target: the same decimal digit count for an original list target or the same bit length for a later-list target. Equal-bit pairs are sorted into p ≤ q after acceptance; unequal-bit targets retain the smaller-bit factor as p. Rejection continues until the protocol-fixed number of accepted pairs is reached. This construction conditions all comparisons on the observed discrete factor-bit profile and the public Challenge label while varying only the additional constraints shown in

Table 5. Nested construction models and their role in the analysis.

Model	Additional Constraints	Primary Use	Claim Limit
M0: size-and-label	Exact target factor-bit lengths and exact Challenge label; no high-bit or modulo-3 restriction.	Reference distribution for the all-11 pair count.	A deliberately weak size-conditioned model, not a historical generator reconstruction.
M1: high-bit	M0 plus M2(p), M2(q) ≥ 3/2.	Minimum model for the high-bit family; comparator for the original list residue count.	Represents a broad construction practice shared by multiple procedures.
M2: documented residue	M1 plus p ≡ q ≡ 2 (mod 3) for original decimal-labelled targets. For later targets, M2 reduces to M1.	Comparator for residual factor-balance in the original list.	Represents the documented original list rule, not an implementation identity.
M3: pair selection	M2 plus an explicit prospective pair-level balance acceptance rule.	Follow-up only if M2 is inadequate for the balance statistic.	Not fitted to the Challenge observations in the primary analysis.
M4: implementation specific	A versioned full key-generation path with build, API, exponent, RNG, and rejection behaviour recorded.	Sensitivity and external validation.	May establish similarity to a labelled implementation, but not unique historical attribution.

.

For M0–M2, 10,000 accepted control pairs were generated for each historical target and applicable model. A fixed pool size was used for every target; no target was dropped because of its acceptance rate. The random-stream material, software versions, probable-prime screen, pool-specific seeds, and rejection counts are recorded in Manifest S1. Generation was divided into independently seeded worker chunks solely as a reproducible computational implementation; the target-level pool size and model constraints were unchanged.

A prime-only OpenSSL call may be used as a mechanism of positive control for high-bit behaviour, but it is not an adequate primary comparator for pair-level RSA construction. No OpenSSL or BSAFE implementation baseline is included in the present analysis. Any future implementation comparison should use a fully documented full key-generation path or be explicitly labelled as a single-mechanism sensitivity check. Results are reported by provenance stratum; the 18 original list and 4 later BSAFE moduli are never pooled to increase the apparent sample size.

4.4. Frozen Model Comparisons and Statistics

Three model comparisons were frozen for the matched-control analysis. H1 and H2 are model-adequacy checks whose observed directions were already visible in the historical data; H2 additionally recovers a documented rule. H3 is the only residual balance comparison. Its statistic and lower-tail direction were frozen before matched M2 controls were generated, but it remains exploratory because the earlier draft had already suggested tighter pairing in the adjacent-bit subset.

$$T_H={\displaystyle \sum _{i=1}^{22}}\mathbf{1}\left\{M_2\left(p_i\right)\ge {\displaystyle \frac{3}{2}}\hspace{0.25em}\wedge \hspace{0.25em}{M}_2\left(q_i\right)\ge {\displaystyle \frac{3}{2}}\right\}.$$

$$T_R=\sum _{i\in \mathcal{O}}\mathbf{1}\left\{p_i\equiv q_i\equiv 2\hspace{0.25em}(\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}3)\right\}, \left|\mathcal{O}\right|=18.$$

$$T_B={\mathrm{m}\mathrm{e}\mathrm{d}\mathrm{i}\mathrm{a}\mathrm{n}}_{\hspace{0.17em}i\in \mathcal{O},\hspace{0.25em}{\mathrm{\Delta }}_b\left(N_i\right)=1}{B}_i.$$

The null statement for each comparison is model adequacy: the observed statistic is compatible with pseudo-datasets generated under the stated comparator. Rejection means that the comparator omits a structure relevant to that statistic; it does not prove that the next model is the unique causal mechanism. Conversely, failure to reject is not evidence of equivalence and is interpreted in light of the small historical strata.

4.5. Monte Carlo Inference, Effect Sizes, and Uncertainty

For each comparison, R = 100,000 matched pseudo-datasets were constructed by drawing one complete control pair for every historical target included in that comparison. Draws preserved target identity, factor pairing, factor-bit profile, label type, and provenance. The statistic was recomputed for each pseudo-dataset. Let E_s equal one when pseudo-dataset s produces a statistic at least as extreme as the observed value in the direction fixed in

Table 6. Frozen model comparisons, statistics, and interpretation rules.

Test	Population	Model	Statistic and Tail	Permitted Interpretation
H1	All 22 retained moduli	M0	High-bit pair count; upper tail	If M0 is inadequate, M1 is the minimum supported family-level model. No software attribution follows.
H2	18 original decimal-labelled moduli	M1	Residue-pair count; upper tail	Recovery of the independently documented residue rule supports M2 as the appropriate original list baseline.
H3	Eight original decimal-labelled moduli with Δb = 1	M2	Median B; lower tail	If M2 is rejected in the frozen lower tail, the model underpredicts normalised-mantissa pairing; otherwise, no additional signature is established.

, and zero otherwise. The one-sided Monte Carlo p-value is

$$p_{\mathrm{M}\mathrm{C}}={\displaystyle \frac{1+{\displaystyle {\sum }_{s=1}^R}\mathbf{1}\left(E_s\right)}{R+1}}.$$

The +1 correction ensures that a Monte Carlo p-value is never reported as zero [19]. If no pseudo-dataset is at least as extreme as the observation, the corrected value is reported at the simulation resolution, 1/(R + 1), together with the number of simulated exceedances and a binomial interval for Monte Carlo uncertainty; it is not interpreted as an exact historical process probability. An independent rerun with a second recorded seed is required for any result whose adjusted p-value lies between 0.04 and 0.06.

Every comparison is accompanied by the observed statistic, the median and central 95% interval of its matched model distribution, and a directionally interpretable effect size:

$${\delta }_T=T_{\mathrm{o}\mathrm{b}\mathrm{s}}-\mathrm{m}\mathrm{e}\mathrm{d}\mathrm{i}\mathrm{a}\mathrm{n}\left(\tilde{T}\right), {\rho }_B={\displaystyle \frac{T_{B,\mathrm{o}\mathrm{b}\mathrm{s}}}{\mathrm{m}\mathrm{e}\mathrm{d}\mathrm{i}\mathrm{a}\mathrm{n}\left({\tilde{T}}_B\right)}}.$$

For H1 and H2, the count difference and observed model percentile are reported. For H3, a negative δT and ρB below one indicate tighter pairing than the M2 median. The Monte Carlo standard error and a 95% binomial interval for the Monte Carlo p-value are also reported. Descriptive factor summaries use the median, interquartile range, and full range because the historical strata are small and no normal approximation is assumed.

The 22 retained moduli form the complete frozen set meeting the inclusion criteria, not a random sample from a defined finite population. Exact feature counts therefore receive no routine binomial confidence interval. Any generalisation to an unobserved historical generation process is model based and rests, if at all, on the matched-control comparisons rather than on nominal confidence intervals around the complete-set counts.

4.6. Multiplicity and Decision Rules

H1–H3 constitute one frozen comparison family for multiplicity adjustment. Their Monte Carlo p-values are adjusted by the Holm step-down procedure to control the familywise error rate at 0.05 without requiring independence [20]. The directions in Table 6 were fixed before generation or inspection of the new matched-control outputs; the opposite tail is not tested after the results are seen. Adjusted p-values, unadjusted p-values, effect sizes, and matched-model intervals are all reported, and no conclusion is based on a threshold alone.

Secondary analyses comprise the equal-bit original list subset, the four-modulus later BSAFE case series, the raw absolute mantissa difference, the factor ratio, and the relative AM-GM transformation. They are reported as descriptive or sensitivity checks and cannot alter the primary H1–H3 conclusions. No additional confirmatory multiplicity family is defined. Deterministic identities and positive-control consequences receive no p-value and do not enter multiplicity counts.

Claim language follows the evidence hierarchy. A supported H1 permits the statement that high-bit conditioning is needed in the minimum adequate family model. A supported H2 permits the statement that the documented original list residue rule is recoverable from the factors. A supported H3 permits only the statement that M2 underpredicts the observed degree of adjacent-bit normalised-mantissa pairing. None permits an assertion about exact BSAFE or RSA DSP source code, candidate increments, random seeds, primality-test internals, key weakness, or factorisation difficulty.

4.7. Sensitivity Analyses and Protocol Deviations

The H3 result was recomputed after omitting each of the eight adjacent-bit moduli in turn. A conclusion that reversed under one omission would be reported as leave-one-out unstable. The raw absolute mantissa difference was evaluated as a secondary statistic, and factor-ratio and relative AM-GM summaries were retained to make the magnitude of the effect interpretable. These alternatives did not replace B_i as the primary balance statistic.

The retained sensitivity analysis repeats the 100,000 matched pseudo-dataset draws with an independently derived random stream while holding the archived primary M0–M2 control pools fixed. This evaluates Monte Carlo draw stability, not independent control-generation stability. A provisional full-control replication could not be retained and independently re-audited, and fresh regeneration was not completed; Protocol Amendment S2 therefore excludes all such values and claims. Implementation-specific controls remain separate from the algorithm-neutral rejection-sampling controls. RSA-129 remains an external contrast, and the four later BSAFE moduli remain descriptive.

Any deviation from Protocol S1 must be recorded with a new version number, date, reason, affected hypotheses, and a statement of whether the relevant control outputs or test statistics had already been inspected. The unchanged protocol and every amendment are retained with the Supplementary Material. This audit trail is necessary because the paper’s central methodological claim depends on separating exact observations from model choices made after observation.

Two implementation and reporting deviations are disclosed. Protocol Amendment S1 excludes an initial software-validation run whose source-to-output provenance could not be certified and records the fresh-process chunking used for the definitive primary run. Protocol Amendment S2 records that a provisional full-control replication could not be retained and re-audited, and that a fresh regeneration did not complete; all full replication values and claims were therefore removed. The retained sensitivity check repeats the 100,000 pseudo-dataset draws with an independently derived seed from the unchanged, quality-audited primary pools. Neither amendment changes the historical populations, M0–M2 models, accepted pair counts, primary statistics, test directions, Holm adjustment, or claim boundaries.

4.8. Fixed Results Order

To prevent selective emphasis, Section 5 reports results in the following order: (i) exact high-bit, bit length, residue, and discrete balance observations; (ii) the H1 size-and-label model check; (iii) the H2-documented residue-positive control; (iv) continuous factor-balance summaries by provenance and bit-allocation stratum; (v) the H3-matched M2 comparison; (vi) secondary and sensitivity analyses; and (vii) the evidential limits implied by Table 3, Table 4, Table 5 and Table 6. Results not defined in the protocol are identified as post hoc and cannot alter the primary conclusions.

5. Results

The results follow the order fixed in Section 4. The historical observations were recomputed from Data S1, and the primary model comparisons were generated from 62 target model pools containing 10,000 accepted factor pairs each. The primary archive therefore contains 620,000 accepted pairs. These required 775,259 complete pair draws, of which 155,259 were rejected because the product did not match the target Challenge label. No target or model pool was omitted. Control QC S1 confirmed 10,000 rows in every primary pool, universal high-bit compliance in M1 and M2, and universal modulo-3 compliance in M2. The primary manifest records a Code S3 hash matching the delivered source. The inferential distributions used 100,000 matched pseudo-datasets. A separately seeded pseudo-dataset rerun used the unchanged primary pools to assess Monte Carlo draw stability; it was not an independent control-generation replication.

5.1. Exact Arithmetic Observations

The exact corpus-level results are summarised in

Table 7. Exact high-bit, bit-allocation, and residue observations in the retained dataset.

Observation	Scope	Result	Evidential Treatment
Both factors have binary prefix 11	22 moduli/44 factors	22/22 pairs; 44/44 factors	E1 exact observation; motivates M1.
Product bit length equals the sum of factor-bit lengths	22 moduli	22/22	Derived from high-bit conditioning; no separate test.
Equal/adjacent factor-bit allocation	14 even-bit; 8 odd-bit moduli	14 equal-bit; 8 adjacent-bit pairs	Discrete factor-balance description; parity consequence.
Both factors are 2 modulo-3	18 original decimal-labelled moduli	18/18	E2 recovery of a documented rule.
A2 − N is divisible by 9	18 original decimal-labelled moduli	18/18	Algebraic consequence of the common modulo-3 rule.

. Every retained factor begins with binary prefix 11; the normalised binary mantissas range from 1.50597 to 1.99753. All 22 products satisfy b(N) = b(p) + b(q). The 14 even-bit moduli have equal factor-bit lengths, whereas the eight odd-bit moduli have adjacent factor-bit lengths. This parity pattern is not counted as independent evidence because it follows from the high-bit condition together with the observed balanced bit allocation.

All 18 original decimal-labelled pairs satisfy p ≡ q ≡ 2 (mod 3). Consequently, all 18 also satisfy the derived Fermat-square condition A² − N ≡ 0 (mod 9). The four later bit-labelled moduli are not included in that residue claim: two have residue pair (1, 2) modulo-3 and two have (2, 2). Because the retained 22 moduli constitute the complete frozen inclusion set rather than a random sample from a defined finite population, these exact counts are reported without routine binomial confidence intervals.

5.2. H1 and H2 Model Checks

Table 8. Matched model comparison results. Intervals are central 95% intervals of the simulated statistic, not confidence intervals for the historical counts.

Test	n	Observed	Matched Median (95% Interval)	Monte Carlo p; Holm p	Interpretation
H1: high-bit pair count	22	22	8 [7,12]	1.00 × 10−5; 3.00 × 10−5	M0 inadequate; high-bit conditioning required at family level.
H2: (2, 2) modulo-3 pair count	18	18	4 [1,2]	1.00 × 10−5; 3.00 × 10−5	Documented original list rule recovered; positive control.
H3: median normalised imbalance B	8	0.0680	0.1216 [0.0463, 0.2236]	0.1007; 0.1007	M2 not rejected; no additional pair-balance signature established.

shows a summary of H1 and H2 model checks. For H1, the observed high-bit pair count was T_H = 22. Under M0, the matched pseudo-dataset distribution had median 8 and central 95% interval [7,12]; its maximum among 100,000 pseudo-datasets was 18. The count difference from the matched median was +14, and no pseudo-dataset reached the observation. The corrected Monte Carlo p-value was 1.00 × 10⁻⁵ (95% Monte Carlo interval [1.00 × 10⁻⁵, 4.69 × 10⁻⁵]), and the Holm-adjusted p-value was 3.00 × 10⁻⁵. Thus, size and public-label conditioning alone are inadequate for the all-11 pattern. M1, or an observationally equivalent high-bit selection rule, is the minimum supported construction-family model. The result does not distinguish among implementations that impose the same condition.

For H2, the observed original list residue-pair count was T_R = 18. Under M1, the matched median was 4 with a central 95% interval [1,2]; the simulated maximum was 14. The count difference from the matched median was +14, and no pseudo-dataset reached the observation (Monte Carlo p = 1.00 × 10⁻⁵; 95% Monte Carlo interval [1.00 × 10⁻⁵, 4.69 × 10⁻⁵]; Holm-adjusted p = 3.00 × 10⁻⁵). This result recovers independently documented metadata and therefore functions as a positive control for the provenance method. It supports M2 as the appropriate original list comparator but is not presented as a newly discovered historical rule.

5.3. Discrete and Continuous Factor-Balance

Discrete factor-balance is exact: 14 pairs have equal factor-bit lengths and eight have adjacent factor-bit lengths. Within the original decimal-labelled population, ten pairs are equal-bit and eight are adjacent-bit; all four later bit-labelled pairs are equal-bit.

Table 9. Historical factor-balance summaries by provenance and discrete bit allocation. Parentheses give the interquartile range (IQR) for B and the full range for r and D_AG.

Stratum	n	Median B (IQR)	Median q/p (Range)	Median D_AG (Range)
Original, equal-bit	10	0.1944 (0.0695, 0.2378)	1.1442 (1.0386, 1.2904)	0.00227 (0.00018, 0.00813)
Original, adjacent-bit	8	0.0680 (0.0581, 0.0913)	2.0544 (1.8431, 2.2437)	0.06551 (0.04710, 0.08275)
Later bit-labelled	4	0.1882 (0.1527, 0.2252)	1.1396 (1.0976, 1.1876)	0.00218 (0.00108, 0.00370)

reports the corresponding continuous summaries. The normalised imbalance B removes the planned zero- or one-bit step, so its values can be compared across the equal- and adjacent-bit strata. The factor ratio and relative AM-GM gap are included only as interpretable transformations.

The adjacent-bit original list pairs have median B = 0.0680, compared with 0.1944 in the equal-bit original list subset. This descriptive difference does not itself establish a distinct pair-selection mechanism: the primary question is whether the adjacent-bit value is unusually low after matching the high-bit, residue, factor-bit, and label constraints in M2.

5.4. H3: Residual Adjacent-Bit Pairing

The H3 statistic for the eight adjacent-bit original list moduli was T_B = 0.0680. The M2 pseudo-dataset distribution had median 0.1216 and central 95% interval [0.0463, 0.2236]. The frozen lower-tail comparison did not reject M2 (Monte Carlo p = 0.1007; Monte Carlo 95% interval [0.0989, 0.1026]); the Holm-adjusted value was also 0.1007. The observed statistic lay within the central 95% model interval.

The retained raw-mantissa sensitivity analysis, independently seeded pseudo-dataset rerun from the same audited pools, and leave-one-out analyses gave the same substantive conclusion. The present data therefore do not establish a residual adjacent-bit balance signature. Failure to reject M2 is not evidence of equivalence, but the result does not support “tight odd-bit pairing” as a separate construction-family signature.

5.5. Secondary and Sensitivity Analyses

Table 10. Secondary and sensitivity checks for factor-balance.

Analysis	Observed	Matched Summary	Model-Relative Result	Conclusion
Raw |M2(q) − M2(p)|, adjacent-bit	0.0849	Median 0.1476; 95% [0.0566, 0.2701]	Lower-tail p = 0.1099	Same conclusion as H3; no separate signature.
Independent pseudo-dataset rerun	0.0680	Median 0.1218; 95% [0.0466, 0.2229]	Lower-tail p = 0.1003	Monte Carlo draw stability; same archived control pools.
H3 leave-one-out	[0.0596, 0.0764]	Medians [0.1210, 0.1215]	p range [0.0900, 0.1835]	No single modulus creates or reverses the conclusion.
Original equal-bit subset	0.1944	Median 0.1223; 95% [0.0520, 0.2141]	Percentile = 93.9%	Descriptive; lies toward the high-imbalance side.
Later bit-labelled case series	0.1882	Median 0.1250; 95% [0.0340, 0.2550]	Percentile = 83.3%	Descriptive only; n = 4.

provides a summary of the secondary and sensitivity checks for factor-balance. The raw absolute mantissa-difference sensitivity produced the same substantive conclusion: observed median 0.0849, matched median 0.1476, and lower-tail p = 0.1099. Repeating the 100,000 matched pseudo-dataset draws with an independently derived seed, while holding the archived primary pools fixed, yielded H3 p = 0.1003 and matched median 0.1218. This checks Monte Carlo draw stability rather than independent control-generation stability. Across the eight leave-one-out analyses, lower-tail p-values ranged from 0.0900 to 0.1835; no omission moved the result below 0.05.

The equal-bit original list subset had observed median B = 0.1944, with a percentile rank of 93.9% in its M2 descriptive distribution. The four later bit-labelled moduli had median B = 0.1882, with a percentile rank of 83.3% in their M1 distribution. Neither comparison was designated as a primary test. In particular, the four-modulus later-list case series is too small to support a distributional or implementation-attribution conclusion.

5.6. Evidential Limits of the Results

The results support two bounded conclusions. First, the all-11 property requires a construction-family model with high-bit conditioning or an observationally equivalent selection rule; size and public-label matching alone are inadequate. Second, the original list factors recover the independently documented common residue rule. The analysis does not support a third, independent adjacent-bit pairing signature after the documented constraints are modelled. For H3, the observed statistic lies within the central M2 interval, and the frozen lower-tail comparison does not reject M2.

These conclusions remain at E1–E3 in the hierarchy of Table 3. They do not identify RSA DSP, BSAFE, OpenSSL, or any other exact implementation; they do not reconstruct seeds, candidate increments, sieving, or retry paths; and they do not imply that the Challenge moduli are weak. The results instead show which final factor properties are exact, which recover historical metadata, which are algebraically dependent, and which do not survive a matched construction-family comparison.

6. Discussion

The analysis distinguishes exact observations, independently documented rules, model-relative construction-family inferences, and algebraic restatements of the same underlying constraints. It supports two bounded findings and does not support a third: high-bit conditioning is required to explain the corpus-level all-11 pattern after size and public-label matching; the original list modulo-3 rule is recovered as a documented positive control; and the adjacent-bit pairing contrast does not establish a separate factor-balance signature after the documented constraints are modelled. This section interprets those findings at the evidential levels fixed in Table 3.

6.1. High-Bit Conditioning as a Broad Construction-Family Signature

The strongest model-relative result is the high-bit comparison. Every retained factor begins with binary prefix 11, so all 22 historical pairs satisfy the pair-level high-bit condition. M0 already conditions on the observed factor-bit lengths and the public Challenge label, making it materially stronger than an unconditioned uniform-mantissa calculation. Those constraints increase the chance of high leading bits for some targets, which is why the M0 pseudo-dataset median is 8 rather than the 5.5 pairs suggested by a naive one-quarter pair probability. Even under that matched baseline, however, the observed count of 22 lies beyond the simulated range used for inference, and H1 has Holm-adjusted p = 3.00 × 10⁻⁵. The appropriate conclusion is that a size-and-label-only model omits a systematic high-bit restriction.

That conclusion remains family level. Setting the two highest candidate bits is one direct mechanism, and OpenSSL documents such behaviour for BN_generate_prime_ex2 when add is NULL [6]. High-bit conditioning is also compatible with standardised prime-generation practice [5]. Nevertheless, final factors alone cannot distinguish explicit candidate-bit setting from an equivalent admissible range, prime selection from the top quarter of each bit interval, or a pair-level acceptance rule that produces the same outputs. H1 therefore supports M1, or an observationally equivalent construction family, but it does not identify RSA DSP, BSAFE, OpenSSL, or any particular source-code path.

The product-bit and parity observations should be interpreted as consequences of this condition rather than as independent discoveries. Once both normalised factor mantissas are at least 3/2, their product exceeds 2 and b(N) = b(p) + b(q). With the observed balanced factor-bit allocation, equal factor-bit lengths follow for even-bit moduli and adjacent factor-bit lengths follow for odd-bit moduli. Counting the all-11 property, the product-bit identity, and the parity pattern as three signatures would therefore triple-count one construction constraint. The dependency-aware treatment is central to the paper: a visually distinct pattern is not additional evidence when it is mathematically forced by variables already in the model.

Nor does the high-bit result imply cryptographic weakness. Top-bit conditioning helps control prime and modulus size and is compatible with ordinary RSA generation practice [5,6]. The inference concerns how candidate space was restricted, not whether the resulting moduli are easier to factor. No factoring algorithm, secret exponent, shared-prime defect, or exploitable bias is established by H1.

6.2. Residue Constraints as a Documented Positive Control

The modulo-3 result has a different evidential character. All 18 original decimal-labelled pairs have both factors congruent to 2 modulo-3. Under M1, which includes the supported high-bit condition but not the historical residue rule, the matched pseudo-dataset median is 4, and the central 95% model interval is [1,2]. The observed count of 18 gives Holm-adjusted p = 3.00 × 10⁻⁵. Unlike the high-bit mechanism, the relevant historical rule is independently stated in the original Challenge record [2]. The factor analysis therefore recovers known construction metadata rather than inferring an undocumented mechanism solely from the outputs.

This positive control serves two purposes. Substantively, it shows that a deliberate compatibility rule can remain visible in the final factors decades after the generation environment has disappeared. Methodologically, it demonstrates that the matched model hierarchy can distinguish a known rule from the broader high-bit family. It does not validate every other proposed provenance feature: each additional claim still requires its own independent documentation or residual model comparison.

The scope of the residue conclusion is limited to the original decimal-labelled population. The four later bit-labelled BSAFE moduli contain two (1, 2) and two (2, 2) residue pairs modulo-3, and no source in the frozen record establishes the same common residue rule for that generation process [3]. Pooling the strata would therefore erase a documented provenance difference. Likewise, condition A² − N ≡ 0 (mod 9) in the original group is not a further signature; it follows exactly because q − p is divisible by 6. The modulo-3 rule is the evidence; the Fermat-square residue is its consequence.

6.3. Factor-Balance and the Unsupported Third Signature

Factor-balance requires a separation between planned bit allocation and residual within-interval pairing. The observed factor ratio is naturally near one for equal-bit pairs and near two for adjacent-bit pairs. The relative AM-GM gap is a one-to-one transformation of that ratio, so its separated bands mainly restate the discrete bit allocation and continuous ratio. They are useful descriptions of magnitude, but they do not provide independent evidence about a generator once those underlying variables are included.

The H3 statistic removes the zero- or one-bit allocation step and compares normalised mantissa balance within the eight adjacent-bit original list pairs. Their observed median B = 0.0680 was below the M2 median of 0.1216, but it lay within the central 95% M2 interval, and the frozen lower-tail comparison did not reject M2 (p = 0.1007). The raw-mantissa sensitivity, independently seeded pseudo-dataset rerun from the same audited pools, and all leave-one-out analyses gave the same substantive conclusion. The present data therefore do not establish a residual adjacent-bit balance signature.

This result should not be described as evidence that the historical generator did or did not deliberately pair mantissas. Failure to reject M2 is not proof of equivalence, and eight pairs provide limited power for a modest residual effect. It does establish the manuscript-level claim boundary: the present data and model do not justify retaining tight adjacent-bit pairing as a third construction-family signature. The descriptive contrast is suitable for a future labelled study, not for an attribution claim in this paper.

6.4. Evidential Synthesis and Claim Boundaries

Table 11. Evidential synthesis of the retained construction features.

Feature	Observed and Model-Relative Result	Status	Strongest Defensible Interpretation
High-bit condition	22/22 pairs; H1 M0 median 8 [7,12]; Holm p = 3.00 × 10−5	E1 + E3	A broad high-bit restriction, or an observationally equivalent selection rule, is required. Exact implementation attribution is not supported.
Product bit length and parity	22/22 satisfy b(N) = b(p) + b(q); 14 equal-bit and 8 adjacent-bit pairs	Derived	A consequence of high-bit conditioning plus balanced bit allocation, not an additional signature.
Original list modulo-3	18/18 pairs; H2 M1 median 4 [1,2]; Holm p = 3.00 × 10−5	E2 + E3 positive control	The documented original list compatibility rule is recoverable. It is not generalised to the later BSAFE group.
Fermat-square modulo-9	18/18 original pairs	Derived	An exact consequence of the common modulo-3 rule, not independent evidence.
Adjacent-bit balance	Median B = 0.0680 versus M2 median 0.1216; p = 0.1007	E1 + exploratory check	No separate factor-balance signature is established; failure to reject is not evidence of equivalence.
Later BSAFE case series	Four solved bit-labelled moduli	E1 descriptive only	The sample is insufficient for a distributional or implementation-attribution conclusion.

clarifies why the term construction-family signature is used narrowly. The high-bit result reaches E3 because a matched size-and-label model is inadequate, but the mechanism remains non-identifiable. The original list residue result reaches E2 through independent historical documentation, and the observed count lies beyond the simulated M1 range. The other prominent patterns are either deterministic consequences or insufficiently supported residual contrasts. No result reaches E4 implementation attribution.

6.5. Relation to Public-Key Implementation Forensics

Prior public-key studies show that large labelled corpora can expose shared prime failures, implementation biases, and likely library origins [7,8,9,10]. The present study addresses a complementary setting. Because the Challenge factors are known, candidate-range, congruence, and pair-balance properties can be examined directly; however, the corpus is far smaller and is not a sample of deployed keys. The evidential advantage of factor visibility is therefore accompanied by a severe limitation in sample size and population breadth.

The comparison also shows why the word fingerprint is avoided for the retained findings. Implementation attribution normally requires labelled examples from competing generators, features that remain discriminative across versions and configurations, and out-of-sample performance estimates [9,10]. Here, high-bit conditioning is deliberately broad, the original list residue rule is documented at the population level, and the later BSAFE stratum contains only four solved cases. These conditions support historical construction-family inference but not classification of an unknown key to a unique library or device.

Operationally, the factor-level method is best understood as cryptographic forensics for known-factor corpora, test keys, or authorised key-generation validation environments. It is not a public-only scanner for ordinary unfactored RSA moduli. In deployed systems, p and q are normally secret and may be non-exportable from a hardware security module. Any practical assurance workflow would therefore require authorised factor-level computation inside the trusted boundary or access to independently generated test artefacts. Those deployment questions are outside the empirical scope of this historical study.

6.6. Methodological Implications

Three methodological lessons follow. First, controls should match the public selection problem. Exact factor-bit lengths and Challenge labels materially affect leading-bit probabilities, so a naive independence calculation is inadequate as the principal baseline. Second, the modulus is the statistical unit. Resampling complete pairs preserves the dependence between p and q and avoids overstating precision through 44 nominally independent factor observations. Third, evidence should be dependency-aware. Product-bit parity, AM-GM bands, and Fermat-square residues remain useful explanatory quantities, but they do not multiply the amount of evidence when they are determined by primary features.

The H3 outcome also illustrates the value of a frozen analysis plan even when full preregistration is impossible. The historical factors had already been inspected, so the protocol does not turn the study into a prospective experiment. It does, however, prevent the newly generated controls from being searched across changing statistics, tails, and subgroup definitions until a preferred result appears. Recording H3 as unsupported, despite a lower observed median, is a substantive result of that discipline.

Finally, reproducibility is part of the evidential claim. The supplementary package records the exact tuples, validation code, model definitions, pool-generation code, accepted control pools, manifests, quality control output, inference results, protocol amendments, and hashes. The independently seeded rerun checks pseudo-dataset draw stability from the same pools. It does not replace an independently regenerated control archive, and the manuscript states that limitation directly.

The method has bounded relevance to critical infrastructure assurance. In authorised known-factor corpora or controlled key-generation test environments, dependency-aware factor analysis may support provenance assessment and validation of documented generation constraints. It does not provide a public-key scanner or an operational governance control.

High-bit conditioning is treated here as a generic construction-family feature consistent with documented RSA prime-generation practices, including FIPS 186-5 and OpenSSL [5,6]. The matched-model p-values are conditional on the control families defined in the protocol and should not be interpreted as unconditional historical probabilities. The present analysis does not include a modern OpenSSL- or BSAFE-based full key-generation baseline. Such an implementation-specific sensitivity analysis remains future work and would require a versioned build and API path, public exponent, random-number-generation and seeding procedure, factor-size allocation, rejection behaviour, sample size, and archived outputs.

Overall, the study demonstrates a dependency-aware forensic method on a small historical dataset and retains only conclusions consistent with known or generic RSA construction practices. It neither claims previously unknown RSA Challenge structure nor provides a public-key scanner, governance control, weak-key detector, or implementation-attribution classifier. Such applications would require substantially larger labelled generator corpora and rigorous out-of-sample validation.

7. Limitations and Future Validation

7.1. Historical Corpus and Selection

The study population is a small historical corpus selected by complete factorisation. The 22 included moduli are the complete frozen set meeting the stated criteria, but they are not a random sample from a defined generator output stream. Selection by solved status truncates the available size and time range and may omit later construction variants. Because inclusion depends on successful factorisation, the observed all-11 frequency could be biased if solved and unsolved Challenge numbers differ systematically in generation era, modulus size, or construction practice. The available data cannot test that possibility. The population also combines 18 original decimal-labelled entries with only 4 later bit-labelled BSAFE entries. The provenance partition prevents inappropriate pooling, but it leaves the later stratum too small for stable distributional inference.

RSA-129 is excluded for the provenance reasons stated in Section 3.3. Consequently, the analysis does not describe all numbers commonly grouped under the broad “RSA numbers” label. More generally, the conclusions apply to the retained formal Challenge entries and should not be generalised automatically to unsolved Challenge numbers, other historical puzzles, modern RSA libraries, or deployed keys.

The exact factors were transcribed from public compilations and cross-checked against primary factorisation reports where available. Exact multiplication, label checks, and independent probable-prime screens reduce transcription risk, but the supplementary package does not contain formal primality certificates for every factor. Future archival work could replace compilation-level sourcing with a complete primary-source chain and machine-verifiable certificates.

7.2. Causal Non-Identifiability

Final prime factors do not preserve a unique record of the candidate-generation path. Explicit top-bit setting, range-restricted sampling, and pair-level rejection can produce the same all-11 output. Even where the modulo-3 rule is documented, the factors do not reveal the random seed, initial candidates, sieve state, primality-test bases, increment strategy, or retry history. Most original RSA DSP and BSAFE implementation details needed for an exact reconstruction are unavailable in the frozen record. Consequently, the analysis identifies compatible construction families rather than causal source code.

M3 and M4 were intentionally not fitted in the primary analysis. An implementation-specific comparison would require preserved or reconstructed historical software, fully described modern generators, labelled outputs, and sensitivity to version and configuration changes. Without those elements, a more detailed simulation could appear mechanistic while remaining weakly identified by the final factors.

7.3. Model Dependence, Power, and Multiplicity

The Monte Carlo p-values are conditional on M0–M2. These models match factor-bit lengths, public labels, high-bit restrictions, and, where applicable, the documented modulo-3 rule, but they use one algorithm-neutral rejection-sampling procedure and one fixed, probable prime screen. They are not replicas of the historical generators. A rejected model identifies an omitted structure relative to that model; it does not prove that the next model is the only explanation.

H1 and H2 yield large model contrasts, but their historical directions were visible before the protocol was frozen. H3 was also motivated by the earlier exploratory draft and remains exploratory despite the frozen matched-control statistic and tail. With only eight adjacent-bit original pairs, the analysis may miss a modest residual pairing effect. Conversely, the visibly lower median cannot be promoted to a signature merely because the sample is small. The correct conclusion is that the present comparison is inconclusive for such an effect and does not reject M2.

Holm adjustment controls the frozen H1–H3 comparison family, but secondary subgroup percentiles, raw-mantissa differences, factor ratios, and AM-GM summaries are descriptive or sensitivity analyses. They should not be interpreted as a second set of confirmatory tests. Finite Monte Carlo resolution and simulation uncertainty are reported, but they are smaller concerns than historical model uncertainty and limited sample size.

7.4. Computational Replication

The primary archive contains 620,000 accepted pairs and passed the recorded constraint and manifest checks. A second random stream reproduced the pseudo-dataset inference from the same archived pools. However, an independently regenerated full control archive was not retained or re-audited, and a fresh regeneration was not completed. Protocol Amendment S2 therefore removes any claim of independent control-generation replication. Third-party regeneration from Code S3 and Protocol S1 remains an important validation step, especially before extending the method to finer or implementation-specific distinctions.

7.5. Operational and Security Scope

The primary features require knowledge of p and q. They cannot generally be computed from an unfactored public modulus and therefore do not provide a public monitoring method for ordinary RSA deployments. Access to factors may also be restricted by key custody rules or hardware security modules. The paper does not test an operational audit workflow, classifier, incident-response procedure, or governance control.

No observed feature is shown to reduce factoring resistance. High-bit conditioning and balanced factors are ordinary size-control practices; the original modulo-3 rule concerns public-exponent compatibility. The study does not identify shared primes, small secret exponents, Coppersmith-type structure, or another exploitable defect. Results should therefore be described as provenance and construction evidence, not weak-key detection.

7.6. Priorities for Future Validation

The strongest future test is genuinely out-of-sample. Any newly factored formal Challenge entry should be processed with the frozen feature definitions before the protocol is changed. A complementary study should generate large labelled corpora through complete RSA key-generation paths from multiple libraries, versions, public exponents, and configurations; reserve untouched versions for external testing; and report classification error, calibration, and failure modes rather than only within-sample contrasts. A first implementation-specific sensitivity study should include a fully specified OpenSSL full-key-generation baseline, archive all configuration and output artefacts, and present it as a contemporary comparator rather than a reconstruction of the historical RSA Challenge process.

Mechanism-focused work should compare explicit top-bit setting, range restriction, pair-level product rejection, and candidate-increment procedures that are observationally equivalent at the coarse feature level. Such work should preregister discriminating statistics before inspecting labelled test outputs. For factor-balance, a larger adjacent-bit population is needed to determine whether the observed lower median represents a reproducible residual effect or ordinary variation under the documented constraints.

8. Conclusions

The solved RSA Challenge moduli preserve arithmetic evidence of their construction, but the strength of that evidence differs by feature. Across the 22 retained formal Challenge entries, all 44 factors begin with binary prefix 11. A matched size-and-label model does not account for the fact that all 22 pairs satisfy the high-bit condition, supporting a broad construction family with high-bit conditioning or an observationally equivalent selection rule. That condition also explains why product bit length equals the sum of factor-bit lengths and, together with balanced factor-bit allocation, why even-bit moduli have equal-bit factors while odd-bit moduli have adjacent-bit factors. These derived patterns are explanatory consequences, not additional signatures.

For the 18 original decimal-labelled entries, both factors are congruent to 2 modulo-3 in every pair. The observed count lies beyond the simulated high-bit-model range and reproduces an independently documented public-exponent compatibility rule. It is therefore a historically specific, positive control rather than a newly inferred construction rule. Its Fermat-square modulo-9 consequence does not add independent evidence, and the mixed residues of the four later BSAFE entries prevent generalisation across provenance strata.

The factor-balance analysis does not establish a third signature. For the eight adjacent-bit original pairs, the H3 statistic lay within the central M2 interval, and the frozen lower-tail comparison and all retained sensitivity checks did not reject the documented-residue model. The analysis therefore establishes no residual adjacent-bit balance signature and supports no mechanism or attribution claim.

The principal contribution is therefore methodological as well as historical. Exact observations, documented rules, matched family-level inferences, and implementation attribution are kept distinct; complete factor pairs are the statistical units; and algebraically dependent quantities are not counted as multiple discoveries. Under that framework, the evidence supports high-bit conditioning and recovery of the original list residue constraint, but not unique software attribution, candidate path reconstruction, public-only diagnosis, weak-key detection, or reduced factoring resistance. Future work should preserve these claim boundaries while testing the frozen features on newly available Challenge factors and on large, fully labelled generator corpora.