I think you're looking for the large formula at the top here: https://en.wikipedia.org/wiki/General_number_field_sieve

Reference to a scientific paper is given: https://www.ams.org/notices/199612/pomerance.pdf

That's referring to attacking the factoring problem, which is one method of attacking RSA, and as I said is known to be faster than exponential, but it felt like the comment to which I was replying was talking about something other than just faster factoring.

I know there are other attacks on RSA, I was interested to know if the poster to whom I was replying knew of any others (other than factoring, which is kinda obvious). After all, I said:

> I know that factoring (which attacks RSA) is sub-exponential, ...

Check out the ROCA attack:

www.techtarget.com/cybersecurity/tip/The-ROCA-vulnerability-How-it-works-and-what-to-do-about-it%3famp=1

In practice it was confined to specific TPM modules, but in principle it shows how one flaw in the RNG can jeopardize the whole system.

I also remember seeing a similar vuln in certificates where an attacker _generated_ millions of certs and was able to somehow get the private cert by trying every possible seed for the RNG. (Like seeding every second from 2003-2011 for example, then generating a cert with it). I know I'm getting major parts of this wrong but it conveys the general idea.

Return of Coppersmith Attack is, as the name suggests, a really old attack whose fix has been known for a decades but was missed in certain newer implementations. It does indeed underscore how RSA is tricky and you shouldn't do it yourself. Everything has to go right for it to be secure, unlike something like AES which doesn't have such subtle failure modes.

Super ... thank you.