How did they factor RSA 240?

Question

Since NFS runs in essentially $n^{1/3}$ time, and RSA-240 is a composite of two 120-digit primes, shouldn't this have taken at least $10^{40}$ operations, not including any overhead? Even if you could do say $10^{20}$ ops / s as modern supercomputers can almost do, this still should have taken essentially $\infty$ years. So what is this massive speedup I'm missing?

Answer 1

$\exp((\log n)^{1/3})\neq n^{1/3}$.

If you work through the formula for $L[\tfrac{1}{3},1.92]$ and set the $o(1)$ term to $0$, you get $2.4\cdot 10^{23}$ operations for $n\approx 10^{240}$.

The reported computation was 900 core years on a 2.1 GHz CPU, which is about $6\cdot 10^{19}$ cycles, which is much closer. Bear in mind that asymptotic notation can hide factors that actually make the result smaller sometimes.