RSA security relies on the difficulty of

1. RSA's security assumption: given $n = p \cdot q$ (the product of two large primes), recovering $p$ and $q$ is COMPUTATIONALLY HARD for large $n$. 2. Modern recommendation: $n$ of at least 2048 bits (3072 bits for long-term security). 3. Without solving the factoring problem, an attacker can't derive the private key from the public key. 4. THREAT: large-scale quantum computers could break RSA via Shor's algorithm — driving the move to POST-QUANTUM cryptography (lattice-based). 5. Other options have no relation to RSA's mathematical foundation. _Source: Boneh & Shoup, "A Graduate Course in Applied Cryptography", §10.2 (RSA)._