An Advantage of Low-Exponent RSA with Modulus Primes Sharing Least Significant Bits

Abstract

Let N = pq denote an RSA modulus of length n bits. Call N an (m – LSbS) RSA modulus if p and q have exactly m equal Least Significant (LS) bits . In Asiacrypt &98, Boneh, Durfee and Frankel (BDF) described several interesting ‘partial key exposure’ attacks on the RSA system. In particular, for low public exponent RSA, they show how to recover in time polynomial in n the whole secret-exponent d given only the n/4 LS bits of d. In this note, we relax a hidden assumption in the running time estimate presented by BDF for this attack. We show that the running time estimated by BDF for their attack is too low for (m — LSbS) RSA moduli by a factor in the order of 2m. Thus the BDF attack is intractable for such moduli with large m. Furthermore, we prove a general related result, namely that if low-exponent RSA using an (m – LSbS) modulus is secure against poly-time conventional attacks, then it is also secure against poly-time partial key exposure attacks accessing up to 2m LS bits of d. Therefore, if low-exponent RSA using (n/4(1 2013; E) – LSbS) moduli for small E is secure, then this result (together with BDF’s result on securely leaking the n/2 MS bits of d) opens the possibility of fast and secure public-server-aided RSA decryption/signature generation.