Decryption Exponent Research Articles

New partial key exposure attacks on RSA with additive exponent blinding

Partial key exposure attacks present a significant threat to RSA-type cryptosystems. These attacks factorize the RSA modulus by utilizing partial knowledge of the decryption exponent, which is typically revealed by side-channel attacks, cold boot attacks, etc. In practice, the RSA implementations typically employ countermeasures to resist physical attacks, such as additive exponent blinding d′=d+rφ(N)\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$d' = d + r \\varphi (N)$$\\end{document} with unknown random blinding factor r. Although there are a couple of partial key exposure attacks on blinding RSA, these attacks require a considerable amount of leakage and fail to work when e is up to full size. In this paper, we propose new partial key exposure attacks on RSA with additive exponent blinding, focusing on leakage scenarios where the Most Significant Bits (MSBs) or Least Significant Bits (LSBs) of d′\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$d'$$\\end{document} are revealed. For the case where e is small, we first recover partial information of p by solving the quadratic congruence equation, and then find the small roots of the integer equation to recover entire private key. Our method relaxes the attack requirements, for instance, we reduce the amount of MSBs for a successful attack from 75 to 25% when e≈N0.25\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$e \\approx N^{0.25}$$\\end{document} and r≈N0\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$r\\approx N^{0}$$\\end{document}. Furthermore, we propose new attacks using the unique algebraic relationship in blinding RSA, which extend the attack to the case where e is of full size.

New simultaneous Diophantine attacks on generalized RSA key equations

RSA stands as a widely adopted method within asymmetric cryptography, commonly applied for digital signature validation and message encryption. The security of RSA relies on the challenge of integer factorization, a problem considered either computationally infeasible or highly intricate, especially when dealing with sufficiently large security parameters. Effective exploits of the integer factorization problem in RSA can allow an adversary to assume the identity of the key holder and decrypt such confidential messages. The keys employed in secure hardware are particularly significant due to the typically greater value of the information they safeguard, such as in the context of securing payment transactions. In general, RSA faces various attacks exploiting weaknesses in its key equations. This paper introduces a new vulnerability that enables the concurrent factorization of multiple RSA moduli. By working with pairs (Ni,ei) and a fixed value y satisfying the Diophantine equation eixi2−y2ϕ(Ni)=zi, we successfully factorized these moduli simultaneously using the lattice basis reduction technique. Notably, our research expands the scope of RSA decryption exponents considered as insecure.

Parallel implementation of Wiener's attack on RSA: Algorithm design and performance evaluation

The robustness of the RSA cryptosystem is intrinsically tied to the choice of public and private keys. As pinpointed by M. Wiener, should the private decryption exponent, d, be improperly chosen-either disproportionately large or unduly small in relation to the public key n-an adversary could feasibly deduce the private keys within a practical time span. In this paper, the algorithm invented by Wiener is revisited and find a way to parallelize the attacking algorithm by using OpenMP. The algorithm is based on the proof made in Wieners article, that if d<1/3 n^(1/4), then the private key d is the denominator of one of the convergent of CF(e/n). Using a constant set of private keys (e,n), an extensive series of simulated attacks employing Wieners method was conducted on a laptop to determine the optimal thread count for executing the parallel algorithm. The results indicate that the algorithms execution speed can be enhanced by a factor of 1.5607 (rounded to five significant figures). Specifically, while the sequential version of the algorithm averaged a runtime of 3518939.04 nanoseconds, its parallel counterpart averaged 2240493.28 nanoseconds.

An improved cryptanalysis of multi-prime RSA with specific forms of decryption exponent

Multi-prime RSA (MPRSA) is an extended version of RSA in which the modulus is the product of three or more distinct prime numbers. As with the RSA, this variant is also scrutinized for vulnerabilities. The main goal of the attacks on MPRSA is to test the strength of MPRSA compared to that of RSA to determine whether MPRSA can be used in place of RSA. We apply two famous attacks on RSA to MPRSA by constructing lattices using the Jochemsz and May approach. In comparison to RSA, MPRSA is less vulnerable to both attacks.

Cryptanalysis of RSA with composed decryption exponent with few most significant bits of one of the primes

Cryptanalysis of RSA with composed decryption exponent with few most significant bits of one of the primes

Asymptotic Bound for RSA Variant with Three Decryption Exponents

This paper presents a cryptanalysis attack on the RSA variant with modulus $N=p^rq$ for $r\geq 2$ with three public and private exponents $(e_1,d_1),$ $(e_2,d_2),$ $(e_3,d_3)$ sharing the same modulus $N$ where $p$ and $q$ are consider to prime having the same bit size. Our attack shows that we get the private exponent $\sigma_1\sigma_2\sigma_3<\left(\frac{r-1}{r+1}\right)^4$, which makes the modulus vulnerable to Coppersmith's attacks and can lead to the factorization of $N$ efficiently where $d_1 The asymptotic bound of our attack is greater than the bounds for May \cite{May}, Zheng and Hu \cite{Z}, and Lu et al. \cite{Y} for $2\leq r \leq 10$ and greater than Sarkar's \cite{Sarkar1} and \cite{Sarkar} bounds for $5 \leq r \leq10$.

Cryptanalysis Attacks on Multi Prime Power Modulus Through Analyzing Prime Difference

The Security of Rivest, Shamir and Adleman Cryptosystem known as RSA and its variants rely on the difficulty of integer factorization problem. This paper presents a short decryption exponent attack on RSA variant based on the key equation where prime difference was carefully analyzed and came up with an approximation of as which enabled us to obtain an improved bound that led to the polynomial time factorization of the variant .

Incorrectly Generated RSA Keys: How I Learned To Stop Worrying And Recover Lost Plaintexts

Abstract When generating primes $p$ and $q$ for an RSA key, the algorithm specifies that if $p-1$ and $q-1$ must be relatively prime to the public exponent $e$. If this is not done, then the decryption exponent is not well defined. However, what if a software bug allows the generation of public parameters $N$ and $e$ of an RSA key with this property and then it is subsequently used for encryption? Though this may seem like a purely academic question, a software bug in a preview release of the Windows 10 operating system makes this question of more than purely theoretical. Without a well defined decryption exponent, plaintexts encrypted to such keys will be undecryptable thus potentially losing user data, a serious software defect. Though the decryption exponent is no longer well defined, it is in fact possible to recover the a small number of potential plaintexts, if the prime factors $p$ and $q$ of the public modulus $N$ are known. This paper presents an analysis of what steps fail in the RSA algorithm and derives a plaintext recovery algorithm. The runtime of this algorithm is $O(e)$ making it practical to use, and it has been implemented in python.

Cryptanalysis of common prime RSA with two decryption exponents: Jochemsz and May approach

Cryptanalysis of common prime RSA with two decryption exponents: Jochemsz and May approach

Cryptanalysis of Common Prime RSA with Two Decryption Exponents: Jochemsz and May Approach

Cryptanalysis of Common Prime RSA with Two Decryption Exponents: Jochemsz and May Approach

Cryptanalysis of RSA with small difference of primes and two decryption exponents: Jochemsz and May approach

RSA is a well-known cryptosystem in Modern Cryptography and its efficiency is based on the hardness of the Integer Factorization problem. The algorithm is shown to be vulnerable to several attacks in a number of special scenarios with assumptions. In this paper, the strength of RSA is investigated if the primes in the modulus are close and the same modulus is used for two instances. The attack is highly efficient compared to other known attacks which are only concentrated on either closeness of the primes or the same modulus used for two or more instances. This attack examines the closeness of the primes chosen whenever the RSA system is used for two instances with the same modulus. The LLL algorithm is used to obtain the bound, and the bound is highly efficient compared to other known attacks.

Increment of insecure RSA private exponent bound through perfect square RSA diophantine parameters cryptanalysis

The public parameters of the RSA cryptosystem are represented by the pair of integers N and e. In this work, first we show that if e satisfies the Diophantine equation of the form ex2−ϕ(N)y2=z for appropriate values of x,y and z under certain specified conditions, then one is able to factor N. That is, the unknown yx can be found amongst the convergents of eN via continued fractions algorithm. Consequently, Coppersmith’s theorem is applied to solve for prime factors p and q in polynomial time. We also report a second weakness that enabled us to factor k instances of RSA moduli simultaneously from the given (Ni,ei) for i=1,2,⋯,k and a fixed x that fulfills the Diophantine equation eix2−yi2ϕ(Ni)=zi. This weakness was identified by solving the simultaneous Diophantine approximations using the lattice basis reduction technique. We note that this work extends the bound of insecure RSA decryption exponents.

An improved cryptanalysis of large RSA decryption exponent with constrained secret key

An improved cryptanalysis of large RSA decryption exponent with constrained secret key

Diophantine Attack on Prime Power With Modulus $N=p^rq$

The importance of keeping information secret cannot be overemphasized especially in today,s digital world where eavesdroppers are rampant in our chanels of communication. This made the use of strong encryption schemes inevitable in order to safeguard the security of our system. RSA cryptosystem and its variants have been designed to provide confidentiality and integrity of data in our medium of communication. This paper reports new short decryption exponent attack on prime power with modulus $N=p^rq$ for $r\geq 2$ using continued fraction method which makes it vulnerable to Diophantine attack and breaks the security of the cryptosystem by factoring the modulus into its prime factors since the hardness relies on the integer factorization problem. The paper also shows that if the short decryption exponent $d

Extended partial key exposure attacks on RSA: Improvement up to full size decryption exponents

Partial key exposure attacks on RSA have been intensively studied by using lattice-based Coppersmith's methods. Ernst et al. (Eurocrypt'05) studied the problem by considering three attack scenarios; (1) the most significant bits (MSBs) of a secret exponent d known, (2) the least significant bits (LSBs) of d known, (3) both the MSBs and the LSBs of d known. The proposed attacks were valuable since they were the first results to handle full size exponents e. Takayasu and Kunihiro (SAC'14, Theoretical Computer Science'19) proposed improved attacks for (1) and (2) when d is sufficiently small, i.e., d<N0.5625 for (1) and d<N0.368 for (2), by utilizing a linearization technique. In this paper, we extend Takayasu-Kunihiro's attacks and improve Ernst et al.'s attack for (3). In particular, our attack contains Takayasu-Kunihiro's attacks for (1) and (2) as special cases when the amount of given LSBs and MSBs are zero, respectively. Furthermore, as opposed to Takayasu-Kunihiro's attacks, our improvement against Ernst et al.'s attack is not limited to small secret exponents such as d<N0.5625. Indeed, we are able to improve Ernst et al.'s attack almost up to full size decryption exponents, i.e., even when d is close to N. Technically, the extension is not straightforward. We first modify Takayasu-Kunihiro's lattice basis matrix for (2), so that it is compatible to embed the given MSBs. The modification is crucial for embedding both the MSBs and the LSBs simultaneously to the matrix.

An Improved Cryptanalysis of Large RSA Decryption Exponent with constrained Secret key

In this study, we revisit the RSA public key cryptosystem in some special case of Boneh and Durfee's attack when the private key d assumes to be larger than the public key e. The attack in this study is the variation of an approach adopted by Luo et al. (2009) based on large decryption exponent. They had chosen a large private key (d > e) and found the weak keys in some specific range between N0.258 ≤ e ≤ N0.857. We highlight the shortcomings and new improvements in our study with more refined bound analysis up to the range between N0.104 ≤ e ≤ N0.923. Our experimental results revealed more refined bounds using lattice-based Coppersmith's method. In our experimental yield, we find the small roots of the devised polynomial, which helps to factorise the RSA modulus of size up to 1,024-bits. We also measure the probability of a specific range of weak keys, which further certify our results about weak keys in an RSA constrained secret key environment.

Comment on “Efficient and Secure Outsourcing Scheme for RSA Decryption in Internet of Things”

Internet-of-Things (IoT) devices have grown in popularity over the past few years. The RSA public-key cryptographic primitive is time consuming for resource-constrained IoT. Recently, Zhang et al. proposed a two-party outsourcing protocol between a client and a server for RSA decryption in IoT. It relies on the Chinese remainder theorem as proposed by Quisquater and Couvreur in 1982 and is very efficient. We show that their protocol does not achieve the claimed security guarantees: 1) the (secret) decryption exponent, the plaintext, and the factorization of the RSA modulus are revealed to a passive adversary and 2) a malicious server can make the client accept an (invalid) value of its choice as the result of the delegated computation.

New Cryptanalytic Attack on RSA Modulus N = pq Using Small Prime Difference Method

This paper presents new short decryption exponent attacks on RSA, which successfully leads to the factorization of RSA modulus N = p q in polynomial time. The paper has two parts. In the first part, we report the usage of the small prime difference method of the form | b 2 p − a 2 q | &lt; N γ where the ratio of q p is close to b 2 a 2 , which yields a bound d &lt; 3 2 N 3 4 − γ from the convergents of the continued fraction expansion of e N − ⌈ a 2 + b 2 a b N ⌉ + 1 . The second part of the paper reports four cryptanalytic attacks on t instances of RSA moduli N s = p s q s for s = 1 , 2 , … , t where we use N − ⌈ a 2 + b 2 a b N ⌉ + 1 as an approximation of ϕ ( N ) satisfying generalized key equations of the shape e s d − k s ϕ ( N s ) = 1 , e s d s − k ϕ ( N s ) = 1 , e s d − k s ϕ ( N s ) = z s , and e s d s − k ϕ ( N s ) = z s for unknown positive integers d , k s , d s , k s , and z s , where we establish that t RSA moduli can be simultaneously factored in polynomial time using combinations of simultaneous Diophantine approximations and lattice basis reduction methods. In all the reported attacks, we have found an improved short secret exponent bound, which is considered to be better than some bounds as reported in the literature.

Revisiting Prime Power RSA

Recently Sarkar (DCC 2014) has proposed a new attack on small decryption exponent when RSA Modulus is of the form N=prq for r≥2. This variant is known as Prime Power RSA. The work of Sarkar improves the result of May (PKC 2004) when r≤5. In this paper, we improve the work of Sarkar when 2<r≤8.We also study partial key exposure attack on Prime Power RSA. Our result improves the works of May (PKC 2004) when r≤8 and the decryption exponent d<N1r+1+3r−23r+3+33(r+1).

A New Attack on RSA With a Composed Decryption Exponent

In this paper, we consider an RSA modulus N = pq, where the prime factors p, q are of the same size. We present an attack on RSA when the decryption exponent d is in the form d = Md1 + d0 where M is a given positive integer and d1 and d0 are two suitably small unknown integers. In 1999, Boneh and Durfee presented an attack on RSA when d < N. When d = Md1 + d0, our attack enables one to overcome Boneh and Durfee’s bound and to factor the RSA modulus.