Decryption Exponent Research Articles

A new attack on RSA with two or three decryption exponents

Let N=pq be an RSA modulus, i.e. the product of two large unknown primes of equal bit-size. In this paper, we describe an attack on RSA in the presence of two or three exponents e i with the same modulus N and satisfying equations e i x i −ϕ(N)y i =z i , where ϕ(N)=(p−1)(q−1) and x i , y i , z i are unknown parameters. The new attack is an extension of Guo’s continued fraction attack as well as the Blomer and May lattice-reduction basis attack.

On Deterministic Polynomial-time Equivalence of Computing the CRT-RSA Secret Keys and Factoring

Let N = pq be the product of two large primes. Consider Chinese remainder theorem-Rivest, Shamir, Adleman (CRT-RSA) with the public encryption exponent e and private decryption exponents dp, dq. It is well known that given any one of dp or dq (or both) one can factorise N in probabilistic poly(log N) time with success probability almost equal to 1. Though this serves all the practical purposes, from theoretical point of view, this is not a deterministic polynomial time algorithm. In this paper, we present a lattice-based deterministic poly(log N) time algorithm that uses both dp, dq (in addition to the public information e, N) to factorise N for certain ranges of dp, dq. We like to stress that proving the equivalence for all the values of dp, dq may be a nontrivial task. Defence Science Journal, 2012, 62(2), pp.122-126 , DOI:http://dx.doi.org/10.14429/dsj. 62.1716

Cryptanalysis of RSA with more than one decryption exponent

In this paper, we analyze the security of the RSA public key cryptosystem where multiple encryption and decryption exponents are considered with the same RSA modulus N. We consider N = p q , where p, q are of the same bit size, i.e., q < p < 2 q . We show that if n many decryption exponents ( d 1 , … , d n ) are used with the same N, then RSA is insecure when d i < N 3 n − 1 4 n + 4 , for all i, 1 ⩽ i ⩽ n and n ⩾ 2 . Our result improves the bound of Howgrave-Graham and Seifert (CQRE 1999) for n ⩽ 42 and also generalizes our recent work for n = 2 (IPL 2010).

Some applications of lattice based root finding techniques

In this paper we present some problems and their solutions exploiting lattice based root finding techniques. In CaLC 2001, Howgrave-Graham proposed a method to find the Greatest Common Divisor (GCD) of two large integers when one of the integers is exactly known and the other one is known approximately. In this paper, we present three applications of the technique. The first one is to show deterministic polynomial time equivalence between factoring $N$ ($N = pq$, where $p > q$ or $p, q$ are of same bit size) and knowledge of $q$-1 mod $p$. Next, we consider the problem of finding smooth integers in a short interval. The third one is to factorize $N$ given a multiple of the decryption exponent in RSA. In Asiacrypt 2006, Jochemsz and May presented a general strategy for finding roots of a polynomial. We apply that technique to solve the following two problems. The first one is to factorize $N$ given an approximation of a multiple of the decryption exponent in RSA. The second one is to solve the implicit factorization problem given three RSA moduli considering certain portions of LSBs as well as MSBs of one set of three secret primes are same.

Cryptanalysis of RSA with two decryption exponents

In this paper, we consider RSA with N = p q , where p , q are of same bit size, i.e., q < p < 2 q . We study the weaknesses of RSA when multiple encryption and decryption exponents are considered with same RSA modulus N. A decade back, Howgrave-Graham and Seifert (CQRE 1999) studied this problem in detail and presented the bounds on the decryption exponents for which RSA is weak. For the case of two decryption exponents, the bound was N 0.357 . We have exploited a different lattice based technique to show that RSA is weak beyond this bound. Our analysis provides improved results and it shows that for two exponents, RSA is weak when the RSA decryption exponents are less than N 0.416 . Moreover, we get further improvement in the bound when some of the most significant bits (MSBs) of the decryption exponents are same (but unknown).

On the uniformity of distribution of the decryption exponent in fixed encryption exponent RSA

Let us fix a security parameter n and a sufficiently large encryption exponent e. We show that for a random choice of the RSA modulus m = p q , where p and q are n-bit primes, the decryption exponent d, defined by e d ≡ 1 ( mod φ ( m ) ) is uniformly distributed modulo φ ( m ) . It is known, due to recent work of Boneh, Durfee and Frankel, that additional information about some bits of d may turn out to be dramatic for the security of the whole cryptosystem. Our uniformity of distribution result implies that sufficiently long strings of the most and the least significant bits of d, which are vulnerable to such attacks, behave as random binary vectors.

Large decryption exponents in RSA

A class of RSA encryption exponents whose corresponding decryption exponents have a bitlength almost equal to the bitlength of the RSA modulus is analysed. In this way, the attacks to small decryption exponent are avoided.

On the Security of the Digital Signature Algorithm

We present a key-recovery attack against the Digital Signature Algorithm (DSA). Our method is based on the work of Coppersmith l7r, and is similar in nature to the attacks of Boneh et al. l5,9r which use lattice reduction techniques to determine upper bounds on the size of an RSA decryption exponent under which it will be revealed by the attack. This work similarly determines provable upper bounds on the sizes of the two key parameters in the DSA for which the system can be broken. Specifically if about half of the total number of bits in the secret and ephemeral keys, assuming contiguous unknown bits in each key, are known, the system can be shown to be insecure. The same technique shows that if about half of the total number of bits in two ephemeral keys are known, again assumed contiguous unknown bits in each key, but with no knowledge of the secret key, the system can be shown to be insecure.