dissertacao.pdf

calculates these roots (though, as we saw, there is an algorithm that encrypts
the messages in polynomial time), it is assumed nowadays that it is hard to
calculate such roots when m ∈ ZN is randomly chosen and N is generated by
random large primes p, q.
Another trapdoor one way function in RSA is the modulus. Computing
N = pq is easy, but what about factoring N knowing only < e, N >? The
Problem of Factoring Large Integers is defined as follows:
Definition 14. (The Problem of Factoring Large Integers) Given a large
integer N, compute its prime factorization.
Again this is a trapdoor one way function: it is easy to compute the product
but difficult to compute the factors.
So lets look at the RSA Problem. If he wants to know m, Marvin can try
to find out d and then decrypt m. To compute d, Marvin must first know φ(N)
and for this he needs to factor N. If Marvin can factor N, he can compute
φ(N) and d = e −1 (mod N). This means that once we solve the problem of
factoring N, we can actually solve the RSA Problem for any m. So the RSA
problem is at most as difficult as the Problem of Factoring Large Integers. It
remains nowadays an open question to know whether both problems have the
same complexity.
As the RSA modulus N is a large number, factoring it is a rather hard task
given that its prime factors are generated randomly and balanced. The study
of factoring methods is an active field in Mathematics and, though it gained
special relevance more than 30 years ago with the appearance of RSA, it is still
unknown whether a polynomial time algorithm that solves this problem in a
classic computer exists. For this reason, it is assumed that if Marvin wishes to
factor an RSA modulus, in order to break the system, will need an amount of
time far larger than the usual duration of an RSA session.
So the safety of RSA relies deeply on the assumption that both the RSA
Problem and the Problem of Factoring Large Integers have no polynomial time
algorithm that solves it. But more relevant in practical terms is the fact that,
over 30 years of existence, no devastating attack on RSA has been publicized
which cannot be easily avoided as we will show in this work.
There is some flaws in the definition of RSA presented in the previous section.
In fact, it is not possible to safely implement RSA in such a way. We now present
some reasons why such an implementation does not provide appropriate security.
16