dissertacao.pdf

If Marvin knows φ(N), then he can solve the system of equations
N = pq ∧ φ(N) = (p − 1)(q − 1)
for p and q and therefore find the factorization of N. It is easy to check that p
and q are the solutions of
x 2 − (N − φ(N) + 1)x + N = 0 (21)
which can be solved efficiently. For this reason, the value of φ(N) should always
be kept secret.
Suppose Alice wishes to send to Bob a plain text m = kp where p is one of
the factors of N. She will encrypt it with Bob’s public key < e, N > obtain-
ing c ∼ = m e (mod N). If Marvin intercepts c, all he has to do is to compute
(c, N) = p to discover a factor of N and consequently break the system. So,
when choosing the plain texts, we cannot choose plain texts which are
not relatively prime to N.
RSA has the Homomorphic Property, that is, the encryption of the prod-
uct of two plain texts is equal to the product of the two encryptions. In RSA,
this is equivalent to the following statement: given two plain texts m1, m2 and
their cypher texts c1, c2, we have:
(m1m2) e ∼ = c1c2 (mod N) (22)
which is verified for RSA. This paves the way for an attack against RSA. Suppose
m is encrypted as c ∼ = m e (mod N). Marvin, knowing c, chooses a random
x ∈ C and asks for the plain text of c0 ∼ = cx e (mod N). Notice that this plain
text, m0, satisfies:
m0 ∼ = c d 0 ∼ = (cx e ) d ∼ = c d x ed ∼ = mx (mod N) (23)
So all he has to do is compute the plain text m ∼ = m0x −1 (mod N).
Another fact about RSA is that it does not provide Semantical Security,
which happens in a cryptosystem when, knowing only the cypher text and the
public key, no information about the plain text can be recovered. This is clearly
17