dissertacao.pdf

not the case regarding RSA as we have defined it. Knowing two different plain
texts (say, ”YES” and ”NO”) and one cypher text, Marvin can easily find out to
what plain text the cypher text corresponds to by simply encrypting it with the
public key. This means that there is no deterministic public key cryptosystem
that is semantically secure.
Because of these properties, it becomes clear that, prior to encryption, a
random padding scheme should be applied to the plain text.
To sum up, there is some mandatory implementation changes we can state
at this moment:
1. The value φ(N) should be kept secret,
2. We cannot use plain texts m : (m, N) = 1,
3. A prior random padding scheme should always be applied to m before
encryption.
1.8 Variants of RSA
In this section we present some of the variants of RSA that have been created
over the years. Although not analysed in this work, we will present some of
their advantages comparing with the original RSA cryptosystem.
1.8.1 CRT-RSA
The encryption and decryption operations take time linear to the bit size of
the encryption and decryption exponents respectively [20]. One simple vari-
ant of RSA consists of, in the decryption process, using all the information
in the private key < p, q, d, N >, that is, to use also the factors p and q.
Knowing them, Bob can compute two partial decryptions mp ∼ = c e (mod p)
and mq ∼ = c e (mod q) and then combine the results using the Chinese Remain-
der Theorem to obtain the plain text m. This is an usual procedure because it
reduces the decryption costs by a factor of 4 [23]. In the literature it is usually
refered to as CRT-RSA.
18