dissertacao.pdf

1.8.2 Multi-Prime RSA
Multi-Prime RSA, like the name says, uses r < 1 distinct primes p1, p2, ..., pr to
form the modulus N = p1p2...pr. A Multi-Prime RSA instance using r-primes
is called r-prime RSA. For greater safety, it is usual to use balanced primes.
The proceedings like computing the exponents and the encryption method are
done in exactly the same way as the original RSA (that is, 2-RSA).
The greatest advantage of Multi-Prime RSA is that it allows for a faster
decryption process when Bob uses its knowledge of the factorization of N. When
receiving a cypher text c = m e (mod N) he starts by computing the partial
decryptions xi ∼ = c (mod pi) for i = 1, ..., r. Then he applies the CRT theorem
and recovers the plain text m. According to results by [19], the worst case cost
of decryption for a 3-prime RSA is 9
4
smaller than the worst case for RSA and
this results gets even better with 4-prime RSA, which presents a worst case cost
4 times smaller than that of the RSA.
One interesting topic regarding Multi-Prime RSA is the number of primes
one should use. It is obvious that the more primes we use the quicker the
decryption will be, but using too many will result in N having smaller factors.
The Number Field Sieve is the most efficient generic factorization method known
presently. Its running time depends solely on the size of N, the integer we want
to factor. On the other side, the Elliptic Curve Method is an extremely efficient
factorization algorithm for numbers N with a small prime factor, as it depends
on the size of N but also on the size of p, its smallest prime factor. When
we choose the size of the modulus, N, the runtime of the NFS is fixed. The
runtime of the Elliptic Curve Method will then be proportional to N but also
to p, the size of the smallest prime factor p. So, the idea that occurred to
Lenstra was to, for each size of a modulus N, calculate how many primes one
can use in r-prime RSA so that the runtime for both algorithms is the same for
standard RSA and for r-prime RSA. His work[28] resulted in recommendations
for the number of primes that we can use safely for r-prime RSA with modulus
of 1024,2048,4096 and 8192 bits. It should be noted that, besides taking in
account the available computational power at the time of publication of the
article, Lenstra also considered its probable evolution.
19