dissertacao.pdf

factorization of N. That is, each user Ui gets the public key < ei, N > and the
private key < di, N >. Simmons [42] showed that, without needing to factor the
modulus, if the same plain text is encrypted and sent to two users with co-prime
public exponents, any other user can decrypt the corresponding cypher text.
Theorem 19. Let N = pq be a RSA modulus and let < e1, N >, < e2, N >
be two public keys such that (e1, e2) = 1. Suppose a plain text m is encrypted
with both public keys. Knowing c1 = m e1 (mod N), c2 = m e2 (mod N) and the
public keys, we can compute m in time polynomial in log(N).
Proof. Knowing e1 and e2, we compute integers a1, a2 such that a1e1 +a2e2 = 1
using the Extended Euclidean Algorithm. Now we compute
c a1
1 ca2
2 ∼ = m a1e1 m a2e2 ∼ = m a1e1+a2e2 ∼ = m (mod N) (38)
Both the Extended Euclidean Algorithm and the final computation are done in
time polynomial in log(N), so the result follows.
So this means that anyone with access to the public keys and the cypher
texts would be able to intercept all the plain texts which would be encrypted
twice to different users.
We implemented this attack and tested it for various values of the size of N.
The results are compiled in Table 2.
Table 2: Common Modulus Attack’s Experimental Results
size of N (in bits) time to compute m (in seconds)
8 0.000021
16 0.000022
32 0.000048
64 0.000059
128 0.000188
256 0.000478
512 0.001517
1024 0.007022
2048 0.036865
4096 0.231358
34