dissertacao.pdf

In 1984 an even stronger attack against Common Modulus RSA was discov-
ered by DeLaurentis[12]. He proved that you don’t even need two encryptions
of a plain text to actually decrypt all the encrypted messages. The theorem
states that any user of the system can actually create a new private key which
will work with any other chosen public key. Here is the result:
Theorem 20. Let < e, N > be a valid RSA public key with corresponding
private key < d, N >. Let < e1, N > be the public key from another user such
that e1 = e. Then a private key < d1, N > corresponding to < e1, N > can be
computed by:
d1 = e −1
1
in time polynomial in log(N).
Proof. We rewrite the key equation
(mod
ed − 1
) (39)
(e1, ed − 1)
ed ∼ = 1 (mod φ(N)) ⇔ ed − 1 = kφ(N) (40)
and notice also that, as e1 is a public exponent it satisfies (e1, φ(N)) = 1 and
therefore (e1, kφ(N)) = k ′ for some k ′ that divides k. Now let k ′′ = k
k ′ . The
modulus in computation (39) can be written as:
So e1 and d1 satisfy:
ed − 1 kφ(N)
=
(e1, ed − 1) k ′ = k′′ φ(N) (41)
d1 ∼ = e −1
1 (mod k ′′ φ(N)) =⇒ d1e1 ∼ = 1 (mod φ(N)) (42)
Therefore d1 is a valid private exponent corresponding to e1. All computations
can be done in time polynomial in log(N).
The implementation of this attack is presented in the appendix. The experi-
mental results obtained, again for different values of the size of n are represented
in Table 3.
The abnormal values for n = 32 and n = 64 are probably due to the fact that
the only relevant operation depending on the size of N timed was a modular
exponentiation.
There is one approach even more simple. Using his pair of private/public
keys, any user can compute a multiple of φ(N) through the key equation
ed − 1 = kφ(N). Then, by the results of Miller [33], he can use a probabilistic
35