dissertacao.pdf

Table 3: DeLaurentis Attack’s Experimental Results
size of N (in bits) time to compute d1 (seconds)
8 0.000019
16 0.000012
32 0.000031
64 0.000031
128 0.000030
256 0.000051
512 0.000058
1024 0.000092
2048 0.000186
4096 0.000387
algorithm running in polynomial time to factor N. So, when implementing
RSA, it is not possible at all to use the same modulus for different
users.
3.2.2 Hastad’s Broadcast Attack
The following attack is due to Hastad[18]. It is also known as Common Plain
text Attack due to the fact that it needs, like the previous attack, that the same
plain text be encrypted more than once. In the original attack, presented below,
we actually need k messages, k ≥ e, where e is a common public exponent used
to encode the k messages. The theorem supporting it follows:
Theorem 21. Suppose a plain text m is encrypted k times with the public keys
< e, N1 >, < e, N2 >, ..., < e, Nk > where k ≥ e and the N1, N2, ..., Nk are
pairwise co-prime. Let N0 = min{N1, N2, ..., Nk} and N = k
i=1 Ni. If the
plain text m satisfies m < N0 then Marvin, knowing ci ∼ = m e (mod Ni) and
< e, Ni > for i = 1, 2, ..., k, can compute the plain text m in time polynomial in
log (N).
Proof. Given that the (Ni’s are co-prime, we can apply the CRT to compute
C ∼ = m e (mod N). As m < N0 we have that m e < N1N2...Nk = N and so
C = m e . Therefore all we need to do is to compute the e-th root of C over
36