dissertacao.pdf

the integers to find out m. All computations can be done in time polynomial in
log (N).
The implementation of this attack is presented in the appendix. Table 4
contains the experimental results:
Table 4: Common Plain text Attack’s Experimental Results
size of N (in bits) time to compute m (seconds)
16 0.000169
32 0.000051
64 0.000049
128 0.000049
256 0.000052
512 0.000062
1024 0.000066
2048 0.000095
4096 0.000097
Another attack, known as the Related Plain text Attack, allows for the en-
crypted messages to be different but related by known polynomials, and requires
a larger number of messages to be encrypted. The result, due to Bleichenbacher
[17], is as follows:
Theorem 22. Given the public keys < e1, N1 >, < e2, N2 >, ..., < ek, Nk >
where the modulus are pairwise co-prime, and f1(x) ∈ ZN1 [x], ..., fk(x) ∈ ZNk [x],
set N0 = min{N1, N2, ..., Nk} and N = k
i=1 Ni. For a plain text m < N0, if
k ≥ maxi{eideg(fi(x))} then given ci = fi(m) (mod Ni) and < ei, Ni > for
i = 1, 2, ..., k, the plain text m can be computed in time polynomial in log N and
maxi{eideg(fi(x))}.
Proof. We can suppose all fi(x) are monic. If not, we just need to multiply
them for the inverse of the leading coefficient. If this inverse does not exist for
fj(x), we find a factor of Nj and from cj we find m.
Set δ = maxi{eideg(fi(x))} and also hi = δ − deg(fi(x) ei ) for i = 1, ..., k.
Now we define the k monic polynomials of degree δ:
gi(x) = x hi (fi(x) ei − ci) ∈ ZNi
37
, for i = 1, ..., k (43)