dissertacao.pdf

Notice that gi(m) ∼ = 0 (mod Ni) for i = 1, ..., k, so we can use the Chinese
Remainder Theorem using the gi(x) and Ni as inputs and compute a new degree
δ monic polynomial G(x) ∈ ZN [x] satisfying:
G(m) ∼ = 0 (mod N) (44)
where m < N0 < N 1
l < N 1
D . So we are in condition to use Coppersmith’s
result. Therefore, we can compute m in time polynomial in log(N) and δ.
The results obtained with the algorithm presented in the appendix are shown
in Table 5.
Table 5: Related Plain text Attack’s Experimental Results
size of N (in bits) time to compute the polynomial G(x) (seconds)
782 0.000289
1093 0.000308
1793 0.000390
3373 0.000524
6251 0.000736
12246 0.001269
23918 0.0026934
The reason for such fast results is that the final step of the attack, solving
the univariate modular polynomial, was not done.
Actually, May and Ritzenhofen [30] have improved the bound for the number
of cypher texts required. Setting δi = eideg(fi(x)), if the inequality
k 1
≥ 1 (45)
δi
i=1
is satisfied then the plain text m can be recovered from the k cypher texts.
To prevent this broadcast attacks, we need to ensure that this last inequality
is not satisfied. A very straightforward way would be not to transmit the same
(or related) message massively. If there is a need for this, then we should ensure
that inequality (45) is not satisfied. For this we can transform the messages
with polynomials of high degree or alternatively use high public exponents.
38