dissertacao.pdf
dissertacao.pdf
dissertacao.pdf
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
ecovery exponent l to reveal the plain text. As this value can be found by an<br />
exhaustive search, we want it to be as large as possible. Immediately we see that<br />
the plain text message m = 1 is a message with recovery exponent equal to 1,<br />
that is, Marvin gets the same cypher text after only one encryption, therefore<br />
he concludes that the message was not encrypted at all. So such a message<br />
should never be sent. Thankfully, most of the plain texts present a much larger<br />
recovery exponent. Although it is not possible to easily calculate l for any given<br />
plain text, one result is particularly helpful to avoid this attack:<br />
Theorem 23. Suppose a plain text m is encrypted with the public key < e, N >.<br />
Then the recovery exponent of m divides λ(λ(N)).<br />
For a proof of this theorem one can read [25]. So, in order to avoid an attack<br />
against our RSA system, we should ensure that λ(λ(N)) is large (as it is the<br />
maximum value of l) and has large prime divisors. It has been shown that, for a<br />
large RSA modulus with balanced, randomly generated primes, this is the usual<br />
case[22].<br />
There is a generalized cycling attack on RSA. Given a cypher text c, it<br />
consists in finding the smallest integer k such that (cek − c, N) > 1. After this,<br />
if:<br />
we have that k = p. Conversely, if<br />
c ek ∼ e<br />
= c (mod p) and c k<br />
≇ c (mod q) (48)<br />
c ek<br />
≇ c (mod p) and c ek ∼ = c (mod q) (49)<br />
then we know that k = q. In any way, we found one of the prime factors of<br />
the modulus and therefore we broke the system completely. Again according to<br />
[22], this attack is infeasible for large values of the randomly chosen primes p<br />
an q.<br />
This attack provides us with one extra security measure when choosing the<br />
generating primes p and q. We should ensure that the smallest prime factor of<br />
λ(λ(pq)) is a large number.<br />
3.3 Recovering Plain texts Encrypted With Small Public<br />
Exponent<br />
This section, which could actually include some of the attacks presented in<br />
the previous section, regards the safety of the RSA cryptosystem when a small<br />
40