dissertacao.pdf

ecovery exponent l to reveal the plain text. As this value can be found by an
exhaustive search, we want it to be as large as possible. Immediately we see that
the plain text message m = 1 is a message with recovery exponent equal to 1,
that is, Marvin gets the same cypher text after only one encryption, therefore
he concludes that the message was not encrypted at all. So such a message
should never be sent. Thankfully, most of the plain texts present a much larger
recovery exponent. Although it is not possible to easily calculate l for any given
plain text, one result is particularly helpful to avoid this attack:
Theorem 23. Suppose a plain text m is encrypted with the public key < e, N >.
Then the recovery exponent of m divides λ(λ(N)).
For a proof of this theorem one can read [25]. So, in order to avoid an attack
against our RSA system, we should ensure that λ(λ(N)) is large (as it is the
maximum value of l) and has large prime divisors. It has been shown that, for a
large RSA modulus with balanced, randomly generated primes, this is the usual
case[22].
There is a generalized cycling attack on RSA. Given a cypher text c, it
consists in finding the smallest integer k such that (cek − c, N) > 1. After this,
if:
we have that k = p. Conversely, if
c ek ∼ e
= c (mod p) and c k
≇ c (mod q) (48)
c ek
≇ c (mod p) and c ek ∼ = c (mod q) (49)
then we know that k = q. In any way, we found one of the prime factors of
the modulus and therefore we broke the system completely. Again according to
[22], this attack is infeasible for large values of the randomly chosen primes p
an q.
This attack provides us with one extra security measure when choosing the
generating primes p and q. We should ensure that the smallest prime factor of
λ(λ(pq)) is a large number.
3.3 Recovering Plain texts Encrypted With Small Public
Exponent
This section, which could actually include some of the attacks presented in
the previous section, regards the safety of the RSA cryptosystem when a small
40