dissertacao.pdf

public exponent, such as e = 3, is used. This may occur when the encrypting
device has small computational powers, such as a cell phone. The attacks are
far from breaking the system as they do not aim to factor the modulus but
rather to recover specific plain texts or part of them.
3.3.1 Stereotyped Message Attack
When encrypting a plain text m, one should be careful about the size of it. As
the last attack of the previous section shows, the plain text m = 1 is easily
recovered. This, unfortunately, is not the only one, specially when we use a
small public exponent. If the public exponent is sufficiently small, there is a
risk that the cypher text will satisfy c = m e < N. Knowing this, all Marvin has
to do is to calculate the e-th root of c over the integers. So plain texts m such
that m < N 1
e cannot be used. This is relevant because RSA is often used to
share a key to use in a symmetric key cryptosystem. As an example, if we use
a 1024 bit modulus RSA and a public exponent e = 3, then the key to share
should have at least 342 bits!
The success of the stereotyped message attack depends not on the size of
the plain text, but rather on the fraction of its bits we know. To understand
how this can be possible, we introduce a classical example: suppose that each
day in the morning, a central authority encrypts and sends to another user
the plain text ”The secret for 1, September, 2011 is ?????”. Marvin, knowing
this procedure (suppose he worked at the company and now wishes to have its
revenge on it) will know a part of the plain text and ignore only a small part of
it. Coppersmith[9] showed that, if both the unknown part (that is, the ”?????”)
and the public exponent are sufficiently small, then Marvin can recover the part
of the plain text which he still doesn’t know.
Theorem 24. Suppose a plain text m is encrypted with the public key < e, N >.
Knowing < e, N >, c ∼ = m e (mod N) and all the plain text m except a fraction
smaller than 1
e
of consecutive bits of m, we can calculate the unknown fraction
of bits (and therefore m) in time polynomial in log(N) and e.
Proof. Because there is only a fraction of less than 1
e consecutive bits of m that
we do not know, we can write m = m22k2 + m12k1 + m0 where only the value of
m1 is unknown and |m1| < N 1
e . Let fN(x) ∈ ZN[x] be the polynomial defined
41