dissertacao.pdf

y
fN(x) = 2 −k1e ((m22 k2 + x2 k1 + m0) e − c) (mod N). (50)
Notice that fN(m1) = 0 (mod N). So m1 is a root of fN(x) (mod N) satisfying
|m1| < N 1
e so we can apply Coppersmith’s theorem to compute m1 in time
polynomial in log(N) and e to find out m.
We implemented this attack and obtained the results shown in Table 7.
Table 7: Stereotyped Message Attack’s Experimental Results
size of N average running time (seconds)
8 0.000057
16 0.000073
32 0.000131
64 0.000247
128 0.000550
256 0.001167
512 0.002209
1024 0.004626
2048 0.009513
The reason for such fast results is that the final step of the attack, solving
the univariate modular polynomial calculated, was not done. This is because
we could not implement Coppersmith’s method.
There is ways of easily avoiding this attack. We can just choose e such
that e > log 2(N), which means that Marvin would need to actually know the
whole plain text. An alternative defence consists in applying to the plain text
a random padding which will represent a fraction of more than 1
e
the message.
of the bits of
There is an heuristic extension to this attack. If the unknown bits are not
contiguous, we can still recover them as long as the fraction of the total amount
of bits does not exceed 1
e
of the bits of the message. This result depends on an
heuristic method created by Coppersmith[9] to find small solutions of bivariate
modular polynomials. If these methods can be proved to be right, a stronger
attack would be proved to exist.
42