dissertacao.pdf

Therefore it is recommended that at least a fraction of 1
e
plain text m are randomized.
3.3.2 Related Message Attack
of the bits of a
The attack presented in this section is considered a small public exponent attack
because it is proved to work for e = 3. There is, however, some evidence that
it should work also with greater exponents[22]. As this is not yet a fact, we
present only the original version of the attack.
Suppose Alice sends the cypher text c ∼ = m e (mod N) to Bob. Marvin,
pretending to be Bob, tells Alice that he did not receive the message and requests
that it will be sent again. Now Alice will slightly alter the message, say, with a
different time stamp, and send it again to Bob and also to Marvin. So Marvin
will have two cypher texts, corresponding to two plain texts that, though not
being the same, are related by a somewhat ”simple” relation. Franklin and
Reiter [47] showed that, knowing the two cypher texts and the nature of the
relation between them, provided it is simple, Marvin can recover the plain text.
43