dissertacao.pdf

Theorem 28. Given an RSA modulus N = pq with p, q > 3 and the public
key < 3, N >, then the constant k in the key equation ed = 1 + kφ(N) satisfies
k = 2.
Proof. From the key equation ed − 1 = kφ(N) we know that 0 < k < e.
So, in our case we have k = 1 or k = 2. Because (3, p − 1) = 1 we have
p − 1 ≇ 0 (mod 3) and, as p > 3, we have (3, p) = 1 and therefore
p − 1 ≇ 2 (mod 3) and so we get that
p − 1 ∼ = 1 (mod 3)
q − 1 ∼ = 1 (mod 3)
So φ(N) = (p − 1)(q − 1) ∼ = 1 (mod 3). Taking the key equation modulo e = 3,
we get:
3d ∼ = 1 + kφ(N) (mod 3) =⇒ k ∼ = 2 (mod 3) (55)
Because k = 1 or k = 2, we have k = 2 and this concludes our proof.
So every time we use e = 3 we are giving away half of the bits of the
private exponent. However, this has not been proven to be enough to factor the
modulus[22], so this attack does not represent a total break of the RSA.
3.4 Factoring the modulus of RSA with Small Private Ex-
ponent d
After the previous attacks, we now study attacks on RSA sessions where the
private exponent, d, is low. These attacks are much more destructive than the
ones presented in the previous section: they aim to factor the modulus, thus
breaking the whole system. The theorems presented on this section suppose the
encrypting and decrypting exponents are defined modulo λ(N). The results,
however, would apply if these exponents were instead defined modulo φ(N) like
in the previous sections.
We present one first result, which will prove useful for the first attack of this
section. Given the key equation ed = 1 + kλ(N), we have
0 < k =
(ed − 1)
λ(N)
In particular we have that k < d.
ed
< < min{e, d} (56)
λ(N)
46