dissertacao.pdf
dissertacao.pdf
dissertacao.pdf
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
3.4.1 Wiener’s Continuous Fractions Attack<br />
This attack, extremely simple to implement, is due to Wiener[46]. It factors the<br />
RSA modulus provided that the private exponent d is sufficiently small.<br />
Theorem 29. Given an RSA modulus N = pq and a public key < e, N >,<br />
let < d, p, q, N > be its corresponding private key, where ed = 1 + kλ(N). Let<br />
g = (p − 1, q − 1), g0 = g<br />
(g,k) and k0 = k<br />
pq<br />
(g,k) . If d < 2(p+q−1)g0k0<br />
N can be factored in time polynomial in log(N) and g<br />
k .<br />
Proof. Given that<br />
λ(N) = lcm(p − 1, q − 1) =<br />
we can rewrite the key equation as:<br />
φ(N) N − s<br />
=<br />
(p − 1, q − 1) g<br />
g0<br />
= N<br />
2sg0k0 then<br />
(57)<br />
ed = 1 + kλ(N) = 1 + k<br />
k0<br />
φ(N) = 1 + (N − s) (58)<br />
g<br />
where k0 = k<br />
(k,g) and g0 = g<br />
by dN:<br />
(k,g) . Suppose we divide both sides of this equation<br />
ed = 1 + k0<br />
g0<br />
(N − s) ⇔ e<br />
N<br />
Now we can majorate:<br />
1 k0<br />
1 k0 k0s<br />
= + (N − s) = + −<br />
dN g0dN dN g0d g0dN (59)<br />
| e k0 1 k0s k0s<br />
− | = | − | <<br />
N g0d dN dg0N dg0N =<br />
1<br />
2(dg0) 2<br />
(60)<br />
So, from the theorem presented in the Continuous Fractions section, we know<br />
that k0<br />
dg0<br />
Let ci = ai<br />
bi<br />
is one of the convergents in the continuous fraction expansion of e<br />
N .<br />
e<br />
k0<br />
be the i-th convergent of N . Then for some j we have dg0<br />
Now we can notice that the equation can be written as:<br />
ed = 1 + k0<br />
φ(N) ⇔ φ(N) = e dg0<br />
g0<br />
k0<br />
− g0<br />
= ⌊e<br />
k0<br />
bj<br />
aj<br />
= aj<br />
bj .<br />
⌋ − ⌊ g0<br />
⌋ (61)<br />
k0<br />
So, if we know the correct convergent cj and guess the value of ⌊ g0<br />
⌋, we can<br />
compute φ(N). To find the convergent and compute φ(N) we proceed as follows:<br />
for each convergent, we compute the corresponding candidate to φ(N): φc =<br />
⌊ e ⌋ + m. For each candidate, we try to factor the modulus, that is, solving<br />
ci<br />
the system N = pq and φc = (p − 1)(q − 1). If a factorization is reached, then<br />
we have the right convergent. If none of the candidates is the right one, we<br />
47<br />
k0