dissertacao.pdf

increment m by one and start again. This way, we are sure that m will be equal
to ⌊ g0
k0
⌋ at some point. As m < ⌊ g0
k0
g0
⌋, we try a maximum of ⌊ ⌋ iterations for
k0
each convergents, whose total number is polynomial in log(N).
The implementation of this attack is presented in the appendix. The results
obtained are represented in Table 8.
Table 8: Wiener’s Attack’s Experimental Results
size of N average running time (seconds)
32 0.007722
64 0.012929
128 0.046937
256 0.151693
512 0.497492
1024 1.78601
The most obvious way to avoid this attack is do simply use d > N 0.25 . In its
work, however, Wiener presented yet another solution to avoid this attack: using
a larger public exponent e. This is not a problem: after choosing e, one simply
adds to e successively multiples of φ(N) until e satisfies e > N 3
2 . Therefore, it
is still possible to avoid this attack and at the same time use a small private
exponent as long as this last inequality is satisfied.
3.4.2 Improving Wiener’s Attack
In its Ph.D. dissertation[16], presented in 2002, Durfee, working with Boneh,
discovered a new way to attack RSA when a small secret exponent is used. Its
attack is an improvement over Wiener’s attack as it aims to show that a private
exponent d < N 0.292 renders the system totally insecure, improving Wiener’s
bound of d < N 0.25 . However, proof of this was not found by Durfee, thought
the attacks work in practice. We present a sketch of his attack.
If we take the key equation we can rewrite it in the following way:
ed ∼ = 1 (mod φ(N)) ⇔ ed + k(N + 1 − (p + q)) = 1 (62)
48