dissertacao.pdf

If we set s = −(p + q), A = N + 1 and take the equation (mod e), the equation
becomes:
k(A + s) ∼ = 1 (mod e) (63)
The following notation will be used for this attack and the next: we will write
e = N α for some α. As e is usually the same size of N, α is usually close to 1.
As for d, as we are talking about small private exponent attacks, we will assume
it satisfies the inequality d < N δ for some δ. Therefore the goal of a low private
key attack is to work for as high a δ as possible. Now lets look at the existing
constraints over k and s:
from the key equation we get:
|k| < de 3de
≤
φ(N) 2N
as we know that p and q are less than 2 2√ N we have:
3 δ−1
< e1+ α . (64)
2
|s| < 3N 0.5 = 3e 1
2α (65)
As in the usual case we have α ≈ 1, if we ignore the small constants we have
the following problem, known as the small inverse problem: finding integers
k and s that satisfy:
k(A + s) ∼ = 1 (mod e) such that |s| < e 0.5 and |k| < e δ
(66)
The reason for the name of the problem is that, in some way, we are given an
integer A and we are looking for a number close to it whose inverse is small
(mod e). If, for a given δ we can list all the solutions of this problem, then
one of them will reveal the true value of s and therefore allow us to factor N
This means that the RSA system is insecure when one uses a private exponent
satisfying d < N δ for a value of δ for which we can solve the Small Inverse
Problem efficiently.
Thought it was Boneh and Durfee’s conviction that this problem can be
solved for δ < 0.292, they could not prove this fact. The reason for this is that
their solution to the small inverse problem, which is based on the LLL algorithm
and Coppersmith’s results, requires Conjecture 1 . However, their attack does
result in practice and for this reason a decryption exponent δ < 0.292 should be
49