Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

More documents

Recommendations

Info

93 5.3 MSB Case: Our Method and its Analysis Once we get these l N /4 MSBs, that is the complete most significant half, of one of the primes, one can use the existing lattice based method [24] by Coppersmith to factor N = pq in poly(logN) time. 5.3.4 Experimental Results We present some experimental results in Table 5.3 to support the claim in Theorem 5.6. The blocksize for known bits, i.e, a, and the approximation offset t are varied to obtain these results for l N = 1024. The target size for reconstruction is T = 256 as the primes are 512 bits each. We have run the experiment 1000 times for each pair of fixed parameters a,t. The first value in each cell represents the experimental percentage of success in these cases and illustrate the practicality of our method. The second value in each cell is the theoretical probability of success obtained from Theorem 5.6. a t = 1 t = 2 t = 3 t = 4 t = 5 10 0, 0 2.5, 0.07 16.8, 3.55 41.5, 19.9 64.5, 45.2 20 1.8, 0.02 18.7, 3.17 44.5, 20.1 65.7, 46.1 81.9, 68.3 40 15.5, 1.6 42.8, 17.8 66.7, 44.9 81.8, 67.9 90.8, 82.7 60 29.1, 6.3 55.6, 31.6 75.7, 58.6 86.6, 77.2 91.7, 88.1 80 41.9, 12.5 66.4, 42.2 82.9, 67.0 91.0, 82.4 95.7, 90.9 100 50.6, 25.0 74.4, 56.2 86.6, 76.6 93.7, 87.9 97.1, 93.8 a t = 6 t = 7 t = 8 t = 9 t = 10 10 82.1, 67.5 90.6, 82.2 95.0, 90.7 97.2, 95.2 - 20 90.6, 82.8 94.8, 91.0 97.5, 95.4 98.5, 97.7 99.3, 97.6 40 95.2, 91.0 97.8, 95.4 98.6, 97.7 99.3, 98.8 99.9, 99.4 60 95.3, 93.9 97.4, 96.9 98.9, 98.4 99.5, 99.2 99.9, 99.7 80 98.3, 95.4 99.1, 97.7 99.4, 98.8 99.7, 99.4 100, 99.7 100 98.8, 96.9 99.6, 98.4 99.8, 99.2 99.9, 99.6 100, 99.8 Table 5.3: Percentage of success of Algorithm 8 with 512-bit p,q, i.e., l N = 1024. One may note that our theoretical bounds on the probability (second value in each cell) is an underestimate compared to the experimental evidences (first value in each cell) in all the cases. This is because we have used the bound on the probability of carry loosely as p c ≤ 1 in Lemma 5.5, whereas a better estimate should have been p c ≈ 1 . As an example, let us check the case with a = 40,t = 3. 2
Chapter 5: Reconstruction of Primes given few of its Bits 94 Here, the theoretical bound on the probability with p c ≤ 1 is 44.9% whereas with p c = 0.5, the same bound comes as 67.9%. The experimental evidence of 66.7% is quite clearly closer to the second one. But we could not correctly estimate the value of p c and hence opted for a safe (conservative) margin. The results in italic font are of special interest. In these cases one can factorize N in poly(logN) time, with probability greater than 1 by knowing less than 70% 2 of the bits of both the primes combined, that is, by knowing approximately just 35% of the bits of each prime p,q. Note that the result by Herrmann and May [51] requires about 70% of the bits of one of the primes in a similar case where the known bits are distributed over small blocks. Their result factorizes N in time exponential in the number of such blocks, whereas our method produces the same result in time polynomial in the number of blocks. 5.4 Conclusion Our work discusses the factorization of RSA modulus N by reconstructing the primes from randomly known bits. The reconstruction method exploits the known bits to prune wrong branches of the search tree and reduces the total search space. We have revisited the work of Heninger and Shacham [50] in Crypto 2009 and provided a combinatorial model for the search where certain bits of the primes are known at random. This, combined with existing lattice based techniques, can factorize N given the knowledge of randomly chosen prime bits in the least significant halves of the primes. We also explain a lattice based strategy to remedy one of the shortcomings of the reconstruction algorithm. Moreover, we study how N canbefactoredgiventheknowledgeofsomeblocksofbitsinthemostsignificant halves of the primes. We propose an algorithm that recovers the most significant halves of one or both the primes exploiting the known bits. Inthischapter, wehaveassumedtheknowledgeofcertainfraction ofbitsofthe RSA primes. However, one may not have such an explicit information regarding the primes, but may gain certain implicit knowledge instead. In the next chapter, we discuss RSA factorization in the light of such an implicit knowledge about the RSA primes. This problem is aptly termed as the ‘implicit factorization problem’.
Page 1:
some results on Cryptanalysis of RS
Page 5 and 6:
Abstract In this thesis, we propose
Page 7 and 8:
Acknowledgements There are many peo
Page 9:
To Thaakuma (Grandmother), the firs
Page 12 and 13:
2.3.7 Small Decryption Exponent Att
Page 14 and 15:
7.4 The General Solution for EPACDP
Page 17 and 18:
List of Figures 1.1 Communication o
Page 19 and 20:
Chapter 1: Introduction 2 The motiv
Page 21 and 22:
Chapter 1: Introduction 4 there is
Page 23 and 24:
Chapter 1: Introduction 6 Discrete
Page 25 and 26:
Chapter 1: Introduction 8 Chapter 5
Page 28 and 29:
Chapter 2 Mathematical Preliminarie
Page 30 and 31:
13 2.2 RSA Cryptosystem are impleme
Page 32 and 33:
15 2.2 RSA Cryptosystem • private
Page 34 and 35:
17 2.2 RSA Cryptosystem istic prima
Page 36 and 37:
19 2.2 RSA Cryptosystem Afterfindin
Page 38 and 39:
21 2.2 RSA Cryptosystem integer x <
Page 40 and 41:
23 2.3 Cryptanalysis of RSA to be h
Page 42 and 43:
25 2.3 Cryptanalysis of RSA The att
Page 44 and 45:
27 2.4 Lattice and LLL Algorithm No
Page 46 and 47:
29 2.4 Lattice and LLL Algorithm Wh
Page 48 and 49:
31 2.5 Solving Modular Polynomials
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
39 2.6 Solving Integer Polynomials
Page 58 and 59:
41 2.6 Solving Integer Polynomials
Page 60 and 61: 43 2.7 Analysis of the Root Finding
Page 62: 45 2.9 Conclusion 2.9 Conclusion No
Page 65 and 66: Chapter 3: A class of Weak Encrypti
Page 81 and 82: Chapter 4: Cryptanalysis of RSA wit
Page 92 and 93: Chapter 5 Reconstruction of Primes
Page 94 and 95: 77 5.1 LSB Case: Combinatorial Anal
Page 102 and 103: 85 5.2 LSB Case: Lattice Based Tech
Page 104 and 105: 87 5.3 MSB Case: Our Method and its
Page 112 and 113: Chapter 6 Implicit Factorization In
Page 114 and 115: 97 6.1 Implicit Factoring of Two La
Page 116 and 117: 99 6.1 Implicit Factoring of Two La
Page 118 and 119: 101 6.1 Implicit Factoring of Two L
Page 124 and 125: 107 6.2 Two Primes with Shared Cont
Page 126 and 127: 109 6.2 Two Primes with Shared Cont
Page 128 and 129: 111 6.3 Exposing a Few MSBs of One
Page 130 and 131: 113 6.3 Exposing a Few MSBs of One
Page 132 and 133: Chapter 7 Approximate Integer Commo
Page 134 and 135: 117 7.1 Finding q −1 mod p ≡ Fa
Page 136 and 137: 119 7.2 Finding Smooth Integers in
Page 138 and 139: 121 7.3 Extension of Approximate Co
Page 140 and 141: 123 7.4 The General Solution for EP
Page 150 and 151: 133 7.5 Sublattice and Generalized
Page 156 and 157: 139 7.6 Improved Results for Larger
Page 158 and 159: 141 7.6 Improved Results for Larger
Page 160 and 161:
143 7.7 EGACDP The approach in this
Page 162 and 163:
145 7.7 EGACDP Sinceinthiscasethema
Page 164:
147 7.8 Conclusion poly{loga,k}. Th
Page 167 and 168:
Chapter 8: Conclusion 150 Chapter 3
Page 169 and 170:
Chapter 8: Conclusion 152 p 1 ,p 2
Page 171 and 172:
Chapter 8: Conclusion 154 represent
Page 173 and 174:
Chapter 8: Conclusion 156 Final Wor
Page 175 and 176:
BIBLIOGRAPHY 158 [9] J. Blömer and
Page 177 and 178:
BIBLIOGRAPHY 160 [31] B. de Weger.
Page 179 and 180:
BIBLIOGRAPHY 162 [54] M.J.Hinek. Cr
Page 181 and 182:
BIBLIOGRAPHY 164 [76] A. K. Lenstra
Page 183 and 184:
BIBLIOGRAPHY 166 [97] A. Nitaj. Cry
Page 185:
BIBLIOGRAPHY 168 [121] C. L. Siegel
show all

Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Create successful ePaper yourself

Delete template?

Save as template?