Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 8: Conclusion 150
Chapter 3: Class of Weak Encryption Exponents
Blömer and May [9] have shown that N can be factored in polynomial time if
the public exponent e satisfies ex+y ≡ 0 (mod φ(N)), with x ≤ 1 3 N 1 4 and |y| =
O(N −3 4ex). Someextensionsconsideringthedifferencep−q havealsobeenstudied.
The number of such weak keys has been estimated as N 3 4 −ǫ . In a similar direction,
more weak keys are presented by Nitaj [96]. Nitaj proved that [ if e satisfies ] eX −
(p−u)(q −v)Y = 1 with 1 ≤ Y < X < 2 −1 4N 4, 1 |u| < N 1 4, v = − qu , and if all
p−u
the prime factors of p−u or q−v are less than 10 50 , then N can be factored from
the knowledge of N,e. The number of such weak exponents is estimated as N 1 2 −ǫ .
We concentrate on the cases when e(= N α ) satisfies eX − ZY = 1, given
|N −Z| = N τ . Using the idea of Boneh and Durfee [14,15], we show that the LLL
algorithm can be efficiently applied to get Z when |Y| = N γ and
γ < 4ατ
⎛ √ (
⎝ 1
4τ + 1 1
12α − 4τ + 1 ) 2
+ 1
12α 2ατ
( 1
12 + τ
24α − α ) ⎞ ⎠.
8τ
This idea substantially extends the class of weak keys presented in [96] when Z =
ψ(p,q,u,v) = (p−u)(q −v). Further, we consider Z = ψ(p,q,u,v) = N −pu−v
to provide a new class of weak keys in RSA. This idea does not require any kind
of factorization as in [96]. A very conservative estimate for the number of such
weak exponents is N 0.75−ǫ , where ǫ > 0 is arbitrarily small for suitably large N.
Chapter 4: More than one Decryption Exponent
From the results of Howgrave-Graham et al [62] and Hinek et al [55] we know
that in the presence of n many decryption exponents, one can factor N when the
decryption exponents d i < N δ , for 1 ≤ i ≤ n, where
δ <
⎧
⎪⎨
⎪⎩
{ }
(2n+1)·2 n −(2n+1)( n min
2
)
(2n−2)·2 n +(4n+2)( n 2
) ,0.5
min
{ (2n+1)·2 n −4n·( n−1
n−1
)
2
(2n−2)·2 n +8n·( n−1
n−1
2 ),0.5 }
if n is even
if n is odd
We improved this bound by showing that if n many decryption exponents
(d 1 ,...,d n ) are used with the same N, then RSA is insecure when d i < N 3n−1
4n+4 , for