Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

155 8.3 Open Problems
Problem 8.3. Is there any polynomial time algorithm to factor N with encryption
exponents of order N if d pi > N 0.073 and d qi > N 0.073 for 1 ≤ i ≤ k?
8.3.3 Reconstruction of Primes
The terms {p,q,d,d p ,d q ,q −1 (mod p)} are stored as a part of the secret key in
PKCS #1 [99] to expedite the decryption in CRT-RSA. Now, one may note
from Chapter 5 that Heninger and Shacham [50] used random known bits of
{p,q,d,d p ,d q }, and our work uses bits of {p,q} to factorize N. None of the methods
could utilize the knowledge of q −1 mod p to factor N. In Chapter 7, we have
proved that knowing q −1 mod p completely is equivalent to factoring N. But, we
do not have any results if one knows some random bits of q −1 mod p. In the presentation
of the paper [50] at Crypto 2009, this problem was also asked. In this
line, let us present the following two open questions.
Problem 8.4. Can one use some known random bits of q −1 mod p to factor N?
Problem 8.5. Does the knowledge of random bits of q −1 mod p reduce the required
number of bits to be known for other private keys in case of factoring N?
In Chapter 5, we studied the case when random bits are known from the lower
half of p and q. However consider the situation when random bits are known from
the upper half of p and q. Hence, we have the following question.
Problem 8.6. Can one factor N when random bits are known from the upper half
of p and q?
8.3.4 Implicit Factorization
In PKC 2009, May and Ritzenhofen [86] introduced the problem of implicit factorization.
They presents some results when few LSBs of the secret primes are same.
They also extend their results for balanced RSA moduli. That is for the case
N 1 = p 1 q 1 ,N 2 = p 2 q 2 ,...,N k = p k q k , with p i and q i are of same bitsize and few
LSBs of p 1 ,...,p k are same. In Chapter 6 and Chapter 7 we analyze the situation
when p 1 ,...,p k share their MSBs. However, we can not extend our ideas for the
balanced case. Hence, we leave the following open question.
Problem 8.7. Can one factor k balanced RSA moduli N 1 ,...,N k in polynomial
time when p 1 ,...,p k share their MSBs?