Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

More documents

Recommendations

Info

15 2.2 RSA Cryptosystem • private key: (395413,572681). To encrypt a plaintext m = 12345, Alice uses Bob’s public key (13,572681), and calculates c = 12345 13 mod 572681 = 536754 and sends c to Bob. To decrypt c = 536754, Bob calculates 536754 395413 mod 572681 = 12345 = m. However, one may note that if an adversary can factor N, then he/she can find d from the public key (e,N). In Example 2.3, it is not very hard to factor N = 572681 into its prime factors. In practice though, the bitsize of N is taken largeenoughsothatitcannotbefactoredefficientlyusingthecurrentcomputation power. ItisrecommendedtouseN ofbitsize1024ormoretopreventfactorization. Security issues of RSA will be discussed in more details later in this chapter. Example 2.4. In a practical scenario, the RSA parameters will look as follows. p = 846599862936164736402988177812099956013778770876315707836731563770 5880893839981848305923857095440391598629588811166856664047346930517527 891174871536167839, q = 1217643468620406884679731818277104033968965197246189229334942736503 0339100965821711975719883742949180031386696753968921229679623132353468 174200136260738213, N = 10308567936391526757875542896033316178883861174865735387244345263 7137208314161521669308869345882336991188745907630491004512656603926295 3518502967942206721243236328408403417100233192004322468033366480788753 9303481101449158308722791555032457532325542013658355061619621556208246 3591629130621212947471071208931707, e = 2 16 +1 = 65537, and d = 101956309423526004076893177133219940094766772585504692321252302615 1120238295258506352584280960487541607315458593878388760777253827593350 0788233193317652234750616708162985718345962209115090210535366860135950 1135207708372912478251719497009548072271475262211661830196811724409660 406447291034092315494830924578345. The public key will be (e,N) and the private key (d,N), as usual. 2.2.2 Implementation of RSA The practical implementation of the RSA algorithm follows the structure as shown in Algorithm 1. To discuss the implementation cost of RSA in terms of time and
Chapter 2: Mathematical Preliminaries 16 space complexity, one may need to refer back to the basic definitions of asymptotic notations at the beginning of this chapter. 1 2 3 4 5 6 Generate randomly two large primes p,q; Compute N = pq,φ(N) = (p−1)(q −1); Generate e randomly such that gcd(e,φ(N)) = 1; Compute d such that ed ≡ 1 (mod φ(N)); Encryption: m ↦→ m e mod N; Decryption: c ↦→ c d mod N; Algorithm 1: Implementing RSA [126]. Primality Testing In Step 1 of Algorithm 1, one needs to generate large random primes p,q. This is done by generating large random numbers and thereafter testing those for primality. This approach works well due to the Prime Number Theorem (PNT) [126]. Theorem 2.5 (PNT). There are approximately N lnN primes smaller than N. In simpler words, the Prime Number Theorem states that on an average, one will find a prime if he/she chooses lnp many random integers of bitsize l p . The next step is primality test. There are many efficient primality testing algorithms in practice. One may use the Solovay-Strassen Algorithm [123] or the Miller-Rabin Algorithm [90,105] for this purpose. The time complexity of both Solovay-Strassen and Miller-Rabin algorithms is O(lp) 3 to test an l p bit integer. For practical RSA instances, l p will be 512 or 1024-bit integers, and hence both the algorithms work well to test whether a number is prime or not. However, both are probabilistic algorithms, and in practice Miller-Rabin algorithm fares better than the Solovay-Strassen algorithm. This is because the probability of failure of Miller-Rabin test (at most 4 −k for k different candidates) is much less compared to the one for Solovay-Strassen (at most 2 −k for k different candidates). If the Generalized Riemann Hypothesis is true then Miller-Rabin Algorithm can be run deterministically with time complexity O(lp). 5 There are many more probabilistic polynomial time primality test algorithms based on elliptic curves, namely Goldwasser-Kilian [44], Atkin-Morain [6] etc. Finding a deterministic polynomial time primality test was a open question for a long period. In 2002, Agrawal, Kayal and Saxena [3] proposed a determin-
Page 1: some results on Cryptanalysis of RS
Page 5 and 6: Abstract In this thesis, we propose
Page 7 and 8: Acknowledgements There are many peo
Page 9: To Thaakuma (Grandmother), the firs
Page 12 and 13: 2.3.7 Small Decryption Exponent Att
Page 14 and 15: 7.4 The General Solution for EPACDP
Page 17 and 18: List of Figures 1.1 Communication o
Page 19 and 20: Chapter 1: Introduction 2 The motiv
Page 21 and 22: Chapter 1: Introduction 4 there is
Page 23 and 24: Chapter 1: Introduction 6 Discrete
Page 25 and 26: Chapter 1: Introduction 8 Chapter 5
Page 28 and 29: Chapter 2 Mathematical Preliminarie
Page 30 and 31: 13 2.2 RSA Cryptosystem are impleme
Page 34 and 35: 17 2.2 RSA Cryptosystem istic prima
Page 36 and 37: 19 2.2 RSA Cryptosystem Afterfindin
Page 38 and 39: 21 2.2 RSA Cryptosystem integer x <
Page 40 and 41: 23 2.3 Cryptanalysis of RSA to be h
Page 42 and 43: 25 2.3 Cryptanalysis of RSA The att
Page 44 and 45: 27 2.4 Lattice and LLL Algorithm No
Page 46 and 47: 29 2.4 Lattice and LLL Algorithm Wh
Page 48 and 49: 31 2.5 Solving Modular Polynomials
Page 56 and 57: 39 2.6 Solving Integer Polynomials
Page 58 and 59: 41 2.6 Solving Integer Polynomials
Page 60 and 61: 43 2.7 Analysis of the Root Finding
Page 62: 45 2.9 Conclusion 2.9 Conclusion No
Page 65 and 66: Chapter 3: A class of Weak Encrypti
Page 81 and 82: Chapter 4: Cryptanalysis of RSA wit
Page 83 and 84:
Chapter 4: Cryptanalysis of RSA wit
Page 85 and 86:
Page 87 and 88:
Page 89 and 90:
Page 92 and 93:
Chapter 5 Reconstruction of Primes
Page 94 and 95:
77 5.1 LSB Case: Combinatorial Anal
Page 96 and 97:
Page 98 and 99:
Page 100 and 101:
Page 102 and 103:
85 5.2 LSB Case: Lattice Based Tech
Page 104 and 105:
87 5.3 MSB Case: Our Method and its
Page 106 and 107:
Page 108 and 109:
Page 110 and 111:
Page 112 and 113:
Chapter 6 Implicit Factorization In
Page 114 and 115:
97 6.1 Implicit Factoring of Two La
Page 116 and 117:
99 6.1 Implicit Factoring of Two La
Page 118 and 119:
101 6.1 Implicit Factoring of Two L
Page 120 and 121:
Page 122 and 123:
Page 124 and 125:
107 6.2 Two Primes with Shared Cont
Page 126 and 127:
109 6.2 Two Primes with Shared Cont
Page 128 and 129:
111 6.3 Exposing a Few MSBs of One
Page 130 and 131:
113 6.3 Exposing a Few MSBs of One
Page 132 and 133:
Chapter 7 Approximate Integer Commo
Page 134 and 135:
117 7.1 Finding q −1 mod p ≡ Fa
Page 136 and 137:
119 7.2 Finding Smooth Integers in
Page 138 and 139:
121 7.3 Extension of Approximate Co
Page 140 and 141:
123 7.4 The General Solution for EP
Page 142 and 143:
Page 144 and 145:
Page 146 and 147:
Page 148 and 149:
Page 150 and 151:
133 7.5 Sublattice and Generalized
Page 152 and 153:
Page 154 and 155:
Page 156 and 157:
139 7.6 Improved Results for Larger
Page 158 and 159:
141 7.6 Improved Results for Larger
Page 160 and 161:
143 7.7 EGACDP The approach in this
Page 162 and 163:
145 7.7 EGACDP Sinceinthiscasethema
Page 164:
147 7.8 Conclusion poly{loga,k}. Th
Page 167 and 168:
Chapter 8: Conclusion 150 Chapter 3
Page 169 and 170:
Chapter 8: Conclusion 152 p 1 ,p 2
Page 171 and 172:
Chapter 8: Conclusion 154 represent
Page 173 and 174:
Chapter 8: Conclusion 156 Final Wor
Page 175 and 176:
BIBLIOGRAPHY 158 [9] J. Blömer and
Page 177 and 178:
BIBLIOGRAPHY 160 [31] B. de Weger.
Page 179 and 180:
BIBLIOGRAPHY 162 [54] M.J.Hinek. Cr
Page 181 and 182:
BIBLIOGRAPHY 164 [76] A. K. Lenstra
Page 183 and 184:
BIBLIOGRAPHY 166 [97] A. Nitaj. Cry
Page 185:
BIBLIOGRAPHY 168 [121] C. L. Siegel
show all

Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?