Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 2: Mathematical Preliminaries 20
Input: x,y,N
Output: x y mod N
1 z = y,u = 1,v = x;
2 while z > 0 do
3 if z ≡ 1 (mod 2) then
4 u = uv mod N;
end
5 = v
endv 2 mod N; z = ⌊ z⌋ ; 2
6
return u.
Algorithm 5: Square and Multiply Algorithm.
2.2.3 Variants of RSA
CRT-RSA
TospeedupthedecryptionphaseofRSA,QuisquaterandCouvreur[103]proposed
the use of Chinese Remainder Theorem (CRT) in the decryption phase. This
variant of RSA is known as CRT-RSA, and it is the most widely accepted version
of RSA in practice. The backbone of the scheme is CRT, stated as follows.
Theorem 2.6 (CRT). Suppose p 1 ,p 2 ,...,p k (k ≥ 2) are pairwise relatively prime
positive integers. Then for any set of integers a 1 ,a 2 ,...,a k , there exists a unique
x < p 1 p 2···p k such that
x ≡ a 1 (mod p 1 ), x ≡ a 2 (mod p 2 ), ..., x ≡ a k (mod p k ).
In case of CRT-RSA, we consider the special case of k = 2. In this scenario, x
can be deduced as follows.
x ≡ a 2 (mod p 2 ) ⇒ x = a 2 +lp 2 for some integer l, and thus
x ≡ a 1 (mod p 1 ) ⇒ a 2 +lp 2 ≡ a 1 (mod p 1 )
⇒ l ≡ (a 1 −a 2 )× ( p −1
2 mod p 1
)
mod p1 .
This value of l, put back into the first congruence, gives the formula for x as
x = a 2 +lp 2 = ( a 2 +((a 1 −a 2 )×(p −1
2 mod p 1 ) mod p 1 )×p 2
)
mod p1 p 2 .
Example 2.7. Take p 1 = 2, p 2 = 3 and a 1 = 1, a 2 = 2. The goal is to find an