Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

21 2.2 RSA Cryptosystem
integer x < p 1 p 2 = 6 such that x ≡ a 1 (mod p 1 ) and x ≡ a 2 (mod p 2 ). One can
check x = 5 uniquely satisfies such conditions.
Let us now describe the CRT-RSA model. Recall that the decryption key in
RSA is (d,N). In CRT-RSA, the decryption key is (d p ,d q ,p,q) where
d p ≡ d mod p−1 and d q ≡ d mod q −1.
In the decryption phase of CRT-RSA, one have to first calculate
c p ≡ c dp (mod p) and c q ≡ c dq (mod q).
Note that m ≡ c d ≡ c dp ≡ c p (mod p) by Fermat’s little Theorem [126], as d p ≡
d mod p−1. Similarly, m ≡ c q (mod q). Using c p ,c q ,p and q, one can find unique
solution for m mod N using Chinese Remainder Theorem (CRT), as follows.
m = ( c q + ( (c p −c q )× ( q −1 mod p ) mod p ) ×q ) mod N.
Example 2.8. Consider Example 2.3 in RSA, with p = 653,q = 877,N =
572681,e = 13 and d = 395413. In this case d p = 301 and d q = 337. So when Bob
gets the ciphertext c = 536754 as in Example 2.3, he first calculates
c p = 536754 301 mod 653 = 591 and c q = 536754 337 mod 877 = 67.
After finding c p and c q , Bob gets the plaintext m = 12345 using CRT on c p =
591,c q = 67,p = 653 and q = 877.
Note that the computation of m involves 1 modular subtraction (modulo p),
1 modular addition (modulo N) and 2 modular multiplications (modulo p and
N). Each of these operations is very fast in practice. The most time consuming
operation in the formula is the modular inversion q −1 mod p. Hence, to make the
calculation of m faster, q −1 mod p is stored as a part of the CRT-RSA decryption
keys. As l p ≈ l q ≈ l N
2
and the computations in CRT-RSA are performed modulo
p,q instead of modulo N, the decryption phase in CRT-RSA is four times faster
than RSA (three times if RSA uses Karatsuba multiplication [87] techniques).