Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 3
A class of Weak Encryption
Exponents in RSA
A lot of weakness of RSA have been identified in the past three decades, but still
RSA can be securely used with proper precautions as a public key cryptosystem.
In 1990, Wiener [130] proved that RSA is insecure if d < 1 3 N 1 4. Later 1999,
Boneh and Durfee [14] improved this bound up to N 0.292 . In [9], Blömer and May
have shown that p,q can be found in polynomial time for every (N,e) satisfying
eX + φ(N)Y = −y, with X ≤ 1 3 N 1 4 and |y| = O(N −3 4ex). Some extensions
considering the difference p−q have also been studied. The work of [9] uses the
result of Coppersmith [24] as well as the idea of CF expression [130] in their proof.
The number of such weak keys has been estimated as N 3 4 −ǫ .
In a similar direction of [9], further weak keys were presented by Nitaj [96,97].
The idea of [96] is as follows. Suppose that e satisfies the following property: there
exist u,v,X,Y[
such that ] eX −(p−u)(q −v)Y = 1 with 1 ≤ Y < X < 2 −1 4N 4,
1
|u| < N 1 4, v = − qu ([x] means the nearest integer of the real number x). If all
p−u
the prime factors of p−u or q−v are less than 10 50 , then N can be factored from
the knowledge of N,e. The number of such weak exponents is estimated as N 1 2 −ǫ .
So, in this case [96] number of weak exponents is smaller than [9].
In [96], Continued Fraction (CF) expression is used to find the unknowns X,Y
e
among the convergents of . We get immediate improvements over the results
N
of [96] using the LLL [77] algorithm. Our results are as follows.
47