Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 3: A class of Weak Encryption Exponents in RSA 48
• The bound on Y can be extended till N γ , with
γ < 4ατ
⎛ √ (
⎝ 1
4τ + 1 1
12α − 4τ + 1 ) 2
+ 1
12α 2ατ
( 1
12 + τ
24α − α ) ⎞ ⎠,
8τ
given e = N α and |N −(p−u)(q −v)| = N τ .
• The only constraint on X is to satisfy the equation eX−(p−u)(q−v)Y = 1,
which gives
X =
1+(p−u)(q −v)Y
e
, i.e., X = ⌈N 1+γ−α ⌉.
• In [96], the constraint 1 ≤ Y < X < 2 −1 4N 1 4 forces that the upper bound of
e is O(N). However, in our case the value of e can exceed this bound. Our
results work for e up to N 1.875 for τ = 1 2 .
In fact, our result is more general. Instead of considering some specific form
eX − (p − u)(q − v)Y = 1, we consider equations like eX − ZY = 1, where
Z = ψ(p,q,u,v) is a function of the RSA primes p,q and integers u,v. Given
e = N α and the constraint |N −Z| = N τ , we can efficiently find Z using the LLL
algorithm when |Y| = N γ , where
γ < 4ατ
⎛ √ (
⎝ 1
4τ + 1 1
12α − 4τ + 1 ) 2
+ 1
12α 2ατ
( 1
12 + τ
24α − α ) ⎞ ⎠.
8τ
We consider Z = ψ(p,q,u,v) = N − pu − v to present a new class of weak keys
in RSA. This idea does not require any kind of factorization as used in [96]. We
estimate a lower bound of N 0.75−ǫ for the number of weak keys in this class. Hence
the number of weak exponents is of the same magnitude as Blömer and May [9].
3.1 Our Basic Technique
In this section we build the framework for our analysis related to weak keys. First
we present a result based on continued fraction (CF) expansions.