Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...
Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...
Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Chapter 3: A class <strong>of</strong> Weak Encryption Exponents in <strong>RSA</strong> 52<br />
3.2 Improvements over Existing Work<br />
In this section we present various improvements over the work <strong>of</strong> [96]. For this,<br />
first we present an outline <strong>of</strong> the strategy in [96]. Consider that [ e satisfies ] eX −<br />
(p−u)(q −v)Y = 1 with 1 ≤ Y < X < 2 −1 4N 1 4, |u| < N 4, 1 v = − qu . If all the<br />
p−u<br />
prime factors <strong>of</strong> p−u or q−v are less than 10 50 , then N can be factored from the<br />
knowledge <strong>of</strong> N,e. The number <strong>of</strong> such weak exponents are estimated as N 1 2 −ǫ .<br />
The flow <strong>of</strong> the algorithm in [96] is as follows.<br />
1. Continued Fraction algorithm is used to find the unknowns X,Y among the<br />
convergents <strong>of</strong> e N .<br />
2. Then, the Elliptic Curve <strong>Factorization</strong> Method (ECM [79]) is used to partially<br />
factor eX−1<br />
Y<br />
, i.e., into the factors (p−u)(q −v).<br />
3. Next, an integer relation detection algorithm (LLL [77]) is used to find the<br />
divisors <strong>of</strong> B ecm -smooth part <strong>of</strong> eX−1<br />
Y<br />
in a small interval.<br />
4. Finally, if p−u or q −v is found, the method due to [24] is applied.<br />
After knowing (p−u)(q −v), if one gets the factorization <strong>of</strong> p−u or q −v, then<br />
it is possible to identify p − u or q − v efficiently and the overall complexity is<br />
dominated by the time required for factorization. According to [96], if ECM [79]<br />
is used for factorization, and if all prime factors <strong>of</strong> p−u or q−v are less than 10 50 ,<br />
then getting p−u or q −v is possible in moderate time. Once p−u or q −v is<br />
found, as u,v are <strong>of</strong> the order <strong>of</strong> N 1 4, using the technique <strong>of</strong> [24], it is possible to<br />
find p or q efficiently.<br />
3.2.1 The Improvement in the Bounds <strong>of</strong> X,Y<br />
In [96] the bounds <strong>of</strong> X and Y are given as 1 ≤ Y < X < 2 −1 4N 1 4. Since, u,v are<br />
<strong>of</strong> O(N 1 4), we get that (p − u)(q − v) is O(N). When e is O(N 1+µ ), µ > 0 and<br />
X is O(N ν ), 0 < ν ≤ 1 4 , the value <strong>of</strong> eX is O(N1+µ+ν ). In such a case, Y will be<br />
O(N µ+ν ), which is not possible as Y < X. Thus the values <strong>of</strong> e are bounded by<br />
O(N) in the work <strong>of</strong> [96]. Next we generalize the bounds on X,Y.<br />
The method <strong>of</strong> [96] requires 1 ≤ Y < X < 2 −1 4N 1 4. For τ = 1 , our result<br />
2<br />
in Lemma 3.1 implies that it is enough to have 2XY < N 2, 1 which gives better<br />
bounds than [96] due to the following reasons.