Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 3: A class of Weak Encryption Exponents in RSA 56
where there is no involvement of factorization at all. For this, let us first refer to
the following existing result from [83, Theorem 10].
Theorem 3.4 (from [83]). Let N = pq be an RSA modulus with q < p < 2q.
Let u be an (unknown) integer that is not a multiple of q. Suppose we know an
approximation ˆP of pu with |pu − ˆP| ≤ 2N 1 4. Then N can be factorized in time
polynomial in logN.
After finding X and Y from the continued fraction expression (as given in
Lemma 3.1 of e N , one can get N −pu−v and hence pu+v. In our case, the ˆP of
Theorem 3.4 is pu+v. Following Theorem 3.4, if |v| < N 1 4 and u is not a multiple
of q, then one can get p.
Next we present further extension on this class of weak keys using the idea of
Theorem 3.2 and noting Z = ψ(p,q,u,v) = pq − pu − v = N − pu − v. In this
case, |N −Z| = |pu+v| = N τ . When Y = N γ and e = N α then X = ⌈N 1+γ−α ⌉.
This gives, XY = N 1+2γ−α , where
γ < 4ατ
as in Theorem 3.2.
⎛ √ (
⎝ 1
4τ + 1 1
12α − 4τ + 1 ) 2
+ 1
12α 2ατ
( 1
12 + τ
24α − α ) ⎞ ⎠,
8τ
It is clear that when N 1+2γ−α is greater than the bound
N
pu+v = N1−τ of
Lemma 3.1, then we get a larger class of weak keys using the LLL method instead
of the technique using continued fraction expression. This happens when
1+2γ −α > 1−τ, which is true taking the value of the upper bound on γ.
For example, taking α = 1 and τ = 1 the upper bound of γ is 0.284 and in this
2
case XY will be N 0.568 . However, the bound from Lemma 3.1 in this case is N 0.5 .
For larger values of α, the bound on XY will increase further.
3.3.1 Experimental Results
We consider the same N as used in Example 3.3.
Example 3.5. Let us first apply the continued fraction method as explained in
Lemma 3.1. The public exponent e is a 1000-bit number
6924191794904822444331919988065675834958089478755604021224486550741286
9094970482880973033565767568702443953304958933817087359916417417403418