Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

More documents

Recommendations

Info

57 3.3 A New Class of Weak Keys 8975911152337295179208385986195123683049905106852500834430037397316270 0864249336588337032797599912676619611066951994203277539744143449608166 337312588384073377751. Then the continued fraction of e gives X,Y (respectively) as N 1684996666696914987166688442938726917102321526408785780068975640579, 1675051614915381290330108388747571693885770140577513454985303531396. Then we find pu+v as 1455711706935944763346481078909022402000177527246411623972976816582783 4476154028615829072068297700713978442098223807592204425878660324320671 085270850022954001141596160. From pu+v we get p using the idea of Theorem 3.4 as in this case u = 2 52 is not a multiple of q and v = 2 175 is less than N 1 4. Next we give an example using the LLL technique that cannot be done using the technique of Lemma 3.1. Example 3.6. The public exponent e is a 1000-bit integer as follows. 6875161700303375704546089777254797601588535353918071259131130001533282 9990657553375889250468602806539681604179662083731636763206733203004319 5254536198882701786034369526609680993429591977911304810695130485689008 4599364131003915783164223278468592950590533634401668968574079388141851 069809468480532614755. Using Theorem 3.2 we get Y (a 240 bit integer) as follows. 1743981747042138853816214839550693531666858348727675018411981662762169 193. We also get pu+v (a 552 bit integer) as follows. 1455711706935944763346481078909022402000177527246411623972976816582783 4476154028615829072068297700713978442098223807592204425878660324320671 085270850022954001141596160. In this case u,v are same as in Example 3.5 and hence p can be found using the idea of Theorem 3.4. It is to note that in this case X is a 241 bit integer 17668470647783843295832975007429185158274838968756189581216062012 92619790. Note that ⌈ N pu+v ⌉ is a 448-bit integer. Now 2XY should be less than 448 bit for a success using the technique of Lemma 3.1, which is not possible as X,Y are
Chapter 3: A class of Weak Encryption Exponents in RSA 58 241 and 240 bit integers respectively. Thus the idea of continued fraction method can not be applied here. Now we like to point out that the weak key of Example 3.6 is not covered by the works of [9,31,130]. In this case, the decryption exponent d is a 999-bit integer and hence the bound of [130] that d < 1 3 N 1 4 will not work here. Here p−q > N 0.48 and according to [31, Section 6] one can consider β = 0.48. If √ d = N δ , then according to [31, Section 6] the bound of δ will be 2−4β < δ < 1− 2β − 1 for RSA to be insecure. Putting β = 0.48, one can get 0.08 < δ < 0.3217, 2 which is much smaller than 0.999 (in Example 3.6, d ≈ N 0.999 ) and hence the weak keys of [31] does not cover our result. In[9,Theorem4, Section4], ithasbeenshownthatp,q canbefoundinpolynomial time for every N,e satisfying ex+y = kφ(N), with 0 < x ≤ 1 φ(N) N 3 4 and 3 e p−q √ |y| ≤ p−q e ex. According to [9], convergents of the CF expression of φ(N)N 1 4 N−⌊2 √ will N⌋ provide k . For the parameters in Example 3.6, we calculated all the convergents x √ with x ≤ 1 φ(N) N 4 3 p−q and we find that for each such k,x, |ex−kφ(N)| > ex. 3 e p−q φ(N)N 4 1 As y = ex−kφ(N), the bound on |y| is not satisfied. Thus the weak key presented in Example 3.6 is not covered by the work of [9]. Next, we attempt different cases with e = N α having varying α given the same p,q in Example 3.3. As the strategy works for the values u = 2 52 and v = 2 175 (given in Example 3.5), we get N τ = pu + v, which implies τ = 0.552. In the first row of Table 3.3, we present the values of α where e = N α ; the second row provides the theoretical upper bound on γ according to Theorem 3.2, given the values of α in the first row and τ = 0.552; the third row presents the experimental values of γ, which is obtained from the bitsize of Y as found in the experiments. The lattice used in these cases has the parameters m = 7,t = 3,w = 60. α 1 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.72 γ (theory) 0.250 0.311 0.374 0.438 0.504 0.570 0.638 0.706 0.720 γ (exp.) 0.240 0.300 0.362 0.426 0.491 0.555 0.621 – – Table 3.3: Values of γ for τ = 0.552, 100 bit N, and p,q as in Example 3.3. In experiments, we do not get the solutions for these p,q values when α ≥ 1.7 as 1 + γ − α becomes very close to zero and hence X does not exist given the bound of Y. The maximum e for which we get a valid X is of size 1653 bits in
Page 1:
some results on Cryptanalysis of RS
Page 5 and 6:
Abstract In this thesis, we propose
Page 7 and 8:
Acknowledgements There are many peo
Page 9:
To Thaakuma (Grandmother), the firs
Page 12 and 13:
2.3.7 Small Decryption Exponent Att
Page 14 and 15:
7.4 The General Solution for EPACDP
Page 17 and 18:
List of Figures 1.1 Communication o
Page 19 and 20:
Chapter 1: Introduction 2 The motiv
Page 21 and 22:
Chapter 1: Introduction 4 there is
Page 23 and 24: Chapter 1: Introduction 6 Discrete
Page 25 and 26: Chapter 1: Introduction 8 Chapter 5
Page 28 and 29: Chapter 2 Mathematical Preliminarie
Page 30 and 31: 13 2.2 RSA Cryptosystem are impleme
Page 32 and 33: 15 2.2 RSA Cryptosystem • private
Page 34 and 35: 17 2.2 RSA Cryptosystem istic prima
Page 36 and 37: 19 2.2 RSA Cryptosystem Afterfindin
Page 38 and 39: 21 2.2 RSA Cryptosystem integer x <
Page 40 and 41: 23 2.3 Cryptanalysis of RSA to be h
Page 42 and 43: 25 2.3 Cryptanalysis of RSA The att
Page 44 and 45: 27 2.4 Lattice and LLL Algorithm No
Page 46 and 47: 29 2.4 Lattice and LLL Algorithm Wh
Page 48 and 49: 31 2.5 Solving Modular Polynomials
Page 56 and 57: 39 2.6 Solving Integer Polynomials
Page 58 and 59: 41 2.6 Solving Integer Polynomials
Page 60 and 61: 43 2.7 Analysis of the Root Finding
Page 62: 45 2.9 Conclusion 2.9 Conclusion No
Page 65 and 66: Chapter 3: A class of Weak Encrypti
Page 73: Chapter 3: A class of Weak Encrypti
Page 81 and 82: Chapter 4: Cryptanalysis of RSA wit
Page 92 and 93: Chapter 5 Reconstruction of Primes
Page 94 and 95: 77 5.1 LSB Case: Combinatorial Anal
Page 102 and 103: 85 5.2 LSB Case: Lattice Based Tech
Page 104 and 105: 87 5.3 MSB Case: Our Method and its
Page 112 and 113: Chapter 6 Implicit Factorization In
Page 114 and 115: 97 6.1 Implicit Factoring of Two La
Page 116 and 117: 99 6.1 Implicit Factoring of Two La
Page 118 and 119: 101 6.1 Implicit Factoring of Two L
Page 124 and 125:
107 6.2 Two Primes with Shared Cont
Page 126 and 127:
109 6.2 Two Primes with Shared Cont
Page 128 and 129:
111 6.3 Exposing a Few MSBs of One
Page 130 and 131:
113 6.3 Exposing a Few MSBs of One
Page 132 and 133:
Chapter 7 Approximate Integer Commo
Page 134 and 135:
117 7.1 Finding q −1 mod p ≡ Fa
Page 136 and 137:
119 7.2 Finding Smooth Integers in
Page 138 and 139:
121 7.3 Extension of Approximate Co
Page 140 and 141:
123 7.4 The General Solution for EP
Page 142 and 143:
Page 144 and 145:
Page 146 and 147:
Page 148 and 149:
Page 150 and 151:
133 7.5 Sublattice and Generalized
Page 152 and 153:
Page 154 and 155:
Page 156 and 157:
139 7.6 Improved Results for Larger
Page 158 and 159:
141 7.6 Improved Results for Larger
Page 160 and 161:
143 7.7 EGACDP The approach in this
Page 162 and 163:
145 7.7 EGACDP Sinceinthiscasethema
Page 164:
147 7.8 Conclusion poly{loga,k}. Th
Page 167 and 168:
Chapter 8: Conclusion 150 Chapter 3
Page 169 and 170:
Chapter 8: Conclusion 152 p 1 ,p 2
Page 171 and 172:
Chapter 8: Conclusion 154 represent
Page 173 and 174:
Chapter 8: Conclusion 156 Final Wor
Page 175 and 176:
BIBLIOGRAPHY 158 [9] J. Blömer and
Page 177 and 178:
BIBLIOGRAPHY 160 [31] B. de Weger.
Page 179 and 180:
BIBLIOGRAPHY 162 [54] M.J.Hinek. Cr
Page 181 and 182:
BIBLIOGRAPHY 164 [76] A. K. Lenstra
Page 183 and 184:
BIBLIOGRAPHY 166 [97] A. Nitaj. Cry
Page 185:
BIBLIOGRAPHY 168 [121] C. L. Siegel
show all

Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?