Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 4
Cryptanalysis of RSA with more
than one Decryption Exponent
From the work of Boneh and Durfee [14], we know that one can factor N in
polynomial time when d < N 0.292 . Instead of one decryption exponent, consider
that n many decryption exponents (d 1 ,...,d n ) are used with the same N. Let
(e 1 ,e 2 ,...,e n ) be their corresponding public exponents. As explained in [60, Page
121] such a situation can arise if a person is using the same RSA modulus N, but
different exponents d i to sign different messages. It has been shown by Howgrave-
Graham and Seifert [62] that in case of n many decryption exponents, one can
factor N efficiently when d i < N δ , for 1 ≤ i ≤ n, where
⎧
(2n+1)·2 n −(2n+1) ( )
n
n/2
⎪⎨ (2n−2)·2 n +(4n+2) ( )
n
if n is even.
n/2
δ <
)
(2n+1)·2 −4n·( n n−1
(n−1)/2
⎪⎩
)
(2n−2)·2 +8n·( n n−1
if n is odd.
(n−1)/2
(4.1)
However, Hinek et al [55, Section 5] proved that one needs to satisfy another
condition for the idea of [62] to work. That condition makes the upper bound of
decryption exponents d i < √ N for 1 ≤ i ≤ n.
We show in this chapter that if n many decryption exponents (d 1 ,...,d n ) are
used with the same N, then RSA is insecure when d i < N 3n−1
4n+4 , for 1 ≤ i ≤ n
and n ≥ 2. Our result improves the bound of Howgrave-Graham and Seifert [62].
The time complexity of our technique as well as that of [62] is polynomial in the
63