Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 4: Cryptanalysis of RSA with more than one Decryption Exponent 64
bitsize of N and exponential in the number of decryption exponents n. Putting
n = 2, we find δ < 0.416. However, for this special case of n = 2, we show that our
strategy can extend the bound till δ < 0.422. Our result has another component
that it takes care of the case when some of the most significant bits (MSBs) of the
decryptionexponentsaresame(butunknown). Thisimplicitinformationincreases
the bounds on the decryption exponents even further. We present experimental
results to support our claim. As explained in the introduction of [62], we also agree
that studying this kind of cryptanalysis may not have direct impact to RSA used
in practice. However, there are few issues for which this problem is interesting.
• This shows how one can find further weaknesses of RSA with additional
public information – in this case more than one encryption exponents.
• Moreover, this shows how one can extend the ideas of [15,130], where a single
encryption exponent is considered, to more than one exponents.
4.1 Theoretical Result
We need the following technical result that will be used later. A general treatment
in this direction is available in [63, Theorem 1, Page 230].
Lemma 4.1. For any fixed positive integer r ≥ 1, and a large integer m,
m∑
t=1
t r = mr+1
r+1 +o(mr+1 ).
Proof. Let S = 1 r +2 r +...+m r . Then we have
∫ m
0
x r dx < S <
∫ m+1
1
x r dx
⇒ mr+1
r+1 < S < (m+1)r+1 −1
r+1
⇒ mr+1
r+1 < S < (m+1)r+1 .
r +1
Now, (m+1)r+1
r+1
− mr+1
r+1 contains the terms mi for i ≤ r. Thus, for a fixed r and large
m, one can write
S = mr+1
r+1 +o(mr+1 ).