Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 5
Reconstruction of Primes given
few of its Bits
An extensive amount of research has been done in RSA factorization and we refer
the reader to the survey papers by Boneh [11] and May [84] for a complete
account. One major class of RSA attacks exploit partial knowledge of the RSA
secret keys or the primes. Rivest and Shamir [109] pioneered these attacks using
Integer Programming and factored RSA modulus given two-third of the LSBs of
a factor. Later, a seminal paper [24] by Coppersmith proved that factorization of
the RSA modulus can be achieved given half of the MSBs of a factor. His method
used LLL [77] lattice reduction technique to solve for small solutions to modular
equations. This method triggered a host of research in the field of lattice based
factorization, e.g., the works by Howgrave-Graham [59], Jochemsz and May [65].
These results require knowledge of contiguous blocks of bits of the RSA secret
keysortheprimes. However,inanactualpracticalscenarioofside-channelattacks,
it is more likely that an adversary will gain the knowledge of random bits of
the RSA parameters instead of contiguous blocks. In fact, the cold-boot attack
proposed by Halderman et al [46] in 2009 was mounted to recover random bits of
RSA secret parameters exploiting data remanence in the computer memory. Thus
the motivation comes from side channel attack on RSA where some bits of p and
q are revealed but not the entire key. In this model, the application of the earlier
factorization methods prove insufficient, and one requires a way to extract more
information out of the random bits obtained via the side channel attacks. In [51],
it has been shown how N can be factored with the knowledge of a random subset
75