Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

More documents

Recommendations

Info

77 5.1 LSB Case: Combinatorial Analysis of Existing Work the least significant t many bits of both p,q, is as follows. It is easy to see that the correct partial solution till the t many LSBs will exist in the set of all pairs (p t−1 ,q t−1 ) found from Algorithm 7. 1 2 3 4 5 6 7 8 9 10 11 Input: N,t and p[i],q[j], for some random values of i,j Output: Contiguous t many LSBs of p,q Initialize: i = 1 and p 0 = p[0] = 1, q 0 = q[0] = 1 (as both are odd); for all (p i−1 ,q i−1 ) do for all possible (p[i],q[i]) do p i := APPEND(p[i],p i−1 ); q i := APPEND(q[i],q i−1 ); if N ≡ p i q i (mod 2 i+1 ) then ADD the pair (p i ,q i ) at level i; end end end if i < t−1 then i := i+1; GOTO Step 2; end REPORT all (p t−1 ,q t−1 ) pairs; Algorithm 7: The search algorithm. As one may notice, there are at most 4 possible choices for (p[i],q[i]) branches at any level i. Algorithm 7 works with all possible combinations of the bits p[i],q[i] atleveliandhenceonemaywanttoobtainarelationbetweenp[i]andq[i]interms of the known values of N,p i−1 ,q i−1 so that it poses a constraint on the possibilities. Heninger and Shacham [50, Section 4] uses Multivariate Hensel’s Lemma to obtain such a relation p[i]+q[i] ≡ (N −p i−1 q i−1 )[i] (mod 2). (5.1) Now, this linear relation between p[i],q[i] restricts the possible choices for the bits. Thus, at any level i, instead of 4 possibilities, the number cuts down to 2. If we construct the search tree, then these possibilities for the bits at any level give rise to new branches in the tree. The tree at any level i contains all the partial solutions p i ,q i up to the i-th LSB (the correct partial solution is one among them). It is quite natural to restrict the number of potential candidates (i.e., the partial solutions) at any level so that the correct one can be found easily by exhaustive search among all the solutions and the space to store all these solutions is within
Chapter 5: Reconstruction of Primes given few of its Bits 78 certain feasible limit. This calls for restricting the width of the search tree at each level. Let us denote the width of the tree at level i by W i . Now we take a look at the situations (depending on the knowledge of the random bits of the primes) that control the branching behavior of the tree. 5.1.2 Growth of the Search Tree Consider the situation where we have a pair of partials (p i−1 ,q i−1 ) and do not have any information of (p[i],q[i]) in Step 3 of Algorithm 7. Naturally there are 4 options, (0,0),(0,1),(1,0) and (1,1) for getting (p i ,q i ). However, Equation (5.1) and the knowledge of N, p i−1 , q i−1 impose a linear dependence between p[i],q[i] and hence restrict the number of choices to exactly 2. If (N −p i−1 q i−1 )[i] = 0 then we have p[i] + q[i] ≡ 0 (mod 2) and (N −p i−1 q i−1 )[i] = 1 implies p[i] + q[i] ≡ 1 (mod 2). Hence the width of the tree at this level will be twice the width of the tree at the previous one, as shown in Figure 5.1. (0, 0) (1, 1) (1, 0) (0, 1) p[i]+q[i] ≡ 0 (mod 2) p[i]+q[i] ≡ 1 (mod 2) Figure 5.1: Branching when both the bits p[i],q[i] are unknown. Next, let us have a look at the situation when exactly one of p[i],q[i] is known. First, the number of branches restricts to 2 by Equation (5.1), as discussed before. Moreover, the knowledge of one bit fixes the other in this relation. For example, if one knows the value of p[i] along with N,p i−1 ,q i−1 in Equation (5.1), then q[i] gets determined. Thus the number of choices for p[i],q[i] and hence the number of p i ,q i branches reduces to a single one in this case. This branching, which keeps the tree-width fixed, may be illustrated as in Figure 5.2 (p[i] = 0 is known, say). Though the earlier two cases are easy to understand, the situation is not so simple when both p[i],q[i] are known. In this case, the validity of Equation (5.1) comes under scrutiny. If we fit in all the values p[i],q[i],N,p i−1 ,q i−1 in Equation (5.1) and it is satisfied, then we accept the new partial solution p i ,q i at level i
Page 1:
some results on Cryptanalysis of RS
Page 5 and 6:
Abstract In this thesis, we propose
Page 7 and 8:
Acknowledgements There are many peo
Page 9:
To Thaakuma (Grandmother), the firs
Page 12 and 13:
2.3.7 Small Decryption Exponent Att
Page 14 and 15:
7.4 The General Solution for EPACDP
Page 17 and 18:
List of Figures 1.1 Communication o
Page 19 and 20:
Chapter 1: Introduction 2 The motiv
Page 21 and 22:
Chapter 1: Introduction 4 there is
Page 23 and 24:
Chapter 1: Introduction 6 Discrete
Page 25 and 26:
Chapter 1: Introduction 8 Chapter 5
Page 28 and 29:
Chapter 2 Mathematical Preliminarie
Page 30 and 31:
13 2.2 RSA Cryptosystem are impleme
Page 32 and 33:
15 2.2 RSA Cryptosystem • private
Page 34 and 35:
17 2.2 RSA Cryptosystem istic prima
Page 36 and 37:
19 2.2 RSA Cryptosystem Afterfindin
Page 38 and 39:
21 2.2 RSA Cryptosystem integer x <
Page 40 and 41:
23 2.3 Cryptanalysis of RSA to be h
Page 42 and 43:
25 2.3 Cryptanalysis of RSA The att
Page 44 and 45: 27 2.4 Lattice and LLL Algorithm No
Page 46 and 47: 29 2.4 Lattice and LLL Algorithm Wh
Page 48 and 49: 31 2.5 Solving Modular Polynomials
Page 56 and 57: 39 2.6 Solving Integer Polynomials
Page 58 and 59: 41 2.6 Solving Integer Polynomials
Page 60 and 61: 43 2.7 Analysis of the Root Finding
Page 62: 45 2.9 Conclusion 2.9 Conclusion No
Page 65 and 66: Chapter 3: A class of Weak Encrypti
Page 81 and 82: Chapter 4: Cryptanalysis of RSA wit
Page 92 and 93: Chapter 5 Reconstruction of Primes
Page 96 and 97: 79 5.1 LSB Case: Combinatorial Anal
Page 102 and 103: 85 5.2 LSB Case: Lattice Based Tech
Page 104 and 105: 87 5.3 MSB Case: Our Method and its
Page 112 and 113: Chapter 6 Implicit Factorization In
Page 114 and 115: 97 6.1 Implicit Factoring of Two La
Page 116 and 117: 99 6.1 Implicit Factoring of Two La
Page 118 and 119: 101 6.1 Implicit Factoring of Two L
Page 124 and 125: 107 6.2 Two Primes with Shared Cont
Page 126 and 127: 109 6.2 Two Primes with Shared Cont
Page 128 and 129: 111 6.3 Exposing a Few MSBs of One
Page 130 and 131: 113 6.3 Exposing a Few MSBs of One
Page 132 and 133: Chapter 7 Approximate Integer Commo
Page 134 and 135: 117 7.1 Finding q −1 mod p ≡ Fa
Page 136 and 137: 119 7.2 Finding Smooth Integers in
Page 138 and 139: 121 7.3 Extension of Approximate Co
Page 140 and 141: 123 7.4 The General Solution for EP
Page 142 and 143: 125 7.4 The General Solution for EP
Page 144 and 145:
127 7.4 The General Solution for EP
Page 146 and 147:
Page 148 and 149:
Page 150 and 151:
133 7.5 Sublattice and Generalized
Page 152 and 153:
Page 154 and 155:
Page 156 and 157:
139 7.6 Improved Results for Larger
Page 158 and 159:
141 7.6 Improved Results for Larger
Page 160 and 161:
143 7.7 EGACDP The approach in this
Page 162 and 163:
145 7.7 EGACDP Sinceinthiscasethema
Page 164:
147 7.8 Conclusion poly{loga,k}. Th
Page 167 and 168:
Chapter 8: Conclusion 150 Chapter 3
Page 169 and 170:
Chapter 8: Conclusion 152 p 1 ,p 2
Page 171 and 172:
Chapter 8: Conclusion 154 represent
Page 173 and 174:
Chapter 8: Conclusion 156 Final Wor
Page 175 and 176:
BIBLIOGRAPHY 158 [9] J. Blömer and
Page 177 and 178:
BIBLIOGRAPHY 160 [31] B. de Weger.
Page 179 and 180:
BIBLIOGRAPHY 162 [54] M.J.Hinek. Cr
Page 181 and 182:
BIBLIOGRAPHY 164 [76] A. K. Lenstra
Page 183 and 184:
BIBLIOGRAPHY 166 [97] A. Nitaj. Cry
Page 185:
BIBLIOGRAPHY 168 [121] C. L. Siegel
show all

Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?