A Generalized Wiener Attack on RSA
نویسندگان
چکیده
We present an extension of Wiener’s attack on small RSA secret decryption exponents [10]. Wiener showed that every RSA public key tuple (N, e) with e ∈ ∗ φ(N) that satisfies ed − 1 = 0 mod φ(N) for some d < 1 3 N 1 4 yields the factorization of N = pq. Our new method finds p and q in polynomial time for every (N, e) satisfying ex + y = 0 mod φ(N) with x < 1 3 N 1 4 and |y| = O(N− 3 4 ex). In other words, the generalization works for all secret keys d = −xy, where x, y are suitably small. We show that the number of these weak keys is at least N 3 4 − and that the number increases with decreasing prime difference p − q. As an application of our new attack, we present the cryptanalysis of an RSA-type scheme presented by Yen, Kim, Lim and Moon [11, 12]. Our results point out again the warning for cryptodesigners to be careful when using the RSA key generation process with special parameters.
منابع مشابه
A generalized attack on RSA type cryptosystems
Let N = pq be an RSA modulus with unknown factorization. Some variants of the RSA cryptosystem, such as LUC, RSA with Gaussian primes and RSA type schemes based on singular elliptic curves use a public key e and a private key d satisfying an equation of the form ed − k ( p − 1 ) ( q − 1 ) = 1. In this paper, we consider the general equation ex− ( p − 1 ) ( q − 1 ) y = z and present a new attack...
متن کاملA Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants
We describe a strategy for finding small modular and integer roots of multivariate polynomials using lattice-based Coppersmith techniques. Applying our strategy, we obtain new polynomial-time attacks on two RSA variants. First, we attack the Qiao-Lam scheme that uses a Chinese Remaindering decryption process with a small difference in the private exponents. Second, we attack the so-called Commo...
متن کاملOn the Improvement of Wiener Attack on RSA with Small Private Exponent
RSA system is based on the hardness of the integer factorization problem (IFP). Given an RSA modulus N = pq, it is difficult to determine the prime factors p and q efficiently. One of the most famous short exponent attacks on RSA is the Wiener attack. In 1997, Verheul and van Tilborg use an exhaustive search to extend the boundary of the Wiener attack. Their result shows that the cost of exhaus...
متن کاملEstimating the Prime-Factors of an RSA Modulus and an Extension of the Wiener Attack
In the RSA system, balanced modulus N denotes a product of two large prime numbers p and q, where q < p < 2q. Since IntegerFactorization is difficult, p and q are simply estimated as √ N . In the Wiener attack, 2 √ N is adopted to be the estimation of p+ q in order to raise the security boundary of private-exponent d. This work proposes a novel approach, called EPF, to determine the appropriate...
متن کاملConverse Results to the Wiener Attack on RSA
A well-known attack on RSA with low secret-exponent d was given by Wiener about 15 years ago. Wiener showed that using continued fractions, one can efficiently recover the secret-exponent d from the public key (N, e) as long as d < N. Interestingly, Wiener stated that his attack may sometimes also work when d is slightly larger than N . This raises the question of how much larger d can be: coul...
متن کامل