Cryptanalysis of Short Exponent RSA with Primes Sharing Least Significant Bits

LSBS-RSA denotes an RSA system with modulus primes, p and q, sharing a large number of least signi…cant bits. In ISC 2007, Zhao and Qi analyzed the security of short exponent LSBS-RSA. They claimed that short exponent LSBS-RSA is much more vulnerable to the lattice attack than the standard RSA. In this paper, we point out that there exist some errors in the calculation of Zhao & Qi’s attack. After re-calculating, the result shows that their attack is unable for attacking RSA with primes sharing bits. Consequently, we give a revised version to make their attack feasible. We also propose a new method to further extend the security boundary, compared with the revised version. The proposed attack also supports the result of analogue Fermat factoring on LSBS-RSA, which claims that p and q cannot share more than n 4 least signi…cant bits, where n is the bit-length of pq. In conclusion, it is a trade-o¤ between the number of sharing bits and the security level in LSBS-RSA. One should be more careful when using LSBS-RSA with short exponents. Keywords: RSA, least signi…cant bits (LSBs), LSBS-RSA, short exponent attack, lattice reduction technique, the Boneh-Durfee attack.