Attacking Power Generators Using Unravelled Linearization: When Do We Output Too Much?

  • Mathias Herrmann
  • Alexander May
Conference paper

DOI: 10.1007/978-3-642-10366-7_29

Part of the Lecture Notes in Computer Science book series (LNCS, volume 5912)
Cite this paper as:
Herrmann M., May A. (2009) Attacking Power Generators Using Unravelled Linearization: When Do We Output Too Much?. In: Matsui M. (eds) Advances in Cryptology – ASIACRYPT 2009. ASIACRYPT 2009. Lecture Notes in Computer Science, vol 5912. Springer, Berlin, Heidelberg

Abstract

We look at iterated power generators \(s_i = s_{i-1}^e {\rm mod} N\) for a random seed s0 ∈ ℤN that in each iteration output a certain amount of bits. We show that heuristically an output of \((1-\frac 1 e)\log N\) most significant bits per iteration allows for efficient recovery of the whole sequence. This means in particular that the Blum-Blum-Shub generator should be used with an output of less than half of the bits per iteration and the RSA generator with e = 3 with less than a \(\frac 1 3\)-fraction of the bits.

Our method is lattice-based and introduces a new technique, which combines the benefits of two techniques, namely the method of linearization and the method of Coppersmith for finding small roots of polynomial equations. We call this new technique unravelled linearization.

Keywords

power generator lattices small roots systems of equations 
Download to read the full conference paper text

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Mathias Herrmann
    • 1
  • Alexander May
    • 1
  1. 1.Horst Görtz Institute for IT-Security, Faculty of MathematicsRuhr University BochumGermany

Personalised recommendations