International Workshop on Public Key Cryptography

PKC 2011: Public Key Cryptography – PKC 2011 pp 147-155

Cryptanalysis of the RSA Subgroup Assumption from TCC 2005

  • Jean-Sébastien Coron
  • Antoine Joux
  • Avradip Mandal
  • David Naccache
  • Mehdi Tibouchi
Conference paper

DOI: 10.1007/978-3-642-19379-8_9

Volume 6571 of the book series Lecture Notes in Computer Science (LNCS)

Abstract

At TCC 2005, Groth underlined the usefulness of working in small RSA subgroups of hidden order. In assessing the security of the relevant hard problems, however, the best attack considered for a subgroup of size 22ℓ had a complexity of O(2). Accordingly, ℓ= 100 bits was suggested as a concrete parameter.

This paper exhibits an attack with a complexity of roughly 2ℓ/2 operations, suggesting that Groth’s original choice of parameters was overly aggressive. It also discusses the practicality of this new attack and various implementation issues.

Keywords

rsa modulihidden ordersubgroupcryptanalysis
Download to read the full conference paper text

Copyright information

© International Association for Cryptologic Research 2011

Authors and Affiliations

  • Jean-Sébastien Coron
    • 1
  • Antoine Joux
    • 2
    • 3
  • Avradip Mandal
    • 1
  • David Naccache
    • 4
  • Mehdi Tibouchi
    • 1
    • 4
  1. 1.Université du LuxembourgLuxembourgLuxembourg
  2. 2.Direction générale de l’armement (DGA)France
  3. 3.Laboratoire PRISMUniversité de Versailles–Saint-QuentinVersailles CedexFrance
  4. 4.Département d’informatique, Groupe de cryptographieÉcole normale supérieureParis Cedex 05France