Factoring Multi-power RSA Modulus N = p ^r q with Partial Known Bits

Abstract

Factoring large integers is a fundamental problem in algebraic number theory and modern cryptography, which many cryptosystems, e.g. RSA, are based on. Up to now, there is no known polynomial-time algorithm to solve it with classical computers. However, in practice side-channel attacks usually cause serious damage: Even if a small proportion of bits in the secret primes is leaked, one may efficiently factor.

In this paper, we study the problem of factoring with partial known bits for multi-power RSA modulus N = p ^r q. In 1999, Boneh, Durfee and Howgrave-Graham showed that this problem can be solved efficiently given a $\frac{1}{r+1}$-fraction of the most significant bits (MSB) of p. In their attack, the unknown bits are located in one consecutive block. We propose two lattice-based approaches that extend the number of unknown blocks to arbitrary n (n ≥ 1). The advantage of our approaches is that now knowledge of a $\frac{\ln (1+r)}{r}$-fraction of the bits of p is already sufficient (for any n). In fact, our result is a first step towards unifying and extending previous works by Boneh-Durfee-Howgrave (Crypto’99) and Herrmann-May (Asiacrypt’08).