Generalized cryptanalysis of RSA with small public exponent

Abstract

In this paper, we demonstrate that there exist weak keys in the RSA public-key cryptosystem with the public exponent e = N ^α ≤ N ^0.5. In 1999, Boneh and Durfee showed that when α ≈ 1 and the private exponent d = N ^β < N ^0.292, the system is insecure. Moreover, their attack is still effective for 0.5 < α < 1.875. We propose a generalized cryptanalytic method to attack the RSA cryptosystem with α ≤ 0.5. For $c = \left\lfloor {\frac{{1 - \alpha }}{\alpha }} \right\rfloor$ and e ^γc ≡ d (mod e ^c), when γ, β satisfy $\gamma < 1 + \frac{1}{c} - \frac{1}{{2\alpha c}}and\beta < \alpha c + \frac{7}{6} - \alpha \gamma c - \frac{1}{3}\sqrt {6\alpha + 6\alpha c + 1 - 6\alpha \gamma c}$, we can perform cryptanalytic attacks based on the LLL algorithm. The basic idea is an application of Coppersmith’s techniques and we further adapt the technique of unravelled linearization, which leads to an optimized lattice. Our advantage is that we achieve new attacks on RSA with α ≤ 0.5 and consequently, there exist weak keys in RSA for most α.

摘要

创新点

本文分析了RSA算法中当公钥e小于等于N的0.5次幂时可能存在的弱密钥攻击。一方面, 改进了之前当d大于e时的攻击方法, 提出了可以用于分析e小于等于N的0.5次幂时的广义攻击。另一方面, 应用展开线性化的技巧, 进一步提出了基于优化的格构造方法下的广义攻击。既可以缩小格的维数, 减少LLL算法的运行时间, 也可以提高理论分析中私钥d应满足的上界。与之前已有的攻击方法对比可以看出, 我们的方法不仅扩大了e的适用范围, 也提高了d的适用范围。