Cryptanalysis of Variants of RSA with Multiple Small Secret Exponents

Abstract

In this paper, we analyze the security of two variants of the RSA public key cryptosystem where multiple encryption and decryption exponents are used with a common modulus. For the most well known variant, CRT-RSA, assume that n encryption and decryption exponents $(e_l,d_{p_l},d_{q_l})$, where $l=1,\cdots ,n$, are used with a common CRT-RSA modulus N. By utilizing a Minkowski sum based lattice construction and combining several modular equations which share a common variable, we prove that one can factor N when $d_{p_l},d_{q_l}<N^{\frac{2n-3}{8n+2}}$ for all $l=1,\cdots ,n$. We further improve this bound to $d_{p_l}(\mathrm {or}\,d_{q_l})<N^{\frac{9n-14}{24n+8}}$ for all $l=1,\cdots ,n$. Moreover, our experiments do better than previous works by Jochemsz-May (Crypto 2007) and Herrmann-May (PKC 2010) when multiple exponents are used. For Takagi’s variant of RSA, assume that n key pairs $(e_l,d_l)$ for $l=1,\cdots ,n$ are available for a common modulus $N=p^rq$ where $r\ge 2$. By solving several simultaneous modular univariate linear equations, we show that when $d_l<N^{(\frac{r-1}{r+1})^{\frac{n+1}{n}}}$, for all $l=1,\cdots ,n$, one can factor the common modulus N.

Appendix

Here we present the detailed calculations of $S_{X_1},S_Y,S_{Z_1},S_{e_1}$.

Let $\sum \limits ^{*}$ denotes $\sum \limits _{i_1=0}^m\cdots \sum \limits _{i_n=0}^m\sum \limits _{j_1=0}^{m-i_1}\cdots \sum \limits _{j_n=0}^{m-i_n}$, for any $0\le a,b\le n$, we have that

$$\begin{aligned} \sum ^{*}i_ai_b= \left\{ \begin{array}{l} \frac{1}{12*2^{n-1}}*m^{2n+2}+o(m^{2n+2}),\,\,(a=b),\\ \\ \frac{1}{18*2^{n-1}}*m^{2n+2}+o(m^{2n+2}),\,\,(a\ne b), \end{array} \right. \end{aligned}$$

and

$$\begin{aligned} \sum ^{*}i_aj_b= \left\{ \begin{array}{l} \frac{1}{24*2^{n-1}}*m^{2n+2}+o(m^{2n+2}),\,\,(a=b),\\ \\ \frac{1}{18*2^{n-1}}*m^{2n+2}+o(m^{2n+2}),\,\,(a\ne b). \end{array} \right. \end{aligned}$$

Then we obtain that

$$\begin{aligned} \sum \limits ^{*}\sum _{k=0}^{i_1+\cdots +i_n}i_1+\cdots +i_n&= (\frac{n^2}{18}+\frac{n}{36})*\frac{m^{2n+2}}{2^{n-1}}+o(m^{2n+2}),\\ \sum \limits ^{*}\sum _{k=0}^{i_1+\cdots +i_n}j_1+\cdots +j_n&= (\frac{n^2}{18}-\frac{n}{72})*\frac{m^{2n+2}}{2^{n-1}}+o(m^{2n+2}),\\ \sum ^{*}\sum _{k=0}^{i_1+\cdots +i_n}k&=\sum ^{*}\frac{(i_1+\cdots +i_n)^2}{2}+\frac{i_1+\cdots +i_n}{2}\\&=(\frac{n^2}{36}+\frac{n}{72})*\frac{m^{2n+2}}{2^{n-1}}+o(m^{2n+2}). \end{aligned}$$

Moreover,

$$\begin{aligned} \sum ^{*}\sum _{k=0}^{i_1+\cdots +i_n}\min (i_1,k)&=\sum ^{*} (\sum _{k=0}^{i_1}k+\sum _{k=i_{1}+1}^{i_1+\cdots +i_n}i_1)\\&=\sum ^{*}(\frac{i_1(i_1+1)}{2}+i_1(i_2+\cdots +i_n))\\&=(\frac{n}{18}-\frac{1}{72})*\frac{m^{2n+2}}{2^{n-1}}+o(m^{2n+2}). \end{aligned}$$

By symmetry, we have

$$ \sum ^{*}\sum _{k=0}^{i_1+\cdots +i_n}\min (i_1,k)+\cdots +\min (i_n,k) =(\frac{n^2}{18}-\frac{n}{72})*\frac{m^{2n+2}}{2^{n-1}}+o(m^{2n+2}). $$

The dimension of lattice $\mathcal {L}'$ is

$$ \mathrm {dim}(\mathcal {L}')=\sum ^{*}\sum _{k=0}^{i_1+\cdots +i_n}1=\frac{n}{6*2^{n-1}}*m^{2n+1}+o(m^{2n+1}). $$