A Complete and Explicit Security Reduction Algorithm for RSA-based - PowerPoint PPT Presentation

A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems Asiacrypt 2003, Taipei Kaoru Kurosawa 1 , Katja Schmidt-Samoa 2 , Tsuyoshi Takagi 2 1 Ibaraki University 2 Technische Universit¨ at Darmstadt A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.1/15

Introduction Problem: Find "small" solutions x, y of ax = y + c mod N Many applications in cryptanalysis and provable security Previous solutions: Brute-force method Continued fraction methods Affine variant of Euclidian algorithm Lattice-based methods A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.2/15

Outline of the talk PD-OW of RSA Features of the lattice-based solution Proposed algorithm Application to PD-OW of RSA Comparison Conclusion A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.3/15

RSA: OW ⇒ PD-OW Target: Compute m from C = m e mod N PD-OW Oracle O : Gets s 1 from ( s 1 · 2 k + s 2 ) e mod N Fujisaki, Okamoto, Pointcheval, Stern 2001: 1. Choose a ∈ Z × N at random 2. Define C ′ = Ca e mod N (encryption of am mod N ) 3. O ( C ) = u and O ( C ′ ) = v 4. m mod N = u · 2 k + r and am mod N = v · 2 k + s ⇒ a · ( u · 2 k + r ) mod N = v · 2 k + s ⇒ ar = s + c mod N, c = ( v − ua ) · 2 k mod N. ⇒ ax = y + c mod N A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.4/15

RSA: OW ⇒ PD-OW, cont’d Problem C = ( u · 2 k + r ) e mod N , find r √ We have ar = s + c mod N, 0 ≤ r, s < B < N General answer to the problem Solve ax = y + c mod N (small solutions) � e mod N For each ( x, y ) : Check C ? u · 2 k + x � = Questions How to solve ax = y + c mod N ? How many small solutions? back A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.5/15

Features of the lattice-based method √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N Define lattice L a,N = { ( x, y ) ∈ Z 2 | ax = y mod N } Precondition: L a,N contains no 0 � = v, | v | < 4 B � � 1. unique small solution ( x, y ) of ax = y + c mod N ( ֒ → no checks necessary) 2. ( x, y ) can be found efficiently (lattice reduction) A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.6/15

Critical area for lattice-based solution Critical area of lattice L a,N = { ( x, y ) ∈ Z 2 | ax = y mod N } : No non-zero vector inside critical area ⇒ method works 4 B Target: New algorithm for solving ax = y + c mod N downsizes critical area A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.7/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N 1 st step: Specify the problem Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! 0 B − c mod N N a A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! 0 B − c mod N N A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! 0 B − c mod N N A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! 0 B − c mod N N A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! 0 B − c mod N N A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! 0 B − c mod N N A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! 0 B − c mod N N A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! 0 B − c mod N N A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! 0 B − c mod N N A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! 0 B − c mod N N A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! 0 B − c mod N N A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15

Motivation of proposed algorithm √ Problem: Find 0 ≤ x, y < B < N s.t. ax = y + c mod N � 1 st step: Specify the problem y = ax − c mod N Find x -minimal solution w. r. t. B : ? → y = − c mod N x = 0 < B no ? → y = − c + a mod N x = 1 < B no . . . . . . . . . . . . . . . . . . ? → y = − c + ˆ x = ˆ x ˆ xa mod N < B yes! 0 B − c mod N N a A Complete and Explicit Security Reduction Algorithm for RSA-based Cryptosystems – p.8/15