Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Alexander May Faculty of Computer Science, Electrical Engineering and Mathematics Crypto 2004 Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 1 / 14
Outline 1 Introduction Quick Overview A more detailed description Related topics and previous Results 2 Main Results Goal and assumptions Proof Overview Main theorems Remarks Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 2 / 14
Introduction Quick Overview Main Result of the paper The knowledge of the RSA public key secret key pair (e,d) ⇒ Factorization of N=pq in Polynomial Time Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 3 / 14
Introduction Quick Overview Main Result of the paper The knowledge of the RSA public key secret key pair (e,d) ⇒ Factorization of N=pq in Polynomial Time Assumptions 1 e , d < φ ( N ) 2 p,q are of the same bit-size Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 3 / 14
Introduction Quick Overview Main Result of the paper The knowledge of the RSA public key secret key pair (e,d) ⇒ Factorization of N=pq in Polynomial Time Assumptions 1 e , d < φ ( N ) 2 p,q are of the same bit-size Technique used Coppersmith’s technique for finding small roots of bivariate integer polynomials Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 3 / 14
Introduction A more detailed description Common technique in public key Cryptography is to establish Polynomial Time equivalence between: Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 4 / 14
Introduction A more detailed description Common technique in public key Cryptography is to establish Polynomial Time equivalence between: • The problem of computing the secret key from the public information • a well-known hard problem p (believed to be computationally infeasible) Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 4 / 14
Introduction A more detailed description Common technique in public key Cryptography is to establish Polynomial Time equivalence between: • The problem of computing the secret key from the public information • a well-known hard problem p (believed to be computationally infeasible) This establishes the security of the secret key (given that p is computationally infeasible) However IT DOES NOT provide security for the public key system itself. Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 4 / 14
Introduction Related topics and previous Results Related Topics • Primality :Proven to be in P [AKS 2002] • Factoring :RSA’s security is based on the hardness of factoriztion: • It is yet unknown if factorization is equivalent to RSA cryptanalysis • Cryptanalysis of RSA is at least as easy as factoring. Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 5 / 14
Introduction Related topics and previous Results Related Topics • Primality :Proven to be in P [AKS 2002] • Factoring :RSA’s security is based on the hardness of factoriztion: • It is yet unknown if factorization is equivalent to RSA cryptanalysis • Cryptanalysis of RSA is at least as easy as factoring. Previous Results • Existence of probabilistic polynomial time equivalence between factoring N and finding d. • Factors of N can be obtained from d under the Extended Riemann Hypothesis (Miller , 1975) Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 5 / 14
Main Results Goal and assumptions Goal Knowledge of (e,d) ⇔ knowledge of factors p,q of N. Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 6 / 14
Main Results Goal and assumptions Goal Knowledge of (e,d) ⇔ knowledge of factors p,q of N. ⇐ : trivial Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 6 / 14
Main Results Goal and assumptions Goal Knowledge of (e,d) ⇔ knowledge of factors p,q of N. ⇐ : trivial ⇒ : (Reduction of factoring problem to d computation) Input (N,e,d) ⇒ output (p,q) under the assumptions: (a) p,q have the same bitsize (b) e · d ≤ N 2 Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 6 / 14
Main Results Goal and assumptions Goal Knowledge of (e,d) ⇔ knowledge of factors p,q of N. ⇐ : trivial ⇒ : (Reduction of factoring problem to d computation) Input (N,e,d) ⇒ output (p,q) under the assumptions: (a) p,q have the same bitsize (b) e · d ≤ N 2 Remarks on the assumptions (a) This is usually the case Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 6 / 14
Main Results Goal and assumptions Goal Knowledge of (e,d) ⇔ knowledge of factors p,q of N. ⇐ : trivial ⇒ : (Reduction of factoring problem to d computation) Input (N,e,d) ⇒ output (p,q) under the assumptions: (a) p,q have the same bitsize (b) e · d ≤ N 2 Remarks on the assumptions (a) This is usually the case (b) Usually 1 < e , d < φ ( N ) Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 6 / 14
Main Results Goal and assumptions Goal Knowledge of (e,d) ⇔ knowledge of factors p,q of N. ⇐ : trivial ⇒ : (Reduction of factoring problem to d computation) Input (N,e,d) ⇒ output (p,q) under the assumptions: (a) p,q have the same bitsize (b) e · d ≤ N 2 Remarks on the assumptions (a) This is usually the case (b) Usually 1 < e , d < φ ( N ) Conclusion: The assumptions are not so restrictive Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 6 / 14
Main Results Proof Overview Basic technique Coppersmith’s method for finding small roots of bivariate integer polynomials Previous application: factorization of N when half of the msb of p are given. Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 7 / 14
Main Results Proof Overview Basic technique Coppersmith’s method for finding small roots of bivariate integer polynomials Previous application: factorization of N when half of the msb of p are given. Steps • Proof for the special case where ed ≤ N 3 / 2 . Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 7 / 14
Main Results Proof Overview Basic technique Coppersmith’s method for finding small roots of bivariate integer polynomials Previous application: factorization of N when half of the msb of p are given. Steps • Proof for the special case where ed ≤ N 3 / 2 . • Generalization of the proof for the case where ed ≤ N 2 Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 7 / 14
Main Results Proof Overview Basic technique Coppersmith’s method for finding small roots of bivariate integer polynomials Previous application: factorization of N when half of the msb of p are given. Steps • Proof for the special case where ed ≤ N 3 / 2 . • Generalization of the proof for the case where ed ≤ N 2 • Experimental Results and conclusion Alexander May (Faculty of Computer Science, Electrical Engineering and Mathematics) Computing the RSA secret Key is Deterministic Polynomial Time equivalent to Factoring Crypto 2004 7 / 14
Recommend
More recommend
