Professional Documents
Culture Documents
Crypto 2004
Outline
1 Introduction
Quick Overview
A more detailed description
Related topics and previous Results
2 Main Results
Introduction
Quick Overview
Introduction
Quick Overview
e, d < (N)
Introduction
Quick Overview
e, d < (N)
Technique used
Coppersmiths technique for finding small roots of bivariate integer
polynomials
Introduction
Introduction
infeasible)
Introduction
infeasible)
Introduction
Related Topics
Primality:Proven to be in P [AKS 2002]
Factoring:RSAs security is based on the hardness of factoriztion:
It is yet unknown if factorization is equivalent to RSA cryptanalysis
Cryptanalysis of RSA is at least as easy as factoring.
Introduction
Related Topics
Primality:Proven to be in P [AKS 2002]
Factoring:RSAs security is based on the hardness of factoriztion:
It is yet unknown if factorization is equivalent to RSA cryptanalysis
Cryptanalysis of RSA is at least as easy as factoring.
Previous Results
Existence of probabilistic polynomial time equivalence between
Main Results
Goal
Knowledge of (e,d) knowledge of factors p,q of N.
Main Results
Goal
Knowledge of (e,d) knowledge of factors p,q of N.
: trivial
Main Results
Goal
Knowledge of (e,d) knowledge of factors p,q of N.
: trivial
: (Reduction of factoring problem to d computation)
Input (N,e,d) output (p,q) under the assumptions:
(a) p,q have the same bitsize
(b) e d N 2
Main Results
Goal
Knowledge of (e,d) knowledge of factors p,q of N.
: trivial
: (Reduction of factoring problem to d computation)
Input (N,e,d) output (p,q) under the assumptions:
(a) p,q have the same bitsize
(b) e d N 2
Remarks on the assumptions
(a) This is usually the case
Main Results
Goal
Knowledge of (e,d) knowledge of factors p,q of N.
: trivial
: (Reduction of factoring problem to d computation)
Input (N,e,d) output (p,q) under the assumptions:
(a) p,q have the same bitsize
(b) e d N 2
Remarks on the assumptions
(a) This is usually the case
(b) Usually 1 < e, d < (N)
Main Results
Goal
Knowledge of (e,d) knowledge of factors p,q of N.
: trivial
: (Reduction of factoring problem to d computation)
Input (N,e,d) output (p,q) under the assumptions:
(a) p,q have the same bitsize
(b) e d N 2
Remarks on the assumptions
(a) This is usually the case
(b) Usually 1 < e, d < (N)
Conclusion: The assumptions are not so restrictive
Main Results
Proof Overview
Basic technique
Coppersmiths method for finding small roots of bivariate integer
polynomials
Previous application:factorization of N when half of the msb of p are
given.
Main Results
Proof Overview
Basic technique
Coppersmiths method for finding small roots of bivariate integer
polynomials
Previous application:factorization of N when half of the msb of p are
given.
Steps
Proof for the special case where ed N 3/2 .
Main Results
Proof Overview
Basic technique
Coppersmiths method for finding small roots of bivariate integer
polynomials
Previous application:factorization of N when half of the msb of p are
given.
Steps
Proof for the special case where ed N 3/2 .
Generalization of the proof for the case where ed N 2
Main Results
Proof Overview
Basic technique
Coppersmiths method for finding small roots of bivariate integer
polynomials
Previous application:factorization of N when half of the msb of p are
given.
Steps
Proof for the special case where ed N 3/2 .
Generalization of the proof for the case where ed N 2
Experimental Results and conclusion
Main Results
Main theorems
ed N 3/2
Wlog assume that p < q. Then p < N 1/2 < q < 2p < 2N 1/2 (1) which
gives p + q < 3N 1/2
N
2
(N) = N + 1 (p + q) >
N
2
(3)
Main Results
Main theorems
ed N 3/2
Wlog assume that p < q. Then p < N 1/2 < q < 2p < 2N 1/2 (1) which
gives p + q < 3N 1/2
N
2
(N) = N + 1 (p + q) >
N
2
(3)
Theorem
Let N=pq be the RSA-modulus, where p and q are of the same bitsize.
Suppose we know integers e,d with ed > 1, ed 1(mod(N)) and
3
ed N 2
Then N can be factored in time polynomial to its bitsize.
Main Results
Main theorems
ed N 3/2
Wlog assume that p < q. Then p < N 1/2 < q < 2p < 2N 1/2 (1) which
gives p + q < 3N 1/2
N
2
(N) = N + 1 (p + q) >
N
2
(3)
Theorem
Let N=pq be the RSA-modulus, where p and q are of the same bitsize.
Suppose we know integers e,d with ed > 1, ed 1(mod(N)) and
3
ed N 2
Then N can be factored in time polynomial to its bitsize.
Proof.
dke:ceiling of k.
Z(N) : Ring of the invertible integers mod(N).
Alexander May (Faculty of Computer Science,Computing
Electrical Engineering
the RSA secret
andKey
Mathematics)
is Deterministic Polynomial TimeCrypto
equivalent
2004to Factoring
8 / 14
Main Results
Main theorems
proof (continued)
ed 1(mod(N)) ed = k(N) + 1 for some k N.
k = ed1
N . Then k dke
In addition k k = ... = (p+q1)(ed1)
(N)N
(2) and (3) give k k < 6N 3/2 (ed 1) (4) which gives
<6
by hypothesis k k < 6 k dke
Thus we only have to try dke + i for i=0,...,5 to find the right k.
Main Results
Main theorems
proof (continued)
ed 1(mod(N)) ed = k(N) + 1 for some k N.
k = ed1
N . Then k dke
In addition k k = ... = (p+q1)(ed1)
(N)N
(2) and (3) give k k < 6N 3/2 (ed 1) (4) which gives
<6
by hypothesis k k < 6 k dke
Thus we only have to try dke + i for i=0,...,5 to find the right k.
Complexity
The complexity of the algorithm is O(log 2 N).
Main Results
Main theorems
ed N 2
Theorem (Coppersmith)
Let f(x,y) be an irreducible polynomial in two variables over Z, of
maximuum degree in each variable seperately. Let X,Y be bounds on the
desired solutions (x0 , y0 ).Let W be the absolute value of the largest entry
2
in the coefficient vector of f(xX,yY). If XY W 3 Then in time
polynomial in logW and 2 we can find all integer pairs (x0 , y0 ) with
f (x0 , y0 ) = 0, |x0 | X and |y0 | Y .
Main Results
Main theorems
ed N 2
Theorem (Coppersmith)
Let f(x,y) be an irreducible polynomial in two variables over Z, of
maximuum degree in each variable seperately. Let X,Y be bounds on the
desired solutions (x0 , y0 ).Let W be the absolute value of the largest entry
2
in the coefficient vector of f(xX,yY). If XY W 3 Then in time
polynomial in logW and 2 we can find all integer pairs (x0 , y0 ) with
f (x0 , y0 ) = 0, |x0 | X and |y0 | Y .
Theorem
Let N=pq be the RSA-modulus, where p and q are of the same bitsize.
Suppose we know integers e,d with ed > 1, ed 1(mod(N)) and
ed N 2
Then N can be factored in time polynomial in the bitsize of N.
Alexander May (Faculty of Computer Science,Computing
Electrical Engineering
the RSA secret
andKey
Mathematics)
is Deterministic Polynomial Time
Crypto
equivalent
2004 to Factoring
10 / 14
Main Results
Main theorems
Proof.
Again ed 1(mod(N)) ed = k(N) + 1 (5) for some k N.
Let k = ed1
be an underestimation of k. Using (4) we obtain
N
k k < 6N 3/2 (ed 1) < 6N 1/2
(dke:approximation
2i1 1/2
4 N
(N)| 14 N 1/2
Main Results
Main theorems
Proof (continued)
+ x)(N g y ) = 0
(5) yields ed 1 (dke
We define the bivariate integer polynomial :
dke(N
f (x, y ) = xy (N g )x + dkey
g ) + ed 1
p + q + 1 g ) over the integers.
with a known root (x0 , y0 ) = (k dke,
We now apply Coppersmiths theorem. We define
X = 6N 1/2 andY = 41 N 1/2 + 1 Then |x0 | X and|y0 | Y .
Let W denote the linf norm of the coefficient vector of f(xX,yY). Then
W (N g )X > 3N 3/2
2
144
Thus XY = ... < W 2/3 = W 3 (for N > (291/3
)
3)2
By Coppersmiths theorem we can find the root (x0 , y0 ) in time
polynomialin the bitsize of of W.
Finally the solution y0 = p + q 1 g yields the factorization of N.
Main Results
Remarks
Remarks
Main Results
Remarks
Remarks
Main Results
Remarks
Remarks
The previous theorem can be easily generalized for the case where
p + q poly (logN)N 1/2
Main Results
Remarks
Remarks
The previous theorem can be easily generalized for the case where
p + q poly (logN)N 1/2
(a) For the case where ed N 3/2 we only have to examine the values
+ i, for i=0,1,...,d2poly (logN)e 1
dke
(polynomialy bounded by the bitsize of N)
Main Results
Remarks
Remarks
The previous theorem can be easily generalized for the case where
p + q poly (logN)N 1/2
(a) For the case where ed N 3/2 we only have to examine the values
+ i, for i=0,1,...,d2poly (logN)e 1
dke
(polynomialy bounded by the bitsize of N)
(b) For the case where ed N 2 we just have to divide the interval
[N poly (logN)N 1/2 , N] into d2poly (logN)e intervals.
Main Results
Remarks
Remarks
The previous theorem can be easily generalized for the case where
p + q poly (logN)N 1/2
(a) For the case where ed N 3/2 we only have to examine the values
+ i, for i=0,1,...,d2poly (logN)e 1
dke
(polynomialy bounded by the bitsize of N)
(b) For the case where ed N 2 we just have to divide the interval
[N poly (logN)N 1/2 , N] into d2poly (logN)e intervals.
Main Results
Remarks
Main Results
Remarks