Analyzing Standards for RSA Integers

Abstract

Abstract. The key-generation algorithm for the RSA cryptosystem is specified in several standards, such as PKCS#1, IEEE 1363-2000, FIPS 186-3, ANSI X9.44, or ISO/IEC 18033-2. All of them substantially differ in their requirements. This indicates that for computing a "secure" RSA modulus it does not matter how exactly one generates RSA integers. In this work we show that this is indeed the case to a large extend: First, we give a theoretical framework that will enable us to easily compute the entropy of the output distribution of the considered standards and show that it is comparatively high. To do so, we compute for each standard the number of integers they define (up to an error of very small order) and discuss different methods of generating integers of a specific form. Second, we show that factoring such integers is hard, provided factoring a product of two primes of similar size is hard.

Universelle Referenzarchitektur für eine sichere cloudbasierte Automation

“…e generation of RSA keys is described in several standards (e.g., FIPS 186-4 [46], IEEE 1363-2000 [1] -see [53] for an overview), many having di erent requirements for the form of the primes. One feature is common to all these standards -the primes should be generated randomly using a large amount of entropy.…”

Notions for RSA integers

“…As for the entropy estimations, we do not know any related work on this. A conference version of this article, focusing on the analysis of standardized RSA key-generators only, was published in Loebenberger & Nüsken (2011).…”

Public Keys

“…Nevertheless, these 173 n-values do not comply with the standards for the generation of RSA moduli (cf. [19]) and they were discarded. Nine cases are probably due to copy-and-paste errors, as eight proper moduli were found that differed from the wrong ones in a few hexadecimal positions (two distinct wrong moduli match up with the same correct one).…”

“…Key generation standards for RSA (cf. [23]) have been analysed and found to be satisfactory in [19]. In [11] and [26] (and the references therein) several problems have been identified that are mostly related to the way certificates are used.…”

“…In [11,19] public key properties are considered but this issue is not addressed, with [19] nevertheless concluding that…”