Generalization of Boneh and Durfee's Attack for Arbitrary Public Exponent RSA

Abstract

In 2000, Boneh-Durfee extended the bound for low private exponent from 0.25 (provided by wiener) to 0.292 with public exponent size is same as modulus size. They have used powerful lattice reduction algorithm (LLL) with coppersmith's theory of polynomials. In this paper we generalize their attack to arbitrary public exponent.

Exponential increment of RSA attack range via lattice based cryptanalysis

“…If γ = 0, we get δ < 1 − 1 2 √ 2β which retrieves the bounds of [1], [13], [22] for the equation ed − kφ(N ) = 1. Moreover, if β = 1, we get δ < 1 − 1 2 √ 2 ≈ 0.292, which in turn retrieves the bound of [3].…”

“…which retrieves the bound of [13]. Moreover, as in the previous comparison, the class of the weak exponents in [13] is a subclass of the weak exponents of the new attack.…”

“…The result presented in [13] extended the attack of [3] to all exponents e = N β and demonstrate that N can be factored with…”

“…As a consequence, our new attack fully covers both attacks of [3] and [13] on RSA. The method presented in this paper shows that the set of the weak public exponents e in the attacks of [3] and [13] can be expanded to more exponents.…”

“…Note that the bound of [3] is valid essentially when e is of the same magnitude than N . [13] extended the attack of [3] with the equation ed − kφ(N ) = 1 for arbitrary e < N β and d < N δ . They showed that RSA is vulnerable if δ < 1 − 1 2…”