New Attacks on RSA with Small Secret CRT-Exponents

Abstract

Abstract. It is well-known that there is an efficient method for decrypting/signing with RSA when the secret exponent d is small modulo p − 1 and q − 1. We call such an exponent d a small CRT-exponent. It is one of the major open problems in attacking RSA whether there exists a polynomial time attack for small CRT-exponents, i.e. a result that can be considered as an equivalent to the Wiener and Boneh-Durfee bound for small d. At Crypto 2002, May presented a partial solution in the case of an RSA modulus N = pq with unbalanced prime factors p and q. Based on Coppersmith's method, he showed that there is a polynomial time attack provided that q < N 0.382 . We will improve this bound to q < N 0.468 . Thus, our result comes close to the desired normal RSA case with balanced prime factors. We also present a second result for balanced RSA primes in the case that the public exponent e is significantly smaller than N . More precisely, we show that there is a polynomial time attack if dp, dq ≤ min{(N/e)

Parallel Lattice Basis Reduction Using a Multi-threaded Schnorr-Euchner LLL Algorithm

“…The speed-up (i.e., scaling factor) is the quotient of the real time of the non-parallel version and the real time of the multi-threaded version. The speed-up factor increases with the dimension up to around 1.8 for the 2-thread and factor 3.2 for the 4-thread version 4 It is interesting to note that for the selected parameters the speed-up factor for unimodular lattice bases increases faster than for knapsack or Goldstein-Mayer random lattices, and eventually all three speed-up factors reach a similar maximum value, as one can clearly observe in the 2-thread case. The 2-thread version, as expected, reaches its maximum earlier than the 4-thread version.…”

“…One can avoid these restrictions by using a less efficient multi-precision floating point arithmetic. The reduction of lattice bases in high dimensions and entries of high bit length (which requires the use of a multi-precision floating point arithmetic for the approximation) are of interest in various context, e.g., for certain attacks on RSA [22,23,5,4]. Using a multi-precision floating-point arithmetic to approximate the lattice basis changes the running time behavior of the Schnorr-Euchner reduction algorithm dramatically.…”

“…The reduction of these lattice bases is of great interest, e.g., for cryptanalyzing RSA [22,23,5,4]. In experiments with sparse and dense lattice bases, experiments with our new parallel LLL show (compared to the non-parallel algorithm) a speed-up factor of about 1.8 for the 2-thread and about factor 3.2 for the 4-thread version.…”

Maximizing Small Root Bounds by Linearization and Applications to Small Secret Exponent RSA

“…Starting point is the polynomial equation (3). We proceed similar to [BM06] and perform an (almost) identical linearization.…”

“…In the framework of unravelled linearization, it is obvious why we do not obtain a positive result for smaller parameters. In order to improve upon the bound from Bleichenbacher, May [BM06], we have to use relation (6). However, the lattice parameters m = 2 and t = 1 are the smallest ones for which the monomial vwx appears.…”