Factoring RSA Modulus with Primes not Necessarily Sharing Least Significant Bits

Transcription

1 Appl. Math. Inf. Sci. 11, No. 1, (017) 43 Applied Mathematics & Information Sciences An International Journal Factoring RSA Modulus with Primes not Necessarily Sharing Least Significant Bits Hatem M. Bahig, Dieaa I. Nassr and Ashraf Bhery Computer Science Division, Department of Mathematics, Faculty of Science, Ain Shams University, Cairo, Egypt Received: 7 Aug. 015, Revised: 19 Nov. 015, Accepted: Nov. 015 Published online: 1 Jan. 017 Abstract: The security of many public-key cryptosystems, such as RSA, is based on the difficulty of factoring a composite integer. Until now, there is no known polynomial time algorithm to factor any composite integer with classical computers. In this paper, we study factoring n when n= pq is a product of two primes p and q satisfying that p l k 1 mod and q l k mod for some positive integers θ 1,θ,k 1,k logn and l. We show that n can be factored in time polynomial in logn if l < θ and either p lk 1 <l k or θ n 1/4, where θ = min{θ 1,θ }, θ = max{θ 1,θ } and k = min{k 1,k }. We also show that the result of Steinfeld and Zheng [1] when the two primes p and q share least significant bits is a special case of our results. Our results point out the warring for cryptographic designers to be careful when generating primes for the RSA modulus Keywords: Factoring Problem, RSA, Coppersmith s method, square root, least significant bits 1 Introduction The integer factorization problem is to find a nontrivial factor p of a given composite integer n. It has received a lot of attention among mathematicians and computer scientists for the following reasons [1][15]: 1.It is one of fundamental problems in mathematics, in particular in Number Theory..Its theoretical complexity is unknown. Its decision version : has N a factor less than M? ; is known to belong to both NP and conp []. From quantum complexity theoretic point of view, Shor [17] showed that integer factorization problem is in BQP (bounded error quantum polynomial time). 3.The security of many public-key cryptosystems and protocols is based on the difficulty of factoring an integer. Among them, the RSA cryptosystem [16]. It was invented by Rivest, Shamir and Adleman in 1978 and is currently the most widely known and widely used public key cryptosystem. In RSA, we choose randomly two large distinct primes p and q of the same bit-size with p>q. Then we compute n = pq and φ(n) = (p 1)(q 1). The number n is called the modulus and φ(n) is called Euler s totient function. Then we choose an integer e such that 1 < e < φ(n), and gcd(e,φ(n)) = 1. We calculate the multiplicative inverse d of e in Z φ(n), i.e., ed 1 mod φ(n). The integer e is called the public key exponent, while the integer d is called the private key exponent. The integers p, q and φ(n) should be secrete or destroyed. To encrypt a message m Z n one computes c me mod n using the public key (n, e). To recover the message m, one computes c d mod n using the private key d. The security of RSA is based mainly on factoring the modulus n. If someone factor n, then he/she will know p and q and can compute φ(n) and so d. In other words, if a fast factoring algorithm were invented, then RSA and many public-key cryptosystems would fall apart. There are many factoring algorithms in literatures. They can be classified into two main types. The first one is called special-purpose factoring algorithms; they work fast on a positive integer n with factors that have some, special, properties. The running time of this type of factoring algorithms mainly depends on the size of the factors which they find. Table 1 shows examples of special-purpose factoring algorithms and their complexity times assuming that p (n). The other type of Corresponding author h.m.bahig@gmail.com

2 44 H. M. Bahig et al.: Factoring RSA modulus with primes... factoring algorithms is called general-purpose factoring algorithms; they work on any positive integer n. The running time of this type of factoring algorithms depends mainly on the size of n. Table shows examples of general-purpose factoring algorithms and their complexity times. In general, to factor a positive integer n, we first apply special-purpose factoring algorithms. If they fail to find a factor of n, then we apply general-purpose factoring algorithms. Table 1: Special purpose factoring algorithms [4][5] Factorization Algorithm Complexity Time Trial division O(p(logn) ) Pollard s ρ-method O(p 1/ (logn) ) Pollard s (P 1)-method O(BlogB(logn) ) where p is B- smooth Lenstra s Elliptic Curve Method O(exp(c log ploglog p)(logn) ), c Table : General purpose factoring algorithms [15][13][5] Factorization Algorithm Complexity Time Lehman s method O(n 1/3+ε ) Shanks Square Form Factorization method O(n 1/4 ) Shanks Class Group method O(n 1/5+ε ) Continued Fraction method O(exp(c lognlog logn)), c= Multiple Polynomial Quadratic Sieve O(exp(c lognlog logn)), c= General Number Field Sieve O(exp(c 3 logn 3 (loglogn) )), c=( 64 9 )1/3 Special Number Field Sieve O(exp(c 3 logn 3 (loglogn) )), c=( 3 9 )1/3 Let (b t b t 1...b 1 ) with b i {0,1}, be the binary representation of a positive integer x. Throughout this paper, we use the following notations: α-msb(x) to refer to b t b t 1...b α. If α = t/ +1, we simply write MSB(x). α-lsb(x) to refer to b α...b b 1. If α = t/, we simply write LSB(x). In literature, there is a set of algorithms in special factoring algorithms class that concerns to factor n = pq when α-lsb(p) (similarly for α-msb(p) ) satisfy some properties. Mainly these properties come from (1) a special way of selecting the primes p and q, i.e., they satisfy special relations, or () obtaining a part of the bits of one of the primes by performing a so-called side-channel attack. For examples: 1.When we know α-msb(p). Coppersmith [5] showed that n = pq can be factored in polynomial time in logn if we have an approximation p 0 of p such that p p 0 < n 1/4. That s means we have α-msb(p),α log p = logn 4. This result is improved by Nassr and et al. [14] when the public exponent e is full sized..when we know α-lsb(p). Boneh and et al. [3] (also in [11]) showed that n = pq can be factored in polynomial time in logn given that p 0 = p mod r, and r n 1/4. For example, if r = α,α logn 4, then p 0 is α-lsb(p). 3.When MSB(p) = MSB(q). De Weger [3] noted that Fermat s factoring algorithm [19] takes time O(1) when the difference between the two primes p q < n 1/4. Han and Xu [8] slightly improved this result to ip jq < n 1/4 for two expected small integers i, and j. 4.When LSB(p) = LSB(q). Steinfeld and Zheng [1] showed that n= pq can be factored in polynomial time in logn if p and q have exactly α equal least significant. Sun et al. [] slightly improved the bound α to α logn 4 7. In this paper, we are interesting to study the factorization of n when α 1 -LSB(p) and α -LSB(q) satisfy that α 1 -LSB(p) = l k 1 and α -LSB(q) = l k for some some positive integers l,k 1,k. In case of k 1 = k, then we get the result of Steinfeld and Zheng [1], i.e., the two primes share the least significant bits. bits, where α logn 4 This paper is organized as follows. In Section, we review some facts used in our results The proposed factoring method with some examples are presented in Section 3. Finally, Section 4 includes the conclusion. Preliminaries In this section, we mention two results needed in this paper. The first one is a variant of Coppersmith s result [5] on integer factorization when we know an approximation p 0 of p such that p p 0 n 1/4, where n = pq is a product of two primes p > q. The second result is related to solving x a mod m for some integers a, and m..1 Factoring with Partial information of prime factors The first result that we need states that n can be factored in polynomial time when the least-significant bits are given as a remainder modulo a positive integer m. Theorem 1.([3][11]) Let n= pq, where p and q are of the same bit-size with p>q. Suppose that we know p 0 and m satisfying p 0 = p mod m and m n 1/4. Then we can find the factorization of n in time polynomial in logn.

3 Appl. Math. Inf. Sci. 11, No. 1, (017) / Square-Roots Modulo a power of The second result that we need in the paper is finding square roots modulo a power of. Theorem. [0] 1.Let a 1 mod 8 and k 3. Then there are exactly four solutions in Z k to the congruence x a mod k. These solutions are of the form x = ±s+b. k 1 with b {0,1} and s is any solution to x a mod k 1. Furthermore, there exists an algorithm that, given a and k, computes these four solutions in time O(k ) bit operations..the set of solutions in Z k to the modular equation x c mod k is summarized as follows. Let c= u v where v is odd. (a)if k u, there are k/ solutions x 0 mod k/. (b)if k > u, there are no solutions if u is odd. Otherwise, if u is even, there are three subcases If k = u+1, there are u/ solutions x u/ mod u/+1. If k = u+, there are. u/ solutions x ± u/ mod u/+ if v 1 mod 4 and none otherwise. If k u+3, there are 4. u/ solutions of the form x u/ (±s + b. k u 1 ) mod k u/ with b {0,1} and s is any solution to s v mod k u if v 1 mod 8 and no solutions if v 1 mod 8. Theorem can be summarized in Algorithm 1. Algorithm 1 Input:c (odd), k. Output: a set S={v : v c mod k }. S empty if c mod 8 1 then return S if k=1 then return S {1} if k= then return S {1,3} v 1 1,v 3,v 3 5,v 4 7 m 8 for i=4 to k do for j=1 to 4 do if v j c m mod =1 then v j v j + m/ m m return S {v 1,v,v 3,v 4 } 3 Factoring n In this section, we study the factorization of n = pq when the primes p and q satisfy the following: p l k 1 mod, q l k mod, for some integers θ 1,θ,k 1,k,l. This study extends Steinfeld and Zheng method [1] to factor n when LSB(p)= LSB(q). Theorem 3.Let n= pq be a product of two primes p and q. Suppose that there are four positive integers θ 1,θ,k 1 and k less than or equal to logn and satisfying p l k 1 mod and q l k mod for some unknown positive integer l < θ where θ = min{θ 1,θ }. If p lk 1 l k, k = min{k 1,k }, then we can find l to factor n in time Proof.The proof consists of two steps: 1.We show that l can be found in polynomial time..we show that n can be factored in time polynomial in logn. Now, we prove the first step. Since p l k 1 mod, q l k mod, and θ = min{θ 1,θ }, we have p l k 1 mod θ and q l k mod θ. Thus, n l k 1+k mod θ. Therefore, l is one of the solutions to the modular equation x k 1+k n mod θ. The integer l can be determined as follows. Case 1:If k 1 + k is odd, then l is unique and can be computed as follows: l = n t mod θ, where t =(k 1 + k ) 1 mod θ 1 Case :If k 1 + k is even, then k 1 + k can be written as k 1 + k = i r, where i 1, and r is odd. Thus, the solutions of the modular equation x k 1+k n mod θ can be obtained by computing the square roots i-times for b, where b n a mod θ, a=r 1 mod θ 1. Note that x i b mod θ. By Theorem, there are four roots can be computed in polynomial time in logn for each square root computation. Thus, in total, there are 4 i roots of the modular equation. Hence, we can find l in polynomial time in logn since 4 i <(k 1 + k ) which is bounded by a polynomial time in logn. Therefore, finding l takes polynomial time in log n. Now, we prove the second step, i.e., given l, n can be factored in polynomial time in logn. Since p l k 1 mod, then there is an integer λ p satisfies p= λ p + l k 1 (1) Similarly, since q l k mod, then there is an integer λ q satisfies q= λ q + l k () Using Eq.(1) and (), we have (p+q) (l k 1 + l k )= λ p + λ q (3)

4 46 H. M. Bahig et al.: Factoring RSA modulus with primes... and (p q) (l k 1 l k )= λ p λ q (4) By subtracting the squaring of Eqs.(3) and (4), we get and so 4n+4l k 1+k 4(pl k + ql k 1 )=+θ + λ p λ q pl k + ql k 1 = n+l k 1+k +θ λ p λ q (5) Now set a= pl k + ql k 1. Thus pl k ql k 1 = a 4nl k 1+k. It follows that pl k = a+ a 4nl k 1+k. Therefore, the computation of gcd(a + a 4nl k 1+k,n) = gcd(pl k,n) returns a non-trivial divisor, p, of n. The factorization of n takes a polynomial time in logn since 1. l is found in polynomial time in logn.. λ p λ q can be computed in polynomial time in logn since by Eqs.(1) and () and the assumption, we have λ p λ q = p lk 1 θ l k also, we have 1, if l = 1; λ p λ q = (θ 1+θ ) n mod l k, if λ p and λ q have the same sign; ( (θ 1+θ ) n mod l k ) l k, otherwise. (6) Note that, from Eqs.(1) and (), we have n +θ λ p λ q mod l k 3. computing l k 1+k is in polynomial time in logn since l < θ and θ,k 1,k logn. Remark. 1.The integer l should be odd; otherwise p and q are not primes since θ 1,θ 1.To determine a set of solutions to x t c mod k, one can use the following algorithm. Algorithm Input: c(odd),t,k. Output: a set S={v : v t c mod k }. S empty if t is odd then r t 1 mod k 1 v c r mod k return S {v} if c mod 8 1 then return S compute s,u where t = u s, s is odd r s 1 mod k 1 c 0 c r mod k set S c 0 mod k (Algorithm 1) for j = 1 to u 1 do for every v Sdefine a set S v v mod k. S v S v return S. 3.We have n is odd, due to Theorem, if n 1 mod 8, then k 1 + k cannot be even. 4.It is not necessary that the prime factors p and q have the same bit-size. Proposition 1.Suppose that we have the same assumptions as in Theorem 3 but k 1 = k = 0. Then n can be factored in polynomial time in logn. Proof.Since k 1 = k = 0 and λ p λ q = p lk 1 l k = 1, then λ p = λ q = 1. Thus p, and q have the form p=+ 1, q=+ 1. Therefore, p, and q can be easily computed in polynomial time since θ 1 and θ are known. Proposition.Suppose that we have the same assumptions as in Theorem 3 but k 1 = 0 and k 0 (or k = 0 and k 1 0). Then n can be factored in polynomial time in logn. Proof.Suppose that k 1 = 0, and k 0 (similarly for k 1 0, k = 0). Then we have either λ p λ q =0 or λ p λ q =1. Case1: λ p λ q = 0. Since p, and q are two primes, then we have λ p 0 (otherwise we get p = 1 which is a contradiction), and so λ q = 0. This implies that p = λ p + 1, and q = l. Since l < θ, and n= pq=lλ p + l, then q can be directly computed from n mod = l. Case : λ p λ q =1. Since p is prime, and k 1 = 0 we have λ p = 1, and so p=+ 1. Therefore, p can be easily computed since θ 1 is known. In both cases, n can be factored in polynomial time in logn. Example: Using NTL [18], we give an example for Theorem 3. We use the same symbols as in the theorem. Let n= pq be 104-bits, n = \ \ \ \ \ 181. The parameters k 1 = 87,k = 83, θ 1 = 80,θ = 70. Since k 1 +k = 85, the modular equation l k 1+k n mod θ has the following four solutions in θ : Take l = 65. By Eq.(6), l 1, there are two candidates for λ p λ q

5 Appl. Math. Inf. Sci. 11, No. 1, (017) / \ \ Let λ p λ q = Then a = \ \ \ \ \ 150. and so a+ a 4nl k 1+k is \ \ \ Computing gcd(a+ a 4nl k 1+k,n) returns the prime factor q q = \ \ Therefore, the other prime factor, p, of n is p= \ \ Note that p l k 1 mod and q l k mod We summarize the results of Theorem 3 and Propositions 1 and in Algorithm 3. Given n with unknown prime factors, and four parameters θ 1,θ,k 1,k, the algorithm returns the prime factor p of n if these parameters satisfy the conditions of Theorem 3, Proposition 1 or Proposition. Otherwise it returns zero. Algorithm 3 Input: n,θ 1,θ,k 1,k Output: a prime factor p of n (success) or 0 (failure). if k 1 = k = 0 then if + 1 divides n then return p= + 1 (success) else return 0 (failure) else if k 1 = 0 and k 0 then if n mod divides n then return p=n mod (success) else if + 1 divides n then return p= + 1 (success) else return 0 (failure) else if k 1 0 and k = 0 then if n mod divides n then return p=n mod (success) else if + 1 divides n then return p= + 1 (success) else return 0 (failure) θ min{θ 1,θ } k min{k 1,k } a set S k 1 +k n mod θ (Using Algorithm.) for every l S do m l k if l=1 then λ 1 else λ (θ 1+θ ) n mod m for i=1 to do a n+l k 1+k +θ λ if a > 4nl k 1+k then b a 4nl k 1+k p gcd(n,a+b) if p 1 and p n then return p (success) λ λ m return 0 (failure) In order to speed up the attack (Algorithm 3), one can skip some l s that cannot lead to a prime factorization. The following result determines a bound for l. Proposition 3.Suppose that we have the same assumption as in Theorem 3. A necessary condition to find l that lead to a prime factorization is max{k 1,k }logl max{θ 1 +θ +(k+1)logl,log p+logl}. Proof.Let k = max{k 1,k }. Since we have either l k 1 > p or l k 1 p. If l k 1 > p, then l k 1 θ < lk 1 (l 1) 1+θ θ = lk l k 1 1+θ < p lk 1 <l k. Thus, k logl < θ 1 + θ +(k+1)logl. If l k 1 p, then Therefore, k logl log p+logl. 1 k logl max{θ 1 + θ +(k+1)logl,log p+logl}. Remark. 1.In general, the value of log p is unknown. Its bound is logn 1/ < log p < logn (or 1<logq<logn 1/ ). But in RSA cryptosystem, n is a product of two primes of the same bit-size. Thus, log p= logn..in practice, it is easy to check that whether l k 1 = p (in RSA, l = p) by dividing n by l before going to determine the correct l. In the following theorem, we study a case similar to Theorem 3 but n is a product of two primes of the same bit-size (as in RSA) and we replace the condition p lk 1 <l k with θ θ n 1/4, θ = max{θ 1,θ }. Theorem 4.Let n= pq be a product of two primes p and q of the same bit-size with p > q. Suppose that there are four positive integers θ 1,θ,k 1 and k less than or equal to logn and satisfying p l k 1 mod and q l k mod for some unknown positive integer l < θ where θ = min{θ 1,θ }. If θ n 1/4, θ = max{θ 1,θ }, then we can find l to factor n in time polynomial in logn.

6 48 H. M. Bahig et al.: Factoring RSA modulus with primes... Proof.The proof of the first part of the theorem, i.e., finding l, is the same as in Theorem 3. Now we show that l can be used to factor n in time We have either θ = θ 1 or θ = θ. Case 1:θ = θ 1. We have p l k 1 mod θ and θ n 1/4. Therefore, we can apply Theorem 1 by taking p 0 = l k 1 mod θ and m = θ n 1/4 to factor n in time polynomial in logn. Case :θ = θ. We have q l k mod θ, and so, p nl k mod θ and θ n 1/4. Therefore, we can apply Theorem 1 by taking p 0 = nl k mod θ and m = θ n 1/4 to factor n in time polynomial in logn. Example: Using NTL [18], we give an example for Theorem 4. We use the same symbols as in the theorem. Let n= pq be 104-bits, n = \ \ \ \ \ The parameters k 1 = 7,k = 4, θ 1 = 70,θ = 65. Since k 1 + k = 11, the modular equation l k 1+k n mod θ has exactly one solution l = By taking p 0 = l k 1 mod = mod 70 m= = 70 > n 1/4 By using Theorem 1, we get p= \ \ q = \ \ In the following corollary, we show that the result of Steinfeld and Zheng [1] is a special case of Theorem 4 Corollary 1.Let n= pq be a product of two large primes where p and q are of the same bit-size. If LSB(p) = LSB(q), then n can be factored in time Proof.Let l = LSB(p) = LSB(q). Then we can write p = θ p h +l and q= θ q h +l where θ is the bit-size of l. Thus, 0<l < θ and θ n 1/4. Therefore, we apply Theorem 4 by taking θ 1 = θ = θ and k 1 = k = 1 to factor n in time Corollary.Let n = pq be the RSA modulus, where p and q are two large primes of the same bit-size. Suppose that p l k 1 mod and q l k mod for some positive integers k 1,k,θ 1,θ logn and l < θ, θ = min{θ 1,θ }. Then n can be factorized in time polynomial in log n in the following cases: 1. p lk 1 l k, k=min{k 1,k },. θ n 1/4, θ = max{θ 1,θ }, Proof.The proof comes directly from Theorems 3 and 4 4 Conclusion In this work, we extended the attack of Steinfeld and Zheng [1] on RSA when the two primes p and q have equal least significant bits. We have studied factoring n in polynomial time in log n when the least significant bits of p and q can be written as a power (not necessarily the same) of a positive integer l modulo a power (not necessarily the same) of. References [1] E. Bach, Annual Reviews Comput. Sci., (1990). [] K. Bimpikis, and R. Jaiswal, A Technical Report Presented to the University of California, San Diego, 1-15 (005). [3] D. Boneh, G. Durfee, Y. Frankel, Lecture Notes in Computer Science 1514, 534 (1998). [4] R. P. Brent, Lecture Notes in Computer Science 1685, 1- (1999). [5] D. Coppersmith, Journal of Cryptology 10(4), 3-60 (1997). [6] J. Faugère, R. Marinier, and G. Renault, Lecture Notes in Computer Science 6056, (010). [7] Y. Filmus, Factorization Methods: Very Quick Overview (010), yuvalf/factorization.pdf. [8] L. Han, G. Xu, Asia-Pacific Conference on Information Processing (APCIP 009), (009). [9] H. W. Jr. Lenstra, Ann. Math. 16, (1987). [10] A. K. Lenstra, H. W. Jr. Lenstra, The Development of the Number Field Sieve, Springer-Verlag (1993). [11] A. May, New RSA vulnerabilities using lattics reduction methods, Ph.D. Dissertation. University of Paderborn. Germany (003). [1] A. May, M. Ritzenhofen, Lecture Notes in Computer Science 5443, 1-14 (009). [13] P.L. Montgomery, A survey of modern integer factorization algorithms, Techincal Report at CWI, Amsterdam (1995). [14] D. Nassr, H. Bahig, A. Bhery, and S. Daoud, Proceeding of the 6th ACS/IEEE International Conference on Computer Systems and Applications, (008). [15] C. Pomerance, Proceedings of symposia in applied mathematics 4, 7-47 (1990). [16] R. Rivest, A. Shamir, L. Adleman, Communication of ACM 1, (1978). [17] P. Shor, SIAM J. Comput. 6(5), (1997)

7 Appl. Math. Inf. Sci. 11, No. 1, (017) / 49 [18] V. Shoup, NTL: A Library for doing Number Theory, online available at [19] J. H. Silverman, A friendly introduction to number theory, nd edition, Prentice Hall (001). [0] R. Steinfeld and Y. Zheng, Lecture Notes in Computer Science 00, 5-6 (001). [1] R. Steinfeld, Y. Zheng, Appl. Algebra Eng. Commun. Comput. 15, (004). [] H. SUN, M. WU, C. YANG, IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, E9.A(8), (009). [3] B. de Weger, Appl. Algebra Eng. Commun. Comput., 13(1), 17-8 (00). [4] R. V. Yampolskiy, Int. J. Bio-Inspired Computation, (), (010). [5] Song Y. Yan, Primality Testing and Integer Factorization in Public-Key Cryptography. nd edition, Springer (009). Hatem M. Bahig received the MSc degree in Computer Science from Faculty of Science, Ain Shams University, Egypt, in In 003, he received the DSc degree from Graduate School of Science, Tokyo Metropolitan University, Japan. His research interests includes computational number theory, and cryptography. Dieaa I. Nassr received the MSc degree in Cryptography at Faculty of Science, Ain Shams University. Now, he is a PhD student and is working a assistant lecturer at Faculty of Science, Ain Shams University. His research interests includes cryptography, discrete mathematics, and computational number theory. Computations. Ashraf M. Bhery is a lecturer of Computer Science at Ain Shams University, Faculty of Science (Egypt). He received the PhD degree in Computer Science at Tokyo Institute of Technology (Japan). His research interests are: Cryptography, Formal Methods, Computational Intelligence, and Models of