Revisiting Wiener s Attack New Weak Keys in RSA

Transcription

1 Rvisiting Winr s Attack w Wak Kys in RSA Subhamoy Maitra an Santanu Sarkar Inian Statistical Institut, 0 B T Roa, Kolkata , Inia {subho, santanu r}@isicalacin Abstract In this papr w rvisit Winr s mtho (IEEE-IT 990) of continu fraction (CF) to fin nw waknsss in RSA W consir RSA with = pq, q < p < q, public ncryption xponnt an privat cryption xponnt Our motivation is to fin out whn RSA is inscur givn is O( δ ), whr w ar mostly intrst in th rang 0 δ 05 Givn ( ) is known to th attackr, w show that th RSA kys ar wak whn = δ an δ < γ γ, whr q p 6 This prsnts aitional rsults ovr th work of Wgr (AAECC 00) W also iscuss how th lattic bas ia of Bonh-Durf (IEEE-IT 000) works bttr to fin wak kys byon th boun δ < γ Furthr w show that, th RSA kys ar wak whn < δ an is O( δ ) for δ Using similar tchniqus w also prsnt nw rsults ovr th work of Blömr an May (PKC 004) Kywors: Cryptanalysis, RSA, Factorization, Wak Kys Introuction RSA [4] is on of th most popular cryptosystms in th history of cryptology Hr, w us th stanar notations in RSA as follows: prims p, q, with q < p < q; = pq, φ() = (p )(q );, with, < φ() ar such that = + tφ(), t ; 4, ar availabl in public an th mssag M is ncrypt as C M mo ; 5 th scrt ky is rquir to crypt th mssag as M C mo In this papr w xploit th Winr s mtho [] of continu fraction (CF) to fin nw waknsss in RSA (s [5] for Lgnr s thorm rlat to CF xprssion) Winr [] show that if < 05, thn t < an t (which in turn rvals p, q) coul b stimat in poly(log ) tim from th CF xprssion of th publicly availabl quantity From = + tφ(), it is asy to s that t =, i, t < whnvr φ() φ() φ() < φ() Thus a goo stimation of φ() can b of us whilxploiting CF xprssion It is known that for q < p < q, + < φ() < + In [5, Sction 4], Winr s attack [] has bn xtn stimating φ() as + This is a substantially rvis (with som corrctions an gnralizations) an xtn vrsion of th papr that has bn prsnt in ISC 008, th Information Scurity Confrnc Sptmbr 5-8, 008, Taipi, Taiwan, publish in Pags 8 4, volum 5, Lctur ots in Computr Scinc, Springr, 008 Th introuction of th paramtr is a gnralization in Thorms, 4; in th confrnc vrsion, w hav us = Furthr, Sctions, prsnt aitional matrials that wr not inclu in th confrnc vrsion of this papr

2 Lots of waknsss of RSA hav bn intifi in past thr cas, but still RSA can b scurly us with propr prcautions as a public ky cryptosystm Th scurity of RSA pns on th harnss of factorization Lt us now brifly iscuss som waknsss of RSA RSA is foun to b wak whn th prim factors of ithr p or q ar small [] Similarly, RSA is wak too whn th prim factors of ithr p + or q + ar small [4] In [0], it has bn point out that short public xponnts may caus waknss if sam mssag is broacast to many partis An outstaning survy on th attacks on RSA is availabl in [] For vry rcnt rsults on RSA on may rfr to [7,, 9] an th rfrncs thrin In this papr w stuy th waknsss of RSA whn th scrt cryption xponnt is uppr boun Th work of [] initiats th application of Continu Fraction (CF) xprssion for th attack In th work of [6], important rsults hav bn shown rgaring small solutions to polynomial quations that in turn show vulnrabilitis of low xponnt RSA In [4, 5], th mtho of [6] has bn xploit to show that RSA is inscur if < 09 Th rsults from [6] hav bn us along with th rsults of [] in many paprs [4, 5, 5,, ] to gt th waknsss whn is lss than δ In this papr, w lik to fin out how th ia of CF xprssion from [] can b xploit to fin waknsss of RSA whn is small In [5, Sction 4], som xtnsion of th work [] has bn mntion an it has also bn not that similar xtnsion will work on th rsults of [] Th rsult of [] works for with a fw mor bits longr than 4 In [8], an xtnsion of Lgnr s rsult has bn stui to gt mor wak kys in th irction of [] Howvr, w fin that nw wak kys of RSA can b intifi using th CF tchniqu Ths wak kys hav not bn xplor in th litratur bfor to th bst of our knowlg In [], it has bn shown that RSA is not scur whn < 05 as unr this conition, t < an t can b foun in th CF xprssion of Th knowlg of hlps in gtting p, q immiatly In [9], a ngativ rsult has bn intifi that Winr s attack will work with ngligibl succss for > 4 Thus thr is a p intrst to fin out cass whr th Winr s stratgy [] can b xtn to gt mor wak kys On may asily chck that > t an < t In [], φ() has bn approximat φ() by to gt th rsults A bttr rsult has bn obtain in [5, Sction 4] whr φ() is approximat by + It has bn shown that t < whn δ < β, + 4 whr p q = β an = δ ot that, for β =, th rsult of [5] givs similar boun on as in [], which is of th orr 4 Th improvmnt is obtain whn β crass Only at β =, bcoms of th orr of In [5, Sction 5, 6], th attack of [4, 5] 4 has bn xtn consiring th valu of β, whr p q = β Insta of consiring p q = β, w hr consir q p γ whr to gt aitional rsults 6 Ths rsults ar prsnt in Sction Furthr, in Sction, w also stuy th ia of Bonh an Durf [4, 5] to monstrat that it compars bttr than th ia prsnt in th bginning of Sction which uss th ia of CF xpansion only Furthr, insta of rlating β, 4 β, with = δ, w put th constraint on W fin that RSA is inscur whn is of th orr of δ for δ 05 Th constraint in our cas

3 is on th public xponnt, which is rlat to th iffrnc of th prims W show that our attack works whn δ A+, which can b stimat as O( 5 δ ) in gnral B A+ Hr A = β + 4 an B = Th consrvativ uppr boun on, i, O( 5 δ ), ignors th trm β in A an thus th iffrnc btwn th two prims os not com into th pictur for th attack in gnral Ths rsults ar prsnt in Sction In [], it has bn shown that p, q can b foun in polynomial tim for vry, satisfying x + y 0 mo φ(), with x 4 an y = O( 4 x); furthr som xtnsions consiring th iffrnc p q hav also bn consir Th work of [] also uss th rsult of [6] as wll as th ia of CF xprssion [] in thir proof W also provi aitional rsult ovr []This is prsnt in Sction W hr highlight th contribution of this papr Givn with known to th attackr RSA is inscur whn = δ an δ < γ γ, whr q p an γ Furthr w show that this boun on δ can b 6 xtn using th lattic bas tchniqus < δ an is O( δ ) for δ x + y = mφ() for m > 0, x 7 4, y c 4 x, c an p q c 4 4 x + y = mφ(), for m > 0, 0 < x φ() γ for an y γ x whr 6 φ() 4 q p γ whr γ an is known to th attackr In th confrnc vrsion of this papr, w hav consir =, whras, th cas for = has bn stui [5] Taking in th rang of [, ] gnralizs both ths ias On may ask a qustion that how can b availabl to th attackr In fact, on may try to guss for iffrnt valus (that ar computationally fasibl) to mount th attack Furthr, on may not that th knowlg of most significant bits (MSBs) of p or q can provi som approximation of that may also b us In [], it has also bn stui how a fw MSBs of p or q can b foun from th knowlg of only Our rsult in Thorm shows that can b factoriz from th knowlg of ( not known) whn is O( ) an is O( ) W lik to point out an important rsult [7, Thorm ] that shoul b stat in this contxt, whr it has bn shown that for, with th knowlg of,, th intgr can b factoriz in O(log ) tim In [0], Sun an Yang propos a variant of RSA whr th public ncryption xponnt an th privat cryption xponnt ar such that log + log log + l k, whr l k is a positiv intgr Th main ia was to kp th bit siz as wll as quit lss an th valu of l k is rlat to th scurity of this variant of RSA Though th class of th xponnts in [0] ar not covr by our Thorm, on ns to b cautious whil choosing,, whn both of thm ar rstrict by som uppr boun Bfor procing furthr, lt us xplain th Continu Fraction (CF) xprssion W follow th matrial from [8, Chaptr 5] for this Givn a positiv rational numbr a, a finit b CF xprssion of a can b writtn as q b + or in short [q, q, q, q m ] As an q + q ++ qm

4 xampl, tak th rational numbr 4 On can writ this as follows in th CF xprssion: 99 4 = = 0 + = 0 + = 0 + = 0 + = , an in short [0,,, 0, ] Consir a subsqunc of [0,,, 0, ] as [0,, ] ot that 0 + = =, + 99 which is vry clos to 4, i, a subsqunc of CF will giv an approximation of th rational 99 numbr Givn that a, b ar t bit intgrs, th CF xprssion [q, q, q,, q m ] of a can b b foun in O(poly(t)) tim an can b stor in O(poly(t)) spac Any initial subsqunc of [q, q, q,, q m ], i, [q, q, q,, q r ], whr r m is call th convrgnt of [q, q, q,, q m ] As xampl, [0,, ] is a convrgnt of [0,,, 0, ], i, = is a 99 convrgnt of 4 Also not that if th subsqunc has a at th n thn that may also 99 writtn by aing th to th prvious intgr an rmoving th That is, both [0,, ] an [0, ] provis th sam rational numbr w Wak Kys I It is known that if p q < 4 [7] (s also [5, Sction ]), thn RSA is wak by Frmat s factorization tchniqu Thus w ar intrst in th rang 4 < p q < only Proposition Lt p, q b of sam bit siz, i, q < p < q Thn φ() > B +, whr B = Furthr, if p q = β whr 4 < β <, thn φ() = A +, whr A = β + 4 Proof Sinc (p q)(p q) < 0, w hav + < φ() Also, as p q = β, w hav p β p = 0, putting q = Thus p = β + β +4 So w gt p + q = p + = p p β + β +4 = β + 4 Thn φ() = (p + q) + = A + β +4 + β + In [5], it has bn intifi that if p q = β, thn RSA is wak for = δ whn δ < β In such a cas t coul b foun as a convrgnt in th CF xprssion of 4 + Thus th rsult works bttr whn p, q ar clos As xampl, if p q = 4 +ɛ, thn δ is boun by ɛ As xampl, for ɛ = 005, RSA bcoms inscur if = 044 < 045 Howvr, this improvmnt is not significant whn p q is O( 05 ) Proposition Lt p q γ 6, whr γ < an Thn p+q ( + ) < γ 8 Proof W hav p q γ So 6 p p γ Hnc p p + p γ, 6 6 i, p + γ As + >, w hav p < γ Again p 6 p 6 multiplying q with th inquality p q γ, w hav 6 q q γ So w hav 6 q + γ As, w hav + > Hnc, q < γ q 6 q 6 i, q < γ 6 γ, as ow p+q ( + 6 ) p + q < γ 8

5 Thorm Lt p q γ with, γ an = δ Thn can b factor 6 in O(poly(log())) tim whn δ < γ Proof Sinc p q γ, w hav p + q ( + 6 ) < γ, 8 i, φ() + ( + ) < γ ow, 8 ( + ) + t ( + ) + φ() + φ() t = φ() ( ( + ) + ) φ() ( ( + ) + ) + φ() < φ() ( ( + ) + ) ( ( + ) + ) + φ() < γ 8 assuming ( + ) + > Thus, ) t < γ + ( + Whn γ <, w gt ( + + 4, an φ() > = γ ) + t < Putting = δ in th inquality γ <, w gt δ < γ This givs th proof 4 4 For xprimntal vincs, w work with prims p, q 0 60, i, 0 0 an = So in this cas w stuy th Continu Fraction of + Howvr, th xprimnts whn q p < n 4 may not b of intrst as in that cas th factorization can b on in polynomial tim similar to th argumnt of Frmat s factorization stratgy [7] (s also [5, Sction ]) Thus w consir th scnario whn q p > All th xampls in this papr (apart from th rsults rlat to lattic ruction) involving larg intgrs ar implmnt in LIUX nvironmnt using C with GMP Exampl W choos a ranom prim q [0 60, 0 6 ] Thn w choos a ranom prim p, such that q p > In this xampl, q p < 05 W thn choos th first gratr 6 than or qual to δ for δ such that is coprim to φ() W consir p, q rspctivly as an , which givs as

6 ot that q p > On can chck that φ() is Taking γ = 05, w gt δ < γ = 04 Thus, in this cas for any < 04, RSA will b inscur ow tak 0 < < 04 W consir = (a 04 igit numbr) Th corrsponing is Th valu of t is Hr t coul b foun in th CF xprssion of + Th CF xprssion of + is as follows 0,,,,, 5,,,,, 4,,,,,,,,,,, 8, 0,,,, 6,,,,, 7,, 5,,,,,,,,,,,,,, 4,, 5,, 6,,,, 5, 4,, 7, 4,, 5, 5,,, 45,, 54, 5,, 4,,, 8,,,,,,,,, 6,,,,, 7, 4,,, 5,,,,,, 4,, 0,,,,,, 8,,,,,, 7,,,, 4,, 6,,, 4,, 8, 6,, 4,,,,, 5,,, 7,,,,,, 0,,, 6,,, 5,, 4,,, 7,,,,,,,,, 4,,,,, 4,,, 4,,,,,, 50, 4,,, 4,,,,, 9, 6,,,, 8,,, 0, 6,,,,, 9,, 6,,,,,,,,,, 4,,, 7,,,, 4,,,,,, 4, 5,,,, 4,, 5, 4, 0,,,,,, 0,, 65, 0,,,,, 6,,, 5, 4, 6,, 9,,,,, 0,, 7,,,,,,,,,,,,, 7,,4,,,,, 5, 5, 6,,,,,,,,,,,,, 4,,,, 48,,, 6,, 7,,,, 9, 6, 4,, 4,, 4,,,,,,,,,,,,,,,, 0,, 0, 7,,, 6,,, 5, 5,,, 5,,,,,,,, 8,,,, 75,,, 4,,,, 7,,,, 7,, 5,, 5,,, 6,,, 4,, 4,,, 8, 6, 6,,, 5,,,,,,, 5, 4,, 6,,,,, 4,,,,,,,,, 7,,, 8,,, 8,,,, 8,,,, 47,, 5,, 0,, 9,,,, 8,,,,, 7,, 6, 5,,, 4,,,,,,,,,, 0,,,,, 4,,,,, 4,,,,,,,,,,,,,,, 57,,, 5,,, 0,,,,,, 7,,,,, 4,, 0, 8,, 5,,,, 5,,,,, 4, 4,, 45,,, 60,,,,,, 5, 4,,,,,,, 5, 4,,,,,,,, 0,,, 4,,, 7,,, 4,,,, 5,,,,,,,,,, 8,, 49, 9, 9,, 7, 4,, 5,, 7,, 8,,,, 4, 5,,, 5,, 94,, 6,,,,,,,, 6,,,, 4,,, 4,,, 55,, 7,,,,, 9,, 9,, 6,,,,,,,,, 6,, 4,,, 5,,, 6,, 4,, 8,,,,, 84, Th CF xprssion of t is as follows 0,,,,, 5,,,,, 4,,,,,,,,,,, 8, 0,,,, 6,,,,, 7,, 5,,,,,,,,,,,,,, 4,, 5,, 6,,,, 5, 4,, 7, 4,, 5, 5,,, 45,, 54, 5,, 4,,, 8,,,,,,,,, 6,,,,, 7, 4,,, 5,,,,,, 4,, 0,,,,,, 8,,,,,, 7,,,, 4,, 6,,, 4,, 8, 6,, 4,,,,, 5,,, 7,,,,,, 0,,, 6,,, 5,, 4,,, 7,,,,,,,,, 4,

7 ,,,, 4,,, 4,,,,,, 50, 4,,, 4,,,,, 9, 6,,,, 8,,, 0, 6,,,,, 9,, 6,,,,,,,,,, 4,,, 7,, Th mark in th CF xprssion of + points th trmination of th subsqunc for th CF xprssion of t This xampl corrspons to Thorm In fact, Thorm prsnts a sufficint conition on whn RSA will b wak In Exampl, it is shown that vn for som, gratr than th boun in Thorm, RSA can b inscur bas on som conition on Exampl shows that thr xists som vn gratr than whn RSA is inscur That is prsnt in Sction, whr w try to rmov th constraint on th iffrnc btwn th prims; insta an uppr boun on is consir Extnsion using lattic bas ia In this sction, w xploit lattic bas tchniqus following th ia of [4, Sction 4] This ia has bn us in [5, Sction 5] whn p q is boun W us similar ia whn q p is boun In this sction w rfr to th arlir works an o not xplain th ia rlat to lattics in tails To follow our rsults, on may n to go through th tail ias prsnt in [4, 5, 5,, 6] Lt = δ W assum = as for < on can gt bttr uppr boun on δ [4, Pag 9] W hav = + tφ() = + t( + p q) = + t ( + ( + ) (p + q ( + ) ) ) = + x(a + y), whr x = t < = δ, A = + ( + ), y = (p + q ( + ) ) Using =, w hav, x < δ, y < γ 8 W hav to fin x 0, y 0 such that + x 0 (A + y 0 ) 0 mo, whr x 0 < δ an y 0 < γ So w hav to fin th roots of th polynomial f(x, y) = + x(a + y) Lt X = δ, Y = γ Thn X, Y ar th uppr bouns of x 0, y 0 nglcting th constant trms As th polynomial f(x, y) w hav scrib hr is sam as th polynomial in [6, Thorms, 4, 5], th uppr bouns X, Y of th roots will also sam Hnc, w can us th sam analysis of [6, Thorms, 4, 5] to not that RSA is inscur unr th following conitions: δ < γ + γ(γ + ) ; () γ < δ < γ; () 6γ 4γ + 4 (6γ ) δ < () 5 Th sha rgion in Figur intifis th valus of γ, δ for which w fin that RSA is inscur In th figur, g(γ) = γ+ γ(γ+) (corrsponing to Inquality ), f(γ) = 6γ γ (corrsponing to Inquality ) an h(γ) = 4γ+4 (6γ ) (corrsponing to 5 Inquality ) Th lowr boun of th Inquality, i, γ is mark by a straight lin

8 δ=05 05γ δ=05 δ=09 δ=f(γ) δ=g(γ) δ= γ δ=h(γ) δ γ Fig Th rgion for δ an γ valus for which RSA is inscur Th cas δ = 05 corrspons to th rsult of [], th cas δ = 09 corrspons to th rsult of [5] an th cas δ = 05 05γ corrspons to our Thorm Exampl For lattic bas stratgy, w hav implmnt th program in SAGE 0 ovr Linux Ubuntu 704 on a computr with Dual CORE Intl(R) Pntium(R) D CPU 80GHz, GB RAM an MB Cach Th lattic paramtrs us hr ar m = 7, t = an on may rfr to [6] for scription of ths lattic paramtrs Th attackr knows only, as scrib blow an tris to fin out W consir sam as in Exampl Th public xponnt is Th corrsponing cryption xponnt ( igit numbr) is , which givs δ is 076 Th valu of t is For th cass corrsponing to Inqualitis, an, w gt th lattics of imnsion w = 60, 5 an rspctivly an th rquir tims to fin ar 789, 774 an 409 scons Th ia of continu fraction mtho as xplain in Thorm will not work in this cas as th valu of δ is highr

9 RSA is wak whn is O( ) an is O( ) Lmma Lt < δ, whr 0 < δ Lt A, B b as in Proposition Thn for δ A+, it is possibl to gt z z such that B A+ z t z t < B+ z z whn < δ + z z < whn k < z B+ z an A+ A+ Proof As w hav < t, thr ar two cass with th conition z z > t t z but 0 z t < but 0 t z z < Cas Th conition hr is: t but 0 z z t < Thus, w hav to satisfy 0 z tz z <, i, 0 z +z tφ() tz z < t > Lt < δ, for δ > 0 Thn 0 z +z tφ() tz z < δ implis 0 z +z tφ() tz z < So w n to stimat z z consiring 0 z +z tφ() tz z < δ ow 0 z +z tφ() tz z < iff 0 z δ t z z ( + tφ()) < k + t iff φ() z z < δ +t if B+ z z (i) Proposition, (ii) > A+ δ δ z ( + tφ()) t < δ iff < δ +t if t +tφ() z z < δ + +tφ(), following A+ > δ, an (iii) = + tφ() t = φ() To hav an z z, w n < δ + B+ A+ For th guarant of gtting a rational z z in th intrval [, k + ), on may choos Clarly, < < B+ A+ B + B+ B + Thus, k + n to b satisfi This givs, B B A+ = (B+)+ δ A+ B A+ Cas Th conition hr is: t but 0 t With similar analysis, w gt δ < z B+ z, which again givs th sam uppr boun for A+ z z < Thorm Consir th intrval I such that I = ( δ, δ + ) Lt < δ, whr 0 < δ Thn for B+ A+ δ A+, an z z I, z z t < B A+ z Proof From Lmma w gt that z t < for th intrvals z B+ z < k + an k < z A+ B+ z A+ Sinc, δ < < z B+ A+ B+ z < δ +, it is nough to A+ hav z z in th intrval I = ( δ, δ + ) to gt z B+ A+ z t < for δ < δ A+ B A+

10 A+ B A+ Corollary Lt < δ, whr 0 < δ an δ in poly(log ) tim Proof Th proof follows from Lmma as will b foun in th CF xprssion of CF xprssion of B + < B+ B + < δ + z z whn z z = B + Thus t Thn can b factor Thn t A+ will b foun in th Blow w prsnt th summariz rsult which is a consrvativ on as th uppr boun of is unrstimat This rsult is gnral as it os not rquir th paramtr β for th proof, whr p q = β Thorm Lt = pq, whr p, q ar prims such that q < p < q Thn can b factor in poly(log ) tim from th knowlg of, whn < δ an is O( δ ) for δ Proof W hav, δ ) B = ( δ ( A+) B A+ ( B) A+ A+, whn β is nglct Thus, δ, an this incrass as A incrass Also th lowr boun of A is + + an this is O( δ ) Th rsults givn in Thorms, o not put any constraint on th iffrnc of th prims to gt a bttr boun on, but th constraint is impos on Whn < δ, thn A+ B A+ with incras in th valu of δ, th valu of bcoms uppr boun by δ In [5, Sction 4], CF xprssion of only a spcific valu + to gt t Thus compar to our cas, z z is approximat by Consiring Lmma, if + < b us to gt th prims, but our mtho will work Th xact algorithm for our propos attack is as follows + has bn xploit in [5, Sction 4] B+ δ, thn th approach of [5] may not Input:,, δ Comput th CF xprssion of + For vry convrgnt t of th xprssion abov if th roots of x ( + t )x + = 0 ar positiv intgrs lss than thn rturn th roots as p, q; Rturn ( failur ); Our consrvativ stimat shows that th RSA kys ar wak whn < δ an is O( δ ) For xampl, consiring δ = 0, 04, 045, 05, is boun by O( 09 ), O( 07 ), O( 06 ), O( 05 ) rspctivly

11 Howvr, w lik to point out that this is a consrvativ stimat an actually th uppr boun of is much bttr W hav δ A+ an th attack works for < n δ Thus th attack will work whn B A+ (+) A+ B A+, taking δ = + Exampl Rfr to p, q of Exampl W consir >, which is (a 07 igit numbr) Th corrsponing is (+) ot that, w n to chck A+ B A+ (+) A+ is B A , taking δ = + an th valu of , which is gratr than in Th valu of t is Hr t coul b foun in th CF xprssion of + Th CF xprssion of + is as follows 0, 8878,,, 4,,,,,, 8,, 54,, 7, 0,,, 44,,,, 68,, 9,,,, 8,,,,, 4,,,,, 4,,,,, 9,,,,, 06,,,, 9, 4, 9,,, 86,,,, 6,,,, 5, 4,,, 6,, 4,, 6,,,, 4, 8, 7,, 4,,,, 7,, 65,,, 6,,, 7, 9,,, 5,,,,,, 5,,,,, 4,,,, 4,,,, 4,,,,,,,,,, 5,,, 4, 4,,,, 0,,,,,,,,, 7,,,,,, 0,,,, 4,,,,,,, 69,,,,, 68,,,,, 4, 4,,, 5,, 5, 8, 6,,,,,, 4,,,, 4,,, 8,,,,,,,,,,,,,,,, 5,, 8,,,,,, 7, 4,,,,,, 6,,,, 47,,, 4,,,,,, 0, 4,,, 5,,, 0,,, 4,,,, 0,,,, 5, 9,, 6,,,, 4,, 5,, 457,,,, 9, 5,,,, 9,,,,,, 4, 58,, 4, 6,,,, 5,,,,, 4,,,, 6, 4,, 5,,,, 6, 47, 4,,,,,,,,,,,,, 7,,,, 5,,,,,,, 5,,,,,,, 7,, 0,,,, 5,,,,, 5,,,,, 4,, 9,,, 8,,,,,,, 7,,,,,,,, 0,,,, 4, 5,,,,,, 59,, 0,, 9,, 7, 9,, 7,,,,,, 5,,,,,, 8,,,,, 6,,, 7,, 7,,,, 0,,,,,,,,,,, 4,,, 8,,,,,,, 8,,,,, 6, 4, 9,,, 5,,,, 6, 8,, 6,,,,, 4,, 4,,,, 4,, 4,,,,,,, 5, 4,,,,, 6,,,,, 6,, 5,, 7,,,,,,,,,,,,, 5,, 5,,,, 9,,, 6, 5,,, 6,, 7, 4,,,,,,,, 6, 4,,,,,,, 6,, 7,,,, 8,,,,,,,,,,,, 4,,, 0,,,, 4,,,,,,,, 5,,,,,, 7,, 4, 6,, 5,,, 4,,, 0,,, 6,, 5,,,,, 6, 8,,, 9,,,,,,,,,,,,,,,,,,,, 4,,, 7,,, 4,, 7, 6, 6,, 4,, 4,, 6,, Th CF xprssion of t is as follows 0, 8878,,, 4,,,,,, 8,, 54,, 7, 0,,, 44,,,, 68,, 9,,,, 8,,,,, 4,,,,, 4,,,,, 9,,,,, 06,,,, 9, 4, 9,,, 86,,,, 6,,,, 5, 4,,, 6,, 4,, 6,,,, 4, 8, 7,

12 , 4,,,, 7,, 65,,, 6,,, 7, 9,,, 5,,,,,, 5,,,,, 4,,,, 4,,,, 4,,,,,,,,,, 5,,, 4, 4,,,, 0,,,,,,,,, 7,,,,,, 0,,,, 4,,,,,,, 69,,,,, 68,,,,, 4, 4,,, 5,, 5, 8, 6,,,,,, 4,,,, 4 Th mark in th CF xprssion of + points th trmination of th subsqunc for th CF xprssion of t ) This xampl corrspons to Corollary On may chck that t will not b foun in th continu fraction xprssion of (Winr s rsult []) or (Wgr s rsult [5, Sction 4]) in Exampl In this + xampl, 65 Actually, th boun 5 in Thorm is a consrvativ approximation of th rsult in Corollary In practic, w may gt rsults whn is gratr than 5 In [5, Sctions 5, 6], th approach of [4] has bn us to slightly improv th bouns of [5, Sctions 4] Th improvmnt in that cas is not vint whn p q approachs an it os not covr our rsults In Exampl, < p q < Thus, for p q = β, β > For β = 04995, w gt δ < β = 096 Thus th mtho of [5, Sction 6] will work for < 096 Our xampl consirs > an hnc not contain in th wak kys prsnt in [5, Sction 6] ow w prsnt anothr xampl Exampl 4 Rfr to p, q of Exampl W consir > Lt = (a 07 igit numbr) Th corrsponing is (+) ow th valu of A+ is B A , which is smallr than an thus th conition in Corollary is not satisfi Th valu of t is Th CF xprssion of + is as follows 0, 4,, 6, 49,, 6, 0, 74,,,,,,,, 4,,,,,,,,4,,, 4,,,, 9,,,,,, 6,,,,, 9,,,,,, 7,, 5,,,, 4,,,,, 88,,, 5,,,,, 6,,,,,, 9,,,,, 4,,,,,,,,,,,,,, 4,,, 5,,, 7,,, 6,,,, 7,,,,,, 8, 9,, 5,, 4,,, 6,,,, 5,, 4,,,, 5,,,,,,,,, 6,,,,,,,,, 8,,,, 5,, 4, 4, 0,,,,,,,, 9, 6,,,,,,,,,, 5, 5,, 4,, 7,,,,,,, 5,,,,, 7, 7,,,, 7,,, 6,,,,, 4, 5,,, 9,,,,,, 5,,, 5,,,,, 6,,, 7, 0,,, 7, 4, 7,,, 5,, 4,,,,

13 ,, 5,,,,,,, 6, 6,, 0,,,, 6,,,,,,,,,,,, 8,, 9,,,, 6,, 5,,, 0, 9,, 4,, 9,,,, 4, 6, 0,,, 5, 0, 4,,,, 4, 9,,,,,,, 4,,,,,,, 5, 4,, 5,,, 4,, 6, 4, 8,, 8, 47, 0,,,, 7,,,,,,, 0,,,, 9, 440,,,, 6,,,,,,,,,,,, 48, 6,, 5,,, 4,,, 4, 4, 9, 50,, 8,,,,,,, 4,,, 5, 9, 7,,,,,,, 8,, 6,,, 4,, 4,, 6,,, 4, 6,,, 6, 7, 6,, 4, 8,,,,,,,,, 8,,,,,,,,, 4, 5,, 5,,, 4,,, 78,,,,,,,,, 4, 6,,,,,,,, 6,, 76,,,,,,,,,, 5,,,,,, 6,,,,, 5,, 9,, 40,,,, 7,,,, 4,, 5,, 4,,,,,,,, 5,, 9,,, 5,,,,,,, 9,,, 7,,,,,, 5,,, 4, 4,,,,, 7,, 5,,, 8,,,,,,,,,,,, 6,,,, 6,,,,,, 6,,,,, 6,,,,, 5, 5,,,,, 4,,,,,,, 9,,, 9,,, 5,,,, 9,,,,,,, 8,,,,,, 4,,,,, 6,,,,, 4,,,, 4,, 0,,,, 8, 9,,,,,,, 44, 7868,,, Th CF xprssion of t is as follows 0, 4,, 6, 49,, 6, 0, 74,,,,,,,, 4,,,,,,,, 4,,, 4,,,, 9,,,,,, 6,,,,, 9,,,,,, 7,, 5,,,, 4,,,,, 88,,, 5,,,,, 6,,,,,, 9,,,,, 4,,,,,,,,,,,,,, 4,,, 5,,, 7,,, 6,,,, 7,,,,,, 8, 9,, 5,, 4,,, 6,,,, 5,, 4,,,, 5,,,,,,,,, 6,,,,,,,,, 8,,,, 5,, 4, 4, 0,,,,,,,, 9, 6,,,,,,,,,, 5, 5,, 4,, 7,,,,,,, 5,,,,, 7, 7,,,, 7,,, 6,,,,, 4, 5,,, 9,,,,,, 5,,, 0 ot that th CF xprssion of t coul not b foun (last thr placs o not match) in th CF xprssion of + Rmark W prsnt Exampl 4 to show th ffcts of th uppr boun on in Thorm as wll as th uppr bouns on, in Corollary ot that of Exampl < of Exampl 4 < of Exampl For th of Exampl 4, t cannot b foun in th CF xprssion of + Th of Exampl 4 os not satisfy th conition givn in Thorm On th othr han, though of Exampl 4 < of Exampl, th boun on corrsponing to Corollary is not satisfi in Exampl 4 On may not that in Exampl 4, th CF xprssion of t os not match only in thr placs at th n with th initial subsqunc of th CF xprssion of + Thus, th ia of sarch in th lin of [] will actually provi th xact rsult with som xtra ffort w Wak Kys II Lt us rstat th rsult of [, Thorm ], whr it was prov that p, q can b foun in polynomial tim for vry, satisfying x + y 0 mo φ(), with x 4 an y = O( 4 x) Consir that x + y 0 mo φ() an th intrst is on th nontrivial cass Thus x+y = m( p q +) This givs m = m(p+q )+y If m = m(p+q )+y <, x x x x x thn th fraction m appars among th convrgnts of Thus on ns to fin out th x

14 conitions such that m(p + q ) + y < is satisfi Calculation shows that for y = x O( 4 x), on gts x 4 ot that insta of trying to fin m among th convrgnts of, a bttr attmpt will x b to fin m among th convrgnts of, whr x φ () φ () is a bttr stimat than for φ() Following th ia of [5], φ () has bn takn as (i, th uppr boun of φ()) an th CF xprssion of has bn consir to stimat m in [, Sction x 4] It has bn prov in [, Thorm 4, Sction 4] that p, q can b foun in polynomial tim for vry, satisfying x + y 0 mo φ(), with x φ() 4 an y p q x p q φ() 4 ow w start with th following Lmma Lmma Lt x + y = mφ() for m > 0 Thn whn y c 4 x, whr c an p q c Proof Lt us list th following obsrvations + m < for x 7 x x 4 4 From Proposition, w hav + < φ() < +, which givs, ( ) < p+q < 0 Thus, ( ) > p+q, i, ( ) > p + q Also not that y c 4 x, which givs y < x 4 as < an c From [, Proof of Thorm ], x m 5 x 4 φ() 4 φ() ow, This givs, + m x = m( p q+ ) y x( +) + m x < m(( ow, m(( ) )+ y x( +) < x if 5 4 if 5 4 x(( ) )+x 4 x( +) < x (as if ( +) < ) )+ y x( +) using itm x φ() (( ) )+x 4 x( +) < x (using itms, ) φ() < ) iff 5 4 (( ) )+ 4 ( +) < x x (as < 0 an 5 4 ( ) ) + 4 < for larg ) iff 5 0x < + if x < 076 (for larg ) if x 75 4 This shows that th class of wak kys intifi in [, Thorm ] can b xtn by, i, by mor than 5 tims 4 In th improv rsult of [, Thorm 4, Sction 4], it has bn shown that p, q can b foun in polynomial tim for vry, satisfying x + y = 0 mo φ(), with 0 < x φ() 4 p q an y p q φ() 4 x Our rsult in Lmma provis nw wak kys which ar not covr by th rsult of [, Thorm 4, Sction 4] in crtain cass as follows

15 Lt p q = c As, q < p < q, w hav p q < Thus, c < In [, Thorm 4, Sction 4], it is givn that x φ() 4 Putting p q = c, w fin x φ() 4 p q c Thus our rsult in Lmma provis xtra wak kys than [, Thorm 4, Sction 4] whn c φ() 4 < 7 4, which is tru for > ( ) 4 4 φ() c As < φ(), 4 <, which givs c Thus th rsult our Lmma prsnts nw wak kys ovr In [, Thorm 4, Sction c > 4 4] whn > ( ) 4 φ() c for 4 < c < xt w us our ia of consiring q p (as prsnt in Proposition ) insta of p q Thorm 4 Lt q p γ whr an γ Suppos satisfis th quation x+y = mφ(), for m > 0 Thn can b factor in O(poly(log())) tim whn 0 < x φ() γ an y q p x 6 φ() 4 Proof W hav m = x+y Using th boun on y, w gt m x φ() ( ) m = x m ( + ) ) + ( ) + x ( + ( = m ( x ( m ( x ( ( + ) p q ( + ) + ( + ) p q x φ() ( + ) + q p (+ φ() ) 4 th uppr ( boun of y) )( = φ() < φ() x ( q p (+ φ() 4 ) x ( + ) + ) y ) (putting x = y + mφ()) ) + y ) )( ) ( + ) p q + q p φ() 4 x ( + ) + ( + ) p q)+ q p φ() 4 ( ( + ) + γ + γ γ 4 ( + ) + < γ φ() ( + ) + ) ( φ() + q p ) ow, φ() 4 ) (putting th uppr boun on m an using (Using q p γ an + ) p q < γ ) < 8 γ (Assum ( + φ() ) + > ) 6 So w gt m via CF xpansion of x < φ() x i, x < 6 Givn, φ() γ ( + ) if + ( + ) m <, can b factoriz using [, Algorithm Gnraliz + x x Winr Attack II] Th rsult of [, Thorm 4, Sction 4] stats that p, q can b foun in polynomial tim for vry, satisfying x+y 0 mo φ(), with 0 < x φ() 4 p q an y p q φ()n 4 x

16 In our rsult p q is rplac by q p whr is known to th attackr Thus th rsults of this sction prsnt nw wak kys othr than thos prsnt in [] Th rsult of [, Thorm 4, Sction 4] works fficintly whn p q is uppr boun an our work givs bttr rsults whn q p is uppr boun A Practical Exampl an Enumration of Wak Kys Exampl 5 W consir sam (065-bit intgr) as in Exampl an tak = Hr public xponnt is 050-bit intgr Using th convrgnts of CF xprssion, w fin x as an m as As, + x = p + q + y, with th knowlg of,, x, m on can gt a goo m m approximation of p + q whn y is in th spcifi boun (in this cas, y is in insi th boun having th valu 498) Thn using th ia of [6], th valus of factors p, q can b known in O(poly(log())) tim In this xampl, is 06-bit intgr ow w lik to point out that th wak ky of Exampl 5 is not covr by th works of [, 5, ] In this cas, th cryption xponnt is a 0-igit intgr ( > 099 ) an hnc th boun of [] that < 4 will not work hr Hr p q > 049 an accoring to [5, Sction 6] on can consir β = 049 If = δ, thn accoring to [5, Sction 6] th boun of δ will b 4β < δ < β for RSA to b inscur Putting β = 049, on can gt 004 < δ < 0 In Exampl 5, > 099 an hnc th wak kys of [5] os not covr our rsult In [, Thorm 4, Sction 4], it has bn shown that p, q can b foun in polynomial tim for vry, satisfying x + y = mφ(), with 0 < x Accoring to [], convrgnts of th CF xprssion of φ() 4 p q an y p q φ() 4 x will provi m For th x φ() 4 p q paramtrs in Exampl 5, w calculat all th convrgnts with x an w fin that for ach such m, x, x mφ() > p q x As y = x mφ(), th boun on φ() 4

17 y is not satisfi Thus th wak ky prsnt in Exampl 5 is not covr by th work of [] To stimat th numbr of wak kys, w us th sam approach as in [] W first us th following xisting rsult Lmma [, Lmma 6] Lt f(, ), g(, ) b functions such that f (, )g(, ) < φ(), f(, ) an g(, ) f(, ) Th numbr of public kys Zφ(), φ() 4 that satisfy an quation x + y 0 mo φ() for x f(, ) an y g(, )x is at last f (, )g(, ) 8 log log ( ) O(f (, ) ɛ ), whr ɛ > 0 is arbitrarily small for suitably larg ow w prsnt our stimat using similar analysis as in [, Thorm 7] First lt us prsnt th finition of th class of wak kys as prsnt in [, Dfinition 5] Dfinition Lt C b a class of RSA public kys (, ) Th siz of th class C is fin by siz C () = { Zφ() (, ) C C is call wak if siz C () = Ω( γ ) for som γ > 0 Thr xists a probabilistic algorithm which on vry input (, ) C outputs th factorization of in O(poly(log )) tim Thorm 5 Lt q p = 4 +γ with 0 < γ Furthr, lt C b th wak class that is 4 givn by th public ky tupls (, ) fin in th Thorm 4 with th aitional rstrictions that Zφ() φ() an Thn siz 4 C () = Ω( 4 ) Proof Hr f(, ) = φ(), an g(, ) = q p Clarly f(, ) Also, 6 q p φ() 4 f (, )g(, ) < φ() Again g(, ) f(, ) Hnc, w can apply Lmma Sinc g(, ) = Ω( γ ), th trm f (, )g(, ) 8 log log ( ) ominats th rror trm O(f (, ) ɛ ) Using f (, )g(, ) = Ω( 4 ), w gt th stimat 4 Conclusion In this papr w stuy th wll known mtho of Continu Fraction (CF) xprssion to monstrat nw wak kys of RSA Th ia is to factoriz using th knowlg of an som stimat of φ() On may not that in most of th cass t can b foun in th CF xprssion of This ia was first propos in [], whr th CF xprssion has bn φ()

18 us to stimat t, i, has bn us as an stimat of φ() Latr to that, + (an uppr boun of φ()) has bn us as an stimat of φ() in many works, g, [5, ] In this papr w hav stui both th uppr an lowr bouns of φ() carfully an us ( + ) + as an stimat of φ() W xtnsivly stuy th cass whn t can b foun in th CF xprssion of ( + ) Our rsults provi nw wak kys ovr + th work of [5, ] an to th bst of our knowlg th wak kys intifi in our papr hav not bn prsnt arlir Acknowlgmnts: Th authors lik to thank Prof Bnn Wgr for his tail commnts on an initial vrsion of this papr post at on -Jul- 008 Motivat by that, w hav introuc th paramtr in this papr Prof Wgr has also point out that th paramtr τ (in th sai vrsion of this papr) cannot b consir small Bas on ths, w hav moifi Thorms an 4 in this vrsion W also thank th anonymous rviwrs of this papr for thir commnts that improv th tchnical as wll as itorial quality of this papr Th scon author liks to acknowlg th Council of Scintific an Inustrial Rsarch (CSIR), Inia for supporting his rsarch fllowship Rfrncs J Blömr an A May Low scrt xponnt RSA rvisit CaLC 00, LCS 46, pp 4 9, 00 J Blömr an A May A gnraliz Winr attack on RSA PKC 004, LCS 947, pp, 004 D Bonh Twnty Yars of Attacks on th RSA Cryptosystm otics of th AMS, 46():0, Fbruary, D Bonh an G Durf Cryptanalysis of RSA with privat ky lss than 09 Eurocrypt 999, LCS 59, pp, D Bonh an G Durf Cryptanalysis of RSA with privat ky lss than 09 IEEE Trans on Information Thory, 46(4):9 49, D Coppprsmith Small solutions to polynomial quations an low xponnt vulnrabilitis Journal of Cryptology, 0(4): 60, J -S Coron an A May Dtrministic Polynomial-Tim Equivalnc of Computing th RSA Scrt Ky an Factoring J Cryptology 0():9 50 (007) 8 A Dujlla Continu fractions an RSA with small scrt xponnt Tatra Mt Math Publ, vol 9, pp 0, E Jochmsz Cryptanalysis of RSA variants using small roots of polynomials Ph D thsis, Tchnisch Univrsitit Einhovn, J Hasta On using RSA with low xponnt in public ky ntwork Lctur ots in Computr Scinc, Avancs in Cryplogy-CRYPTO 85 Procings w York: Springr-Vrlag, pp D Ibrahim, H M Bahig, A Bhry an S S Daou A nw RSA vulnrability using continu fractions In th 6th ACS/IEEE Intrnational Confrnc on Computr Systms an Applications (AICCSA 008), March April 4, 008, Doha, Qatar E Jochmsz an A May A Polynomial Tim Attack on RSA with Privat CRT-Exponnts Smallr Than 007 CRYPTO 007, LCS 46, pp 95 4 J M Pollar Thorms on factorization an primality tsting Proc of Combrig Philos Soc, vol 76, pp 5 58, R L Rivst, A Shamir an L Alman A mtho for obtaining igital signaturs an public ky cryptosystms Communications of ACM, ():58 64, Fb K H Rosn Elmntary umbr Thory Aison-Wsly, Raing Mass, 984

19 6 S Sarkar, S Maitra an S Sarkar RSA Cryptanalysis with Incras Bouns on th Scrt Exponnt using Lss Lattic Dimnsion Cryptology Print Archiv: Rport 008/5, Availabl at 7 R D Silvrman Fast gnration of ranom, strong RSA prims Cryptobyts, ():9, D R Stinson Cryptography Thory an Practic n Eition, Chapman & Hall/CRC, 00 9 R Stinfl, S Contini, J Piprzyk an H Wang Convrs rsults to th Winr attack on RSA PKC 005, LCS 86, pp 84 98, H -M Sun an C -T Tang RSA with Balanc Short Exponnts an Its Application to Entity Authntication PKC 005, LCS 86, pp 99 5, 005 H -M Sun, M -E Wu an Y -H Chn Estimating th prim-factors of an RSA moulus an an xtnsion of th Winr attack ACS 007, LCS 45, pp 6 8, 007 E R Vrhul an H C A van Tilborg Cryptanalysis of lss short RSA scrt xponnts Applicabl Algbra in Enginring, Communication an Computing, vol 8, pp 45 45, 997 M Winr Cryptanalysis of short RSA scrt xponnts IEEE Transactions on Information Thory, 6():55 558, H C Williams A p + mtho of factoring Mathmatics of Computation, 9(59):5 4, July 98 5 B Wgr Cryptanalysis of RSA with small prim iffrnc Applicabl Algbra in Enginring, Communication an Computing, ():7 8, 00