Estimating the φ(n) of Upper/Lower Bound in its RSA Cryptosystem

Transcription

1 Estimatig the φ() of Upper/Lower Boud i its RSA Cryptosystem Cheglia Liu 1 ad Ziwei Ye 2 1 Departmet of Electrical Egieerig, Natioal Tsig-Hua Uiversity, Taiwa cheglia.liu@gmail.com 2 Departmet of Computer Sciece ad Techology, Tsig-Hua Uiversity, Beijig, Chia @QQ.COM Abstract. The RSA-768 (270 decimal digits) was factored by Kleijug et al. o December , ad the RSA-70 (212 decimal digits) was factored by Bai et al. o July 2, Ad the RSA-200 (663 bits) was factored by Bahr et al. o May 9, Util right ow, there is o body successful to break the RSA- 210 (696 bits) curretly. I this paper, we would discuss a estimatio method to approach lower/upper boud of φ() i the RSA parameters. Our cotributio may help researchers lock the φ() ad the challege RSA shortly. Keywords: RSA cryptosystem; Euler s totiet fuctio; Factorig; 1 Itroductio Challege RSA [12] is a iterestig ad difficult work. Recetly, most scietists ad researchers [1,, 8] usig geeral umber field sieve (GNFS) algorithm to factor RSA modulus. I practical eviromet, it looks like if you to wat to break the RSA, you may have best choice to choose GNFS whe you already factor the modulus. I theoretical, Wieer [17] first proposed a cryptaalysis of short secret expoets where the d < N 0.5 i Boeh [3] preseted Twety years of attacks o RSA cryptosystem i He classified ad described varieties attack. Followed by Boeh ad Durfee [2], they suggested the provate key d should be greater tha N for the security problem. Eve though, some bodies focus o secret key d or factor composite umber. Their purpose are clearly. We ca ot help but thik, does it exist a geeral estimatio way without factor to challege RSA? I this article, we would itroduce a ew methodology where approach the lower boud ad the upper boud of φ(). For this geeralize coceptio, it may match ay bit legth composite umber. 2 Review of RSA Coceptio The siger prepares the prerequisite of a RSA sigature: Two distict large prime p ad q, = pq, Let e be a public key so that gcd(e, φ()) = 1, where φ() = (p 1)(q 1), the calculate the private key d such that ed 1 (mod φ()). The siger publishes (e, ) ad keeps (p, q, d) secretly. The otatio as same i [12].

2 2 Cheglia Liu ad Ziwei Ye 2.1 RSA Ecryptio ad Decryptio I RSA public-key ecryptio, Alice ecrypts a plaitext M for Bob usig Bob s public key (, e) by computig the ciphertext C M e (mod ) (1) where, the modulus, is the product of two or more large primes, ad e, the public expoet, is a (odd) iteger e 3 that is relatively prime to φ(), the order of the multiplicative group Z. 2.2 RSA Digital Sigature s M d (mod ) (2) where (, d) is the siger s RSA private key. The sigature is verified by recoverig the message M with the siger s RSA public key (, e): M s e (mod ) (3) 3 Our Methodology I this sectio, we would calculate the upper boud ad the lower boud of φ() i RSA scheme. The detail described as below. Notatio: l: meas lower boud. u: meas upper boud. ε: a decimal expasio umber (e.g 99/100 = 0.99 ). 3.1 Approachig φ() If is composite, hece φ(), () Sierpiski [15] metioed it i 196. It is kow that if equatio () is a good upper boud for φ(). Is there a good lower boud for φ()? This questio also be discussed by a ewsgroup dialog betwee Ray Steier ad Bob Silverma i 1999 [16]. For > 30, the φ() > 2/3, Kemdall ad Osbor proved it [7]; for 3, the φ() > log 2 2 log give by Hatalova ad Salat [6] Estimate upper boud Does the equatio () a good upper boud? I follows, we would estimate a ew value where its smaller tha previous ad optimize. Theorem 1. Assume p, q are large prime umbers, where = pq, the φ() = k, k Z where 1 k 2 +1.

3 Estimatig the φ() of Upper/Lower Boud i its RSA Cryptosystem p q l φ() u Cetral Approachig Lower Boud Upper Boud Fig. 1. The lower/upper boud of φ() i RSA scheme. Proof. As kow two variat p ad q are large prime umbers, ad p, q > 2, sice 2 p, 2 q, therefore 2 p 1, 2 q 1. (p 1)(q 1), φ(). φ() = k, k Z +. We will discuss how calculate the rage of value k. Ad φ() = (p 1)(q 1) = pq (p + q) + 1 = (p + q) + 1. (5) p + q 2, p + q Z +, 2 p + q. p + q 2. φ() φ() = k, k Z +. φ() (6) Here, we kow the maximum value (limit superior) for k 2 +1, we call boudary value. Cosequetly, accordig to above iferece, we obtai a best upper boud u of φ() where φ() Theorem 2. Assume p, q are large prime umbers, ad p, q > 2, = pq, where φ() t, t Z. The t = φ() x 2 ( + 1 t)x + = 0 have two positive iteger solutios. Proof. We describe two properties, ecessary ad sufficiet coditios as follow: Necessary coditio: If t = φ() = (p 1)(q 1) = pq (p+q)+1 = (p+q)+1, the +1 t = p+q,

4 Cheglia Liu ad Ziwei Ye i the same time, the formula be x 2 (p + q)x + pq = 0. It is clearly, the equatio of the two roots p ad q are eeded to set up. Sufficiet coditio: If equatio x 2 ( + 1 t)x + = 0 have two iteger solutios. Assume x 1, x 2 be the equatio of the two roots, where x 1, x 2 Z +. The equatio could be trasformed to (x x 1 )(x x 2 ) = 0. Promptly, x 2 (x 1 + x 2 )x + x 1 x 2 = 0. The = x 1 x 2, accordig to s structure, there are two choice: 1) x 1 = 1 ad x 2 = (or x 1 = ad x 2 = 1). 2) x 1 = p ad x 2 = q (or x 2 = q ad x 2 = p). If x 1, x 2 oe for 1 ad. Now, x 1 + x 2 = + 1, because x 1 + x 2 = + 1 t, hece t = 0. However, i our assumptio, the coditio is t > 0, so this iferece cotradictio. The equatio have two itegers p ad q where x 1 + x 2 = p + q, (7) the Promptly, ad p + q = + 1 t. (8) t = + 1 (p + q), (9) t = φ(). (10) Thus, for the sufficiet coditio is settig up. Theorem 3. Assume p, q are large prime umbers, ad p, q > 2, = pq, t = k where φ() t, t Z. If ( + 1 t) 2 is a iteger umber, the equatio x 2 ( + 1 t)x + = 0 has two iteger solutios. Proof. Sice p, q are both prime umbers where = pq, 2, but Suppose t = k, ad 2 t. Thus t. If ( + 1 t) 2 Z, so 2 ( + 1 t) 2. The equatio x 2 ( + 1 t)x = 0 of the two solutios are: x = +1 t± (+1 t) 2 2. Because t, ad while ( + 1 t) 2 Z, it exists 2 ( + 1 t) 2. Whe ( + 1 t) 2 Z, t ± ( + 1 t) 2. Due to ( + 1 t) 2 Z, the x is also Z. Here, the two solutios of equatio x 2 ( + 1 t)x + = 0 are both itegers Estimate lower boud Loomis et al. [10] thought the Shapiro s [13] lower boud φ() > (log 2) /(log 3) as a (aive) lower boud for E, they ca determie whe all members of a give E have bee foud. Powell [11] poited out that Koyagi ad Shparliksi s lower boud N 1 (, p) > (p 1)/2 p 3/2 / where > 1 is a

5 Estimatig the φ() of Upper/Lower Boud i its RSA Cryptosystem 5 q prime q positive iteger ad that p is a odd prime umber with p 1 (mod ); that is a good boud if p is a small compared to, ad establishes that N 1 (, p) ( φ()( q 1/(q 1) )/)p 1 1/φ(). Powell also discussed a improvemet the upper ad lower bouds i [11]. What is the optimal lower boud? The other discuss i followig: Theorem. For all 3 we have φ() e γ log log + Ø( (log log ) ), where γ 2 is the Euler-Mascheroe Costat, ad the above holds with equality ifiitely ofte. Remark:ote i particular that sice loglog as grows large, we see that the result m < φ() ca ot hold for ay fixed iteger m. Proof. Cosider R, set of all such that m < implies φ() m. This set is the all of the record breakig. If R has k prime factors, let be the product of the first k prime factors. If ad φ() φ(), which is impossible. Hece, R cosist etirely of of the form = p y p for some y. Now for R, we ca choose y so that log = p y log p = θ(y). The usig oe of Mertes estimates we see that φ() = p y (1 1 p ) = e γ log y +O( 1 (log y) ). Sice log log = log(θ(y)) = log y+ø(1) 2 by Mertes estimates agai, we have for R, φ() = e r log log + O( 1 (log log ). 2 < φ(m) Fig. 2. The same digits of φ() ad modulus parameters i RSA. From above, it seems so complexity. Does it exist a simple computatio method? We observed the modulus with φ(), there have some characteristics. A example for RSA-200, the modulus ad the φ() are 200 decimal digits. We compared ad φ() each other, there are the same digits from left to right 110 digits. The example showed i Figure 2. Discuss o RSA modulus umber with haft of the bit prescribed, be itroduced some literatures i [5, 9, 1]. To RSA-70, the ad φ() had same Table 1. Compariso of some types i RSA parameters. Uit: decimal digits type Modulus legth φ() legth p legth q legth same digits & φ() same digits φ() &u RSA RSA ?? RSA RSA

6 6 Cheglia Liu ad Ziwei Ye digits 106, it amouts same legth with p or q. We computed the upper boud value accordig to Theorem 1, this upper boud had same 108 digits with its φ(). Ad aalyzed the RSA-768, the had 115 digits same with φ(); the φ() had 120 digits same with its upper boud u. Please see Table 1 We observed the relatioship of φ() ad its boudary value k, whe φ() divided by k, we obtaied this quotiet are very approachig to umber, these lower bouders are very close to multiples of umber. We say 3.999, ad have 106 s 9 after decimal poit for case of RSA-210 type. The lower boud approximatio figure diagram be show i figure ad i Table 2. As Fig. 3. The lower boud approximatio curve status. Table 2. The relatioship of φ() ad its boudary value k. type φ()/k statemet RSA RSA RSA RSA s there have 99 s 9 after the decimal poit 106 s Estimatig have 106 s 9 after decimal poit 107 s there have 107 s 9 after decimal poit 117 s there have 117 s 9 after decimal poit kow as the modulus umber of RSA-210, we re-estimated its lower/upper bouds. We assume: (3 + ε) φ() 2 + 1, (11)

7 Estimatig the φ() of Upper/Lower Boud i its RSA Cryptosystem s 9 where ε = We therefore compute the upper boud u ad lower boud l; those show result i Figure. Fig.. The lower/upper boud parameters of φ() i RSA-210. Coclusio I this paper, we re-estimated a ew lower/upper boud values of φ() i RSA-210, our methodology are easily, simply, clearly, o itricately ad ituitive. It may be useful to researchers who would quickly reduce the searchig rages. Lookig back, more researchers focus o secret d or modulus, such as well kow short expoet attack, side chael attack, or commo modulus ad cyclic attacks. Our method is differ to previous literatures. Fially, We preseted what we claimed actually. Refereces 1. Bai, S., Thomé, E., Zimmerma, P.: Factorisatio of RSA-70 with cado-fs. IACR Cryptology eprit Archive p. 369 (2012) 2. Boeh, D., Durfee, G.: Cryptaalysis of RSA with private key d less tha N IEEE Trasactios o Iformatio Theory 6(), (July 2000) 3. Boeh, D.: Twety years of attacks o the RSA cryptosystem. Notices of the AMS 6, (1999). F. Bahr, M. Boehm, J.F., Kleijug, T.: RSA-200 is factored. Website (2005), Graham, S.W., Shparliski, I.E.: O RSA moduli with almost half of the bits prescribed. Discrete Applied Mathematics 156(16), (2008) 6. Hatalova, H., Salat, T.: Remarks o two results i thelemetary theory of umbers. Acta. FacRer. Natur Uiv Comeia. Math. (20), (1969) 7. Kedall, D.G., Osbor, H.B.: Two Simple Lower Bouds for Euler s Fuctio, vol. 17. Texas Joural of Sciece (1965) 8. Kleijug, T., Aoki, K., Frake, J., Lestra, A.K., Thomé, E., Bos, J.W., Gaudry, P., Kruppa, A., Motgomery, P.L., Osvik, D.A., Te Riele, H., Timofeev, A., Zimmerma, P.: Factorizatio of a 768-bit RSA modulus. I: Proceedigs of the 30th aual coferece o Advaces i cryptology. CRYPTO 10 (2010)

8 8 Cheglia Liu ad Ziwei Ye 9. Meg, X.: O RSA moduli with half of the bits prescribed. Joural of Number Theory 133(1), (2013), article/pii/s002231x Paul Loomis, M.P., Polhill, J.: Summig up the Euler φ fuctio. The College Mathematics Joural 39(1), 3 2 (2008) 11. Powell, C.: Bouds for multiplicative cosets over fields of prime order. Mathematics of Computatio 66(218), (April 1997) 12. Rivest, R., Shamir, A., Adlema, L.: A method for obtaiig digital sigatures ad publickey cryptosystems. Commuicatios of the ACM 21, (1978) 13. Shapiro, H.: A arithmetic fuctio arisig from the φ fuctio. The America Mathematical Mothly 50, (193) 1. Shparliski, I.: O RSA moduli with prescribed bit patters. Desigs, Codes ad Cryptography 39 (2006) 15. Sierpiski, W.F.: Elemetary Theory of Numbers. North-Hollad PWN-Polish Scietific Publishers, Warsawa (196) 16. Silverma, B.: Euler s phi fuctios. Website (2012), rusi/kow-math/99/mi_phi 17. Wieer, M.J.: Cryptaalysis of short RSA secret expoets. IEEE Trasatios o Iformatio Theory