A generalized attack on RSA type cryptosystems

Transcription

1 A gnralizd attack on RSA typ cryptosystms Martin Bundr, Abdrrahman Nitaj, Willy Susilo, Josph Tonin Abstract Lt N = pq b an RSA modulus with unknown factorization. Som variants of th RSA cryptosystm, such as LUC, RSA with Gaussian prims and RSA typ schms basd on singular lliptic curvs us a public ky and a privat ky d satisfying an quation of th form d k ( p 2 ) ( q 2 ) =. In this papr, w considr th gnral quation x ( p 2 ) ( q 2 ) y = z and prsnt a nw attack that finds th prim factors p and q in th cas that x, y and z satisfy a spcific condition. Th attack combins th continud fraction algorithm and Copprsmith s tchniqu and can b sn as a gnralization of th attacks of Winr and Blömr-May on RSA. Introduction In 978, Rivst, Shamir and Adlman [20] proposd RSA, th first and widly most usd public ky cryptosystm. Th scurity of RSA is mainly basd on th hardnss of factoring larg composit intgrs, nvrthlss, RSA has bn xtnsivly studid for vulnrabilitis by various non factorization attacks. Th public paramtrs in RSA ar th RSA modulus N = pq which is th product of two larg prims of th sam bit-siz and a public xponnt satisfying gcd(, (p )(q )) =. Th corrspondnt privat xponnt is th intgr d < N satisfying d (mod (p )(q )) which can b rwrittn as a ky quation d k(p )(q ) =. In RSA, th ncryption and dcryption tim ar proportional to th bit-lngth of th public and th privat xponnts. To rduc ncryption or dcryption tim, on may b tmptd to us small public xponnts or privat xponnts. Whil a fw attacks on RSA with small public xponnt hav bn launchd (s [0]), many attacks on RSA with School of Mathmatics and Applid Statistics, Univrsity of Wollongong, Australia, martin bundr@uow.du.au Laboratoir d Mathématiqus Nicolas Orsm, Univrsité d Can Normandi, Franc, abdrrahman.nitaj@unican.fr School of Computing and Information Tchnology, Univrsity of Wollongong, Australia, willy susilo@uow.du.au School of Computing and Information Tchnology, Univrsity of Wollongong, Australia, josph tonin@uow.du.au@uow.du.au

2 small or spcial privat xponnt d xploit th algbraic proprtis of th ky quation. In 990, Winr [24] prsntd an attack on RSA that solvs th ky quation and factors N if d is sufficintly small, namly d < 3 N Winr s attack consists on finding k d among th convrgnts of th continud fraction xpansion of N and thn using k d to factor N. Winr s attack on RSA has bn xtndd in many ways using lattic rduction and Copprsmith s mthod [7] (s [2], [], [7]). In 997, Bonh and Durf [4] usd lattic rduction and Copprsmith s mthod to improv th bound to d < N In 2004, Blömr and May studid th variant quation x + y 0 (mod (p )(q )) and showd that th RSA modulus can b factord if th unknown paramtrs satisfy x < 3 N 0.25 and y cn 3 4 x for som constant c. In ordr to improv th implmntation of th RSA cryptosystm, many schms hav bn prsntd giving ris to RSA typ cryptosystms [3]. On way to xtnd RSA is to considr a prim-powr modulus of th form N = p r q with r 2 (s [22]) or a multi-prim modulus of th form N = p p 2... p r. Anothr way to xtnd RSA is to considr th modulus N = pq and th xponnt with spcific arithmtical oprations such as lliptic curvs [4] [3], Gaussian domains [8] and quadratic filds [9]. In 995, Kuwakado, Koyama and Tsuruoka [4] prsntd a schm basd on using an RSA modulus N = pq and a singular cubic quation with quation y 2 = x 3 + bx 2 mod N whr a mssag M = (m x, m y ) is rprsntd as a point on th singular cubic quation. In this systm, th public xponnt and th privat xponnt d satisfy an quation of th form d k ( p 2 ) ( q 2 ). In 2002, Elkamchouchi, Elshnawy and Shaban [8] adaptd RSA to th Gaussian domain by using a modulus of th form N = P Q whr P and Q ar two Gaussian prims. Th public xponnt and th privat xponnt d satisfy d (mod ( P ) ( Q )). Whn P = p and Q = q ar intgr prim numbrs, th quation bcoms d (mod ( p 2 ) ( q 2 ) ) =. In 993, Smith and Lnnon proposd LUC [2], whr th public xponnt and th privat xponnt d ar such that d (mod ( p 2 ) ( q 2 ) ). In 2007, in connction with LUC, Castagnos [6] proposd a schm that uss an RSA modulus N = pq and a public xponnt. Th two public paramtrs N and ar such that gcd (, ( p 2 ) ( q 2 )) = which implis th xistnc of two positiv intgrs d and k satisfying th quation d k ( p 2 ) ( q 2 ) =. Th formr four variants of RSA us a modulus N = pq and a public xponnt satisfying an quation of th form d k ( p 2 ) ( q 2 ) =. In [5], an attack 2N is prsntd that solvs th formr quation whn d satisfis d < 3 8N 2. Th attack, which is rlatd to Winr s attack on RSA, is basd on applying th continud fraction algorithm to find k d among th covrgnts of th continud fraction xpansion of N N+. In this papr, w considr an xtnsion of this attack by studying th mor gnral quation x ( p 2 ) ( q 2 ) y = z whr th unknown paramtrs x, y, z satisfy xy < 2N 4 2N 3 4 and z < (p q)n 4 y. 2

3 Th nw attack uss th convrgnts of th continud fraction xpansion of to find y N N x and thn applis Copprsmith s tchniqu [7] to find p and q. Th rmaindr of th papr is organizd as follows. In sction 2, w rcall som RSA typ schms that ar basd on a modulus of th form N = pq with a public xponnt satisfying gcd (, ( p 2 ) ( q 2 )) =. In Sction 3, w brifly rviw som basic rsults usd in th papr, including continud fractions and Copprsmith s tchniqu. In Sction 4, w prsnt som lmmas that will b usd in th papr. In Sction 5, w prsnt our nw mthod. In Sction 6, w giv a numrical xampl. W conclud th papr in Sction 7. 2 Variant RSA schms Lt N = pq b an RSA modulus and a public intgr. In this sction, w brifly dscrib thr schms that ar variants of th RSA cryptosystm with a modulus N = pq and with a public ky and a privat ky d satisfying d k ( p 2 ) ( q 2 ) =. As this quation dos not dpnd on th undrlying variant schms, w thn gnraliz it to th quation x ( p 2 ) ( q 2 ) y = z which is th main focus of this papr. 2. LUC cryptosystm In 993, Smith and Lnnon [2] proposd a variant of th RSA cryptosystm, calld LUC, basd on a Lucas functions. In LUC, th modulus is a RSA modulus N = pq and th public xponnt is a positiv intgr satisfying gcd (, ( p 2 ) ( q 2 )) which can b rwrittn as an quation d k ( p 2 ) ( q 2 ) =. A mor gnral quation is x ( p 2 ) ( q 2 ) y = z with th unknown paramtrs x, y and z. 2.2 Castagnos cryptosystm In 2007, Castagnos [6] proposd a cryptosystm rlatd to LUC and RSA whr th modulus N = pq and th public xponnt satisfy th condition gcd (, ( p 2 ) ( q 2 )) or quivalntly d k ( p 2 ) ( q 2 ) = for som intgrs d and k. This quation can b xtndd to a mor gnral on, namly x ( p 2 ) ( q 2 ) y = z. 2.3 RSA with Gaussian prims In 2002, Elkamchouchi, Elshnawy and Shaban [8] proposd a gnralization of th RSA cryptosystm to th domain of Guassian intgrs. A Gaussian intgr 3

4 is a complx numbr z = a + bi whr a and b ar both intgrs. A Gaussian prim is a Gaussian intgr that is not th product of two non-unit Gaussian intgrs, th only units bing ± and ±i. Th Gaussian prims ar of on of th following forms P = ± ± i, P = a whr a is an intgr prim with a 3 (mod 4), P = ai whr a is an intgr prim with a 3 (mod 4), P = a + ib whr P = a 2 + b 2 (mod 4) is an intgr prim. In th RSA variant with Gaussian intgrs, th modulus is N = P Q, a product of two Gaussian intgr prims P and Q. Th Eulr totint function is φ(n) = ( P ) ( Q ) and th public xponnt is a positiv intgr satisfying gcd(, φ(n)) =. Whn P = p and Q = q ar intgr prims, thn φ(n) = ( p 2 ) ( q 2 ) and th public xponnt satisfis th ky quation d k ( p 2 ) ( q 2 ) = which can b xtndd to a mor gnral quation x ( p 2 ) ( q 2 ) y = z. 2.4 RSA typ schms basd on singular cubic curvs Lt N = pq b an RSA modulus. For an intgr b Z/nZ, considr th cubic curv E N (b) dfind ovr th ring Z/nZ givn by th Wirstrass quation E N (b) : y 2 = x 3 + bx 2 mod N. In 995, Kuwakado, Koyama, and Tsuruoka [4] proposd a nw cryptosystm basd th lliptic curv E N (b). Th ncryption ky is a positiv intgr satisfying gcd (, ( p 2 ) ( q 2 )) and th dcryption ky is th intgr d satisfying d (mod ( p 2 ) ( q 2 ) ), or quivalntly d k ( p 2 ) ( q 2 ) =. Th ncryption and th dcryption procdurs us oprations on th singular cubic curv E N (b). Using th continud fraction algorithm, it is possibl to attack th schm using th ky quation d k ( p 2 ) ( q 2 ) =. A mor gnral attack on th schm can b launchd by using th quation x ( p 2 ) ( q 2 ) y = z and by combining th continud fraction algorithm and Copprsmith s mthod. 3 Prliminaris In this sction, w prsnt th mathmatical prliminaris. 4

5 3. Continud fractions Lt x b a ral numbr. Dfin th sts (x 0, x,...) and [a 0, a,...] by x 0 = x and by th rcurrncs a i = x i, x i+ = x i a i, i = 0,,.... Th st [a 0, a, ] is th continud fraction xpansion of x and satisfis x = a 0 + a + a Th convrgnts of x ar th rational numbrs pn q n, n = 0,,... satisfying p n = a 0 + q n a + a a n Continud fractions hav numrous proprtis and applications in cryptography. Th following usful rsult charactrizs th approximations to a ral numbr x (s Thorm 84 of [9]). Thorm (Lgndr) If a, b b positiv intgrs and 0 < x a < b 2b 2 thn a b is a convrgnt of th continud fraction of x. Not that whn x = r s is a rational numbr, thn th list of th convrgnts of th continud fraction xpansion of r s can b don in polynomial tim in log(max(a, b)) Copprsmith s mthod In 997, Copprsmith [7] introducd an algorithm to find small solutions of univariat modular polynomial quations and anothr algorithm to find small roots of bivariat polynomial quations. Sinc thn, Copprsmith s mthod has bn applid in various applications in cryptography, mainly to attack th RSA cryptosystm. A typical xampl is th following rsult. 5

6 Thorm 2 Lt N = pq b th product of two unknown prims such that q < p < 2q. Givn an approximation p of p with an additiv rror trm at most N 4, on can find p and q in polynomial tim in log(n). As a consqunc of Copprsmith s Thorm, on can show that if N = pq with p q < N 4, thn N can b factord (s [8]). Thus, throughout this papr, w will considr that th prim diffrnc p q satisfis p q > N 4. 4 Usful Lmmas On of th main RSA standard rcommndations for saf paramtrs is to choos th prim factors factors p, q of th sam bit-siz. Mor prcisly, p and q should satisfy < p q < 2 or quivalntly q < p < 2q. Undr this assumption, on can find intrvals for p, q, p q, p + q and p 2 + q 2 in trms of N. W bgin by th following rsults (s [8]). Lmma Lt N = pq b an RSA modulus with q < p < 2q. Thn 2 2 N < q < N < p < 2 N and 0 < p q < N. 2 2 W will nd th following rsult. Lmma 2 Lt N = pq b an RSA modulus with q < p < 2q. Thn 2 N < p + q < 3 2 N and 2N < p 2 + q 2 < N. Proof. Assum that N = pq with q < p < 2q. Thn < p q < 2. Th function f(x) = x + x is incrasing on [, + ). Hnc, f() < f( p q ) < f(2), that is Multiplying by N = pq, w gt 2 < p q + q p < N < p 2 + q 2 < 5 2 N. Similarly, sinc < p q < 2, thn f() < f( p q ) < f( 2), or quivalntly p p 2 < q + q < Hnc, multiplying by N = pq, w gt 2 N < p + q < 3 2 N. 2 This trminats th proof. 6

7 5 Th Nw Attack In this sction, w prsnt our nw attack to solv th quation x ( p 2 ) ( q 2 ) y = z whn x, y and z ar suitably small. Th nw mthod combins two tchniqus, th continud fraction algorithm and Copprsmith s mthod. Thorm 3 Lt N = pq b an RSA modulus with q < p < 2q. Lt b a public xponnt satisfying an quation x ( p 2 ) ( q 2 ) y = z with coprim positiv intgrs x and y. If xy < 2N 4 2N 3 4 and z < (p q)n 4 y, thn on can find p and q in polynomial tim in log(n). Proof. Suppos that N = pq with q < p < 2q and that a public xponnt satisfis th quation x ( p 2 ) ( q 2 ) y = z, () with x > 0, y > 0 and gcd(x, y) =. Thn x (N ) N y = x (p 2 )(q 2 )y = z (p 2 + q 2 94 ) N y. (p 2 + q 2 94 N ) y (2) From this w dduc N N y x z x ( N N) + p 2 + q N y x ( N (3) 4N). Using Lmma 2, w gt that p 2 + q N < 4N. Suppos in addition that z < p q N 4 y. Thn, using Lmma, w gt Hnc (3) lads to z < p q N y < N N 4 y = 2 2 N 3 4 y. (4) N N y 2 x < 2 N 3 4 N N y x + 4 N N N y x = N + 2 2N 3 4 4N N y x. Now, suppos that xy < 2N 4 2N 3 4. A straightforward calculation shows that 2N 4 2N 3 4N N 4 < 2N N (5)

8 Thn xy < ( 4N N 2 N+2 2N 3 4 ) and N+2 2N 3 4 4N N < 2xy. Using this in (5), w gt N N y x < N + 2 2N 3 4 4N N y x < 2xy y x = 2x 2. Hnc, if this condition is fulfilld, thn on can find y x amongst th convrgnts of th continud fraction xpansion of as statd in Thorm. N N Morovr, sinc gcd(x, y) =, th valus of x and y ar th dnominator and numrator of th convrgnt. Plugging x and y in (), w gt Adding 2N to both sids of (6), w gt p 2 + q 2 = N 2 + x y + z y. (6) (p + q) 2 = (N + ) 2 x y + z y. (7) Similarly, subtracting 2N to both sids of (6), w gt (p q) 2 = (N ) 2 x y + z y. (8) Obsrv that (7) can b transformd into p + q (N + )2 x y p + q + (N + )2 x y = z y, from which w dduc p + q (N + )2 x y = z (N < p + q + + )2 x y y z (p + q)y. By (4) w hav z < 2 2 N 3 4 y and by Lmma 2 w hav p + q > 2 N. Thn p + q (N + )2 x 2 y < 2 N N = 4 N 4 < N 4. This mans that (N + )2 x y is an approximation of p + q with rror trm lss than N 4. In a similar way, using (8), w gt p q (N )2 x y p q + (N )2 x y = z y, 8

9 which lads to p q (N )2 x y = z (N < p q + + )2 x y y z (p q)y. Using th assumption z < (p q)n 4 y, w gt p q (N )2 x (p q)n 4 y y < = N 4. (p q)y Hnc, (N )2 x y is an approximation of p q with an rror trm lss than N 4. Combing th approximations of p + q and p q, w gt ( p 2 (N + )2 x y + (N )2 x y ) < 2 p + q (N + )2 x y + 2 p q (N )2 x y < 2 N N 4 = N 4. This givs an approximation of p with an rror trm of at most N 4. Hnc, using Copprsmith s Thorm 2, on can find p which lads to q = N p. Sinc vry stp in th proof can b don in polynomial tim in log(n), thn th factorization of N can b obtaind in polynomial tim in log(n). W not that, whn gcd ( x, ( p 2 ) ( q 2 )) =, th diophantin quation x ( p 2 ) ( q 2 ) y = z is quivalnt to th modular quation x z (mod ( p 2 ) ( q 2 ) ). Morovr, th xponnt satisfis z x (mod ( p 2 ) ( q 2 ) ). Hnc, Thorm 3 implis that on can factor N = pq for such xponnts in th cas whr xy < 2N 4 2N 3 4 and z < (p q)n 4 y. W now considr an application of Thorm 3 to th privat xponnt d. W rcall that d satisfis d (mod ( p 2 ) ( q 2 ) ). Instad of this modular quation, w considr th ky quation d k ( p 2 ) ( q 2 ) =. 9

10 Corollary Lt N = pq b an RSA modulus with q < p < 2q. Lt < ( p 2 ) ( q 2 ) b a public xponnt. If th privat xponnt d satisfis d < 2N 4 2N 3 4, thn on can find p and q in polynomial tim in log(n). Proof. Suppos that q < p < 2q and < ( p 2 ) ( q 2 ). Sinc th privat xponnt d satisfis d k ( p 2 ) ( q 2 ) = for a positiv intgr k, thn k = d (p 2 ) (q 2 ) < d (p 2 ) (q 2 ) < d. Thn dk < d 2. Now, assum that d 2 < 2N 4 2N 3 4. Thn, dk < 2N 4 2N 3 4 and d, k fulfill th conditions of Thorm 3 wich lads to th factorization of N in polynomial tim in log(n). 6 A Numrical Exampl In this sction w giv a dtaild numrical xampl to xplain our mthod as dvlopd in Thorm 3. Lt us considr th small public ky N = , = It is obvious that quation x ( p 2 ) ( q 2 ) y = z has infinitly many solutions (x, y, z) with positiv intgrs x, y and non zro intgr z. Our aim is to find th solution that satisfis th conditions of Thorm 3, if any. Dfin W want to find y x among th convrgnts of th continud fraction xpansion of. Following th tchniqu of Thorm 3, for ach convrgnt y N N x of with xy < 2N 4 2N 3 N N , w comput an approximation p of p using ( p = 2 (N + )2 x y + (N )2 x ) y, and apply Copprsmith s Thorm 2 with p. Using th convrgnt y x = , w gt p Copprsmith s Thorm outputs th prim factor p = from which w dduc th scond prim factor q = N p = This complts th factorization of N. 0

11 7 Conclusion In this papr, w considrd som variants of th RSA cryptosystm that us a modulus N = pq and a public xponnt d satisfying gcd (, ( p 2 ) ( q 2 )). W studid th gnral quation x ( p 2 ) ( q 2 ) y = z and combind th continud fraction algorithm with Copprsmith s tchniqu to find x and y and thn to factor th RSA modulus N. Our nw mthod can considrd as an xtnsion to som RSA typ schms of two formr mthods that work for RSA, namly Winr s attack and Blömr-May attack. Rfrncs [] Blömr, J., May, A.: A gnralizd Winr attack on RSA. In Public Ky Cryptography - PKC 2004, volum 2947 of Lctur Nots in Computr Scinc, 3. Springr-Vrlag (2004) [2] Bonh, D.: Twnty yars of attacks on th RSA cryptosystm, Notics Amr. Math. Soc. 46 (2), pp , (999) [3] Bonh, D., Shacham, H.: Fast Variants of RSA, CryptoByts, Vol. 5, No., pp. 9, (2002) [4] Bonh, D., Durf, G.: Cryptanalysis of RSA with privat ky d lss than N 0.292, Advancs in Cryptology-Eurocrypt 99, Lctur Nots in Computr Scinc Vol. 592, Springr-Vrlag, pp. (999) [5] Bundr, M., Nitaj, A., Susilo, W., Tonin, J.: A nw attack on thr variants of th RSA cryptosystm, Information Scurity and Privacy, 2st Australasian Confrnc, ACISP 206, Mlbourn, VIC, Australia, July 4-6, 206, Procdings, Volum 9723 of th sris Lctur Nots in Computr Scinc pp (206) [6] Castagnos, G.: An fficint probabilistic public-ky cryptosystm ovr quadratic fild quotints, 2007, Finit Filds and Thir Applications, 07/2007, 3(3-3), p ~gcastagn/publi/crypto_quad.pdf [7] Copprsmith, D.: Small solutions to polynomial quations, and low xponnt RSA vulnrabilitis. Journal of Cryptology, 0(4), pp (997) [8] Elkamchouchi, H., Elshnawy, K., Shaban, H.: Extndd RSA cryptosystm and digital signatur schms in th domain of Gaussian intgrs, in Procdings of th 8th Intrnational Confrnc on Communication Systms, (2002) pp [9] Hardy, G.H., Wright, E.M.: An Introduction to th Thory of Numbrs, Oxford Univrsity Prss, London, 965.

12 [0] Hastad, J., Solving simultanous modular quations of low dgr, SIAM J. of Computing, Vol. 7, p , 988. [] Hink, M.J.: Cryptanalysis of RSA and its variants. Chapman & Hall/CRC Cryptography and Ntwork Scurity. CRC Prss, Boca Raton, FL, (200) [2] Konrad, K.: Th Gaussian intgrs, prprint, availabl at math.uconn.du/~kconrad/blurbs/ugradnumthy/zinots.pdf. [3] K. Koyama, U.M. Maurr, T. Okamoto, S.A. Vanston, Nw public-ky schms basd on lliptic curvs ovr th ring Zn, Advancs in Cryptology Proc. Crypto 9, Lctur Nots in Computr Scinc, vol. 576, Springr, Brlin, 992, pp [4] Kuwakado, H., Koyama, K., Tsuruoka, Y.: A nw RSA-typ schm basd on singular cubic curvs y 2 = x 3 + bx 2 (mod n), IEICE Transactions on Fundamntals, vol. E78-A (995) pp [5] Lnstra, A.K., Lnstra, H.W., Lovász, L.: Factoring polynomials with rational cofficints, Mathmatisch Annaln, Vol. 26, pp , (982) [6] Ibrahimpašić, B.: A cryptanalytic attack on th LUC cryptosystm using continud fractions, Math. Commun., Vol. 4, No., pp (2009) [7] May, A.: Nw RSA Vulnrabilitis Using Lattic Rduction Mthods. PhD thsis, Univrsity of Padrborn (2003) availabl at d/impria/md/contnt/may/papr/bp.ps [8] Nitaj, A.: Anothr gnralization of Winr s attack on RSA, in Vaudnay, S. (d.) Africacrypt Lctur Nots in Computr Scinc, Springr- Vrlag Vol. 5023, pp (2008) [9] Paulus, S., Takagi, T.: A nw public ky cryptosystm ovr quadratic ordrs with quadratic dcryption tim. J. Cryptology 3, (2000) [20] Rivst, R., Shamir, A., Adlman, L.: A Mthod for Obtaining digital signaturs and public-ky cryptosystms, Communications of th ACM, Vol. 2 (2), pp (978) [2] Smith, P.J., Lnnon, G.J.J.: LUC: a nw public ky cryptosystm, Ninth IFIP Symposium on Computr Scinc Scurity, Elsvivr Scinc Publishrs, 993, [22] Takagi, T.: Fast RSA-typ cryptosystm modulo p k q. In Advancs in Cryptology Crypto 98, pp Springr, (998) [23] d Wgr, B.: Cryptanalysis of RSA with small prim diffrnc, Applicabl Algbra in Enginring, Communication and Computing,Vol. 3(), pp (2002) [24] Winr, M.: Cryptanalysis of short RSA scrt xponnts, IEEE Transactions on Information Thory, Vol. 36, pp (990) 2