Coppersmith's lattices and "focus groups": an attack on small-exponent RSA

用于整数分解的 SAT 与格归约

SAT and Lattice Reduction for Integer Factorization

本文提出结合 SAT 求解器与 Coppersmith 格基归约的混合方法，由 SAT 调用代数方法判断部分比特赋值可否补全，从而显著加速随机泄露比特的整数分解。

Continued fractions and RSA with small secret exponent

Extending the classical Legendre's result, we describe all solutions of the inequality |x - a/b| < c/b^2 in terms of convergents of continued fraction expansion of x. Namely, we show that a/b = (rp_{m+1} +- sp_m) / (rq_{m+1} +- sq_m) for some nonnegative integers m,r,s such that rs < 2c. As an application of this result, we describe a modification of Verheul and van Tilborg variant of Wiener's attack on RSA cryptosystem with small secret exponent.

Double Counting in $2^t$-ary RSA Precomputation Reveals the Secret Exponent

A new fault attack, double counting attack (DCA), on the precomputation of $2^t$-ary modular exponentiation for a classical RSA digital signature (i.e., RSA without the Chinese remainder theorem) is proposed. The $2^t$-ary method is the most popular and widely used algorithm to speed up the RSA signature process. Developers can realize the fastest signature process by choosing optimum $t$. For example, $t=6$ is optimum for a 1536-bit classical RSA implementation. The $2^t$-ary method requires precomputation to generate small exponentials of message. Conventional fault attack research has paid …

The ray attack, an inefficient trial to break RSA cryptosystems

The basic properties of RSA cryptosystems and some classical attacks on them are described. Derived from geometric properties of the Euler functions, the Euler function rays, a new ansatz to attack RSA cryptosystems is presented. A resulting, albeit inefficient, algorithm is given. It essentially consists of a loop with starting value determined by the Euler function ray and with step width given by a function $ω_e(n)$ being a multiple of the order $\mathrm{ord}_n(e)$, where $e$ denotes the public key exponent and $n$ the RSA modulus. For $n=pq$ and an estimate $r<\sqrt{pq}$ for the smaller pr…

A variant of Wiener's attack on RSA

Wiener's attack is a well-known polynomial-time attack on a RSA cryptosystem with small secret decryption exponent d, which works if d<n^{0.25}, where n=pq is the modulus of the cryptosystem. Namely, in that case, d is the denominator of some convergent p_m/q_m of the continued fraction expansion of e/n, and therefore d can be computed efficiently from the public key (n,e). There are several extensions of Wiener's attack that allow the RSA cryptosystem to be broken when d is a few bits longer than n^{0.25}. They all have the run-time complexity (at least) O(D^2), where d=Dn^{0.25}. Here we pro…

Fault Attacks on RSA Public Keys: Left-To-Right Implementations are also Vulnerable

After attacking the RSA by injecting fault and corresponding countermeasures, works appear now about the need for protecting RSA public elements against fault attacks. We provide here an extension of a recent attack based on the public modulus corruption. The difficulty to decompose the "Left-To-Right" exponentiation into partial multiplications is overcome by modifying the public modulus to a number with known factorization. This fault model is justified here by a complete study of faulty prime numbers with a fixed size. The good success rate of this attack combined with its practicability ra…