Continued fractions and RSA with small secret exponent

A Comparison of Secret Sharing Schemes Based on Latin Squares and RSA

In recent years there has been a great deal of work done on secret sharing scehemes. Secret Sharing Schemes allow for the division of keys so that an authorised set of users may access information. In this paper we wish to present a critical comparison of two of these schemes based on Latin Squares, [Cooper et., al.] and RSA [Shoup]. These two protocols will be examined in terms of their positive and negative aspects of their secuirty.

Double Counting in $2^t$-ary RSA Precomputation Reveals the Secret Exponent

A new fault attack, double counting attack (DCA), on the precomputation of $2^t$-ary modular exponentiation for a classical RSA digital signature (i.e., RSA without the Chinese remainder theorem) is proposed. The $2^t$-ary method is the most popular and widely used algorithm to speed up the RSA signature process. Developers can realize the fastest signature process by choosing optimum $t$. For example, $t=6$ is optimum for a 1536-bit classical RSA implementation. The $2^t$-ary method requires precomputation to generate small exponentials of message. Conventional fault attack research has paid …

基于连分数-双曲线的RSA密码系统攻击

A Continued Fraction-Hyperbola based Attack on RSA cryptosystem

本文基于双曲线的新算术与代数结果，提出一种独立于私钥d和公钥指数e大小的连分数攻击RSA型模数方法，复杂度为O(b log αj4 log(αi3+αj3))，旨在通过连分数收敛找到满足特定内积条件的点，并给出实验示例。

A variant of Wiener's attack on RSA

Wiener's attack is a well-known polynomial-time attack on a RSA cryptosystem with small secret decryption exponent d, which works if d<n^{0.25}, where n=pq is the modulus of the cryptosystem. Namely, in that case, d is the denominator of some convergent p_m/q_m of the continued fraction expansion of e/n, and therefore d can be computed efficiently from the public key (n,e). There are several extensions of Wiener's attack that allow the RSA cryptosystem to be broken when d is a few bits longer than n^{0.25}. They all have the run-time complexity (at least) O(D^2), where d=Dn^{0.25}. Here we pro…

Coppersmith's lattices and "focus groups": an attack on small-exponent RSA

We present a principled technique for reducing the lattice and matrix size in some applications of Coppersmith's lattice method for finding roots of modular polynomial equations. Motivated by ideas from machine learning, it relies on extrapolating patterns from the actual behavior of Coppersmith's attack for smaller parameter sizes, which can be thought of as "focus group" testing. When applied to the small-exponent RSA problem, our technique reduces lattice dimensions and consequently running times, and hence can be applied to a wider range of exponents. Moreover, in many difficult examples o…