Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 2: Mathematical Preliminaries 16
space complexity, one may need to refer back to the basic definitions of asymptotic
notations at the beginning of this chapter.
1
2
3
4
5
6
Generate randomly two large primes p,q;
Compute N = pq,φ(N) = (p−1)(q −1);
Generate e randomly such that gcd(e,φ(N)) = 1;
Compute d such that ed ≡ 1 (mod φ(N));
Encryption: m ↦→ m e mod N;
Decryption: c ↦→ c d mod N;
Algorithm 1: Implementing RSA [126].
Primality Testing
In Step 1 of Algorithm 1, one needs to generate large random primes p,q. This is
done by generating large random numbers and thereafter testing those for primality.
This approach works well due to the Prime Number Theorem (PNT) [126].
Theorem 2.5 (PNT). There are approximately N
lnN
primes smaller than N.
In simpler words, the Prime Number Theorem states that on an average, one will
find a prime if he/she chooses lnp many random integers of bitsize l p .
The next step is primality test. There are many efficient primality testing algorithms
in practice. One may use the Solovay-Strassen Algorithm [123] or the
Miller-Rabin Algorithm [90,105] for this purpose. The time complexity of both
Solovay-Strassen and Miller-Rabin algorithms is O(lp) 3 to test an l p bit integer. For
practical RSA instances, l p will be 512 or 1024-bit integers, and hence both the
algorithms work well to test whether a number is prime or not. However, both
are probabilistic algorithms, and in practice Miller-Rabin algorithm fares better
than the Solovay-Strassen algorithm. This is because the probability of failure
of Miller-Rabin test (at most 4 −k for k different candidates) is much less compared
to the one for Solovay-Strassen (at most 2 −k for k different candidates). If
the Generalized Riemann Hypothesis is true then Miller-Rabin Algorithm can be
run deterministically with time complexity O(lp). 5 There are many more probabilistic
polynomial time primality test algorithms based on elliptic curves, namely
Goldwasser-Kilian [44], Atkin-Morain [6] etc.
Finding a deterministic polynomial time primality test was a open question
for a long period. In 2002, Agrawal, Kayal and Saxena [3] proposed a determin-