Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 2: Mathematical Preliminaries 22
CRT-RSA with d p −d q = 2
To reduce the storage space for the CRT-RSA parameters, Qiao and Lam [102]
proposed using CRT-RSA with d p − d q = 2. In this case, one needs to store
only one of the decryption exponents and the other one can be generated trivially
at runtime. This variant of RSA is very useful in case of hand-held devices like
smart-cards, which have comparatively low storage capacities. However, Jochemsz
and May [65] showed that some lattice-based attacks on CRT-RSA can be made
stronger if d p −d q = 2, and this is a major drawback of this variant of RSA.
Multi Prime RSA
Some time it is useful to choose an RSA modulus N = p 1 p 2···p r with distinct
primes p i , or to choose N = p r q with p ≠ q. The first one is known as multi prime
RSA, and the second variant was proposed by Takagi [127]. The reader may refer
to [53] for various interesting results related to multi prime RSA.
Common Prime RSA
A special instance of RSA where gcd(p − 1,q − 1) is large, is known as common
prime RSA. Attacks on RSA which exploit small decryption exponent d work less
efficiently [52] in this variant of RSA. The reader may refer to [54] to know the
current results related to common prime RSA.
2.3 Cryptanalysis of RSA
From the previous discussion, we may recall that c = m e mod N is the main
relation between the plaintext and the ciphertext in RSA. From the point of view
of an attacker, the RSA Problem can be framed as follows.
Problem 2.9 (RSA Problem). Consider an RSA setup with public key (e,N),
private key (d,N) and c = m e mod N. Given just 〈c,e,N〉, find message m.
As c 1/e is m in Z N , if one can find the e-th root of the ciphertext c in Z N ,
then he/she can obtain the plaintext m. So RSA problem can also be stated as a
problem to find the e-th root of a given integer modulo N. However it is believed