Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 2: Mathematical Preliminaries 24
and Stănică [80], and Chen and Zhu [20] for results related to the prime power
factorization of n! for any positive integer n. There have been many attempts to
factor integers of other special forms as well; namely the factorization of Fermat
numbers [78], the factorization of Mersenne numbers [132] etc.
2.3.2 Partial Exposure of Primes
Coppersmith[22,24]provedthatfactorizationoftheRSAmoduluscanbeachieved
in polynomial time given half of the Most Significant Bits (MSBs), that is the
contiguous top half, of one of the factors. Later Boneh et al [16] proved a similar
result when half of the Least Significant Bits (LSBs), that is the contiguous lower
half, of one of the factors is known.
2.3.3 Small Public Exponent Attack
Bob may choose the public exponent e very small (3, say) to allow Alice the
privilege of faster encryption. Suppose an attacker knows a contiguous chunk of
Most Significant Bits (MSBs) of m, and constructs an approximation m 1 , such
that m 1 and m share the known chunk of bits at the top. If |m−m 1 | < N 1 e, then
Coppersmith [23] proved that the attacker can find m in polynomial time. For an
example, if e = 3, the attacker needs to know the top 2 -rd portion of the plaintext
3
m to recover the whole of m in polynomial time.
2.3.4 Related Message Attack
In 1995, Franklin and Reiter [42] proved that when two plaintexts are sent using
the same RSA modulus N with small public exponent e, then RSA may be weak
in cases where the two plaintexts are polynomially related. This result was later
improved by Coppersmith, Franklin, Patarin and Reiter [26].
Suppose that Alice sends the messages m 1 and m 2 = αm 1 + β to Bob where
the integers α and β are known. Also suppose that Bob uses e = 3. So, we have
c 1 = m 3 1 mod N and c 2 = m 3 2 mod N.