Cryptology - Unofficial St. Mary's College of California Web Site

246 CHAPTER 12. RSA
First, what about our old standby – frequency analysis If N consists of
around 600 decimal digits, then our ciphertext segments will also be about 600
digits long. How many possible 600 digit segments are there Lots: 10 600 .
Recall that a traditional estimate for the number of elementary particles in the
universe is 10 80 . So even if we wanted to perform frequency analysis, there
wouldn’t be enough room in the universe to write down our frequency count!
So we must try another method to break a message. As usual, once we have
tried the brute force method of frequency analysis, we then turn to the specifics
of the system itself. Again, how to decrypt an RSA-enciphered message
Well, we can look up our enemy’s e and N, since these are public information.
We want M, the true message, we know the value of N and we know that
E d %N = M. The only thing we don’t know is d. So we only need to discover
d.
Well, we know that e and d are chosen so that e·d ≡ 1 (mod (P −1)(Q−1)),
and we know e. The only thing we don’t have is (P − 1)(Q − 1). So we only
need to discover (P − 1)(Q − 1).
Well, we know N, and we know that P · Q = N. Also,
(P − 1)(Q − 1) = P · Q − P − Q + 1 = N − P − Q + 1.
We know the N and 1 parts of this, but don’t know the P or Q. So we only
need to discover P or Q.
Well, N/P = Q and N/Q = P , so if we know either P or Q then we know
the other and so know them both. But N has only two factors, P and Q. So
we only need to factor N.
Thus the entire security of the RSA system apparently comes down to the
ease or difficulty of factoring N. If we can factor N we can easily decrypt any
message enciphered modulo N. And the chain of “well”s above is meant to
convince you that factor N is the only way to break RSA. 15 How hard can this
be After all, we all spent several weeks in 5th or 7th grade talking about primes
and factors and breaking down numbers into their prime factors. So why can’t
smart people using fast machines just factor N In fact, why not just set up
a really fast computer and do the obvious thing: see if 2 divides N, then see
if 3 divides N, then see if 5 divides N, and so on, working your way along the
primes until you find either P or Q
Remember that N is about 600 digits long. An important theorem, called,
logically enough, the Prime Number Theorem, says that less that N there are
about N/ ln(N) primes. That means that to find up to P or Q, which means
checking up to about 10 300 , we must check about 10 300 / ln(10 300 ) ≈ 10 298
primes. But, again, there are only 10 80 particles in the whole universe! Imagine
that I said I hid one specially marked atom somewhere in the universe and you
15 Of course there are other ways to break any particular RSA system. Perhaps our enemy
will make some grievous mistake in enciphering, like leaving part of the message unenciphered.
Or will allow us to time his/her computer while it is deciphering as many messages as we wish.
But, for most practical purposes, the security of RSA comes down to the factoring problem.