Partial Key Exposure Attack on CRT-RSA

Authors:
Santanu Sarkar;Subhamoy Maitra
Affiliations:
Indian Statistical Institute, Kolkata, India 700 108;Indian Statistical Institute, Kolkata, India 700 108
Venue:
ACNS '09 Proceedings of the 7th International Conference on Applied Cryptography and Network Security
Year:
2009

Citing 10
Cited 0

A course in computational algebraic number theory

A course in computational algebraic number theory
A method for obtaining digital signatures and public-key cryptosystems

Communications of the ACM
Cryptanalysis of Unbalanced RSA with Small CRT-Exponent

CRYPTO '02 Proceedings of the 22nd Annual International Cryptology Conference on Advances in Cryptology
Finding Small Roots of Univariate Modular Equations Revisited

Proceedings of the 6th IMA International Conference on Cryptography and Coding
A polynomial time attack on RSA with private CRT-exponents smaller than N0.073

CRYPTO'07 Proceedings of the 27th annual international cryptology conference on Advances in cryptology
A strategy for finding roots of multivariate polynomials with new applications in attacking RSA variants

ASIACRYPT'06 Proceedings of the 12th international conference on Theory and Application of Cryptology and Information Security
Tunable balancing of RSA

ACISP'05 Proceedings of the 10th Australasian conference on Information Security and Privacy
Partial key exposure attacks on RSA up to full size exponents

EUROCRYPT'05 Proceedings of the 24th annual international conference on Theory and Applications of Cryptographic Techniques
New attacks on RSA with small secret CRT-Exponents

PKC'06 Proceedings of the 9th international conference on Theory and Practice of Public-Key Cryptography
Cryptanalysis of RSA with private key d less than N0.292

IEEE Transactions on Information Theory

Quantified Score

Hi-index	0.00

Visualization

Abstract

Consider CRT-RSA with N = pq , q p q , public encryption exponent e and private decryption exponents d p , d q . Jochemsz and May (Crypto 2007) presented that CRT-RSA is weak when d p , d q are smaller than N 0.073. As a follow-up work of that paper, we study the partial key exposure attack on CRT-RSA when some Most Significant Bits (MSBs) of d p , d q are exposed. Further, better results are obtained when a few MSBs of p (or q ) are available too. We present theoretical results as well as experimental evidences to justify our claim. We also analyze the case when the decryption exponents are of different bit sizes and it is shown that CRT-RSA is more insecure in this case (than the case of d p , d q having the same bit size) considering the total bit size of d p , d q .