How to Generalize RSA Cryptanalyses Atsushi Takayasu and Noboru - PowerPoint PPT Presentation

PKC2016@Taipei How to Generalize RSA Cryptanalyses Atsushi Takayasu and Noboru Kunihiro The University of Tokyo, Japan AIST, Japan 1/19

Background 2 /19

RSA Public key: 𝑂, 𝑓 Secret key: (𝑞, 𝑟, 𝑒) Key generation: 𝑂 = 𝑞𝑟 and 𝑓𝑒 = 1 mod (𝑞 − 1)(𝑟 − 1)  One of the most famous cryptosystems  A number of paper study the security. 3 /19

Known Attacks on RSA • Small secret exponent attack: [BD00] Small secret exponent 𝑒 < 𝑂 0.292 disclose the factorization of 𝑂 . • Partial key exposure attacks: [EJMW05], [TK14] The most/least significant bits of 𝑒 disclose the factorization of 𝑂 .  These attacks are based on Coppersmith’s method. 4 /19

Variants of RSA RSA Takagi RSA Prime Power RSA 𝑂, 𝑓 𝑂, 𝑓 𝑂, 𝑓 PK (𝑞, 𝑟, 𝑒) (𝑞, 𝑟, 𝑒) (𝑞, 𝑟, 𝑒) SK 𝑂 = 𝑞 𝑠 𝑟 𝑂 = 𝑞 𝑠 𝑟 𝑂 = 𝑞𝑟 KG 𝑓𝑒 = 1 𝑓𝑒 = 1 𝑓𝑒 = 1 mod mod mod 𝑞 𝑠−1 (𝑞 − 1)(𝑟 − 1) (𝑞 − 1)(𝑟 − 1) (𝑞 − 1)(𝑟 − 1)  The variants enable faster decryption using CRT.  When 𝑠 = 1 , both variants are the same as RSA. 5 /19

Known Attacks on the Variants RSA Takagi’s RSA Prime Power RSA Small [BD00] [IKK08] [May04], [LZPL15], Secret [Sar15] Exponent Partial [EJMW05], [HHX+14] [May04], [LZPL15], Key [TK14] [Sar15], [EKU15] Exposure  When 𝑠 = 1 , only [IKK08] achieves the same bound as the best attacks on RSA. 6 /19

Open Questions • Are there better attacks on the variants that generalize the best attacks on RSA? • [IKK08]’s algorithm construction is very technical and hard to follow. 7 /19

Open Questions • Are there better attacks on the variants that generalize the best attacks on RSA? • [IKK08]’s algorithm construction is very technical and hard to follow. Are there easy-to-understand generic transformations that convert the attacks on RSA to Takagi’s RSA and the prime power RSA? 7 /19

Our Results We propose transformations for both the Takagi’s RSA and the prime power RSA which are very simple and give improved results. – Simpler analyses of [IKK08], [Sar15] – Better bounds than [HHX+14], [Sar15], [EKU15] – Some evidence of optimality 8 /19

PKE attacks on Takagi’s RSA (𝑠 = 2) Exposed proportion of 𝑒 [HHX+14] Our Improvements log 𝑂 𝑒 9 /19

PKE attacks on Takagi’s RSA (𝑠 = 2) Exposed proportion of 𝑒 [HHX+14] Our Improvements log 𝑂 𝑒 9 /19

PKE attacks on the prime power RSA (𝑠 = 2) Exposed proportion of 𝑒 [LZPL15] [Sar15] Our Improvements log 𝑂 𝑒 9 /19

Coppersmith’s Method 10 /19

Overview [How97] To find small roots of a bivariate modular equation ℎ 𝑦, 𝑧 = 0 mod 𝑓 where 𝑦 < 𝑌 and 𝑧 < Y, 11 /19

Overview [How97] To find small roots of a bivariate modular equation ℎ 𝑦, 𝑧 = 0 mod 𝑓 where 𝑦 < 𝑌 and 𝑧 < Y, • Generate ℎ 1 𝑦, 𝑧 , … , ℎ 𝑜 (𝑦, 𝑧) that have the roots ) modulo 𝑓 𝑛 . (𝑦 , 𝑧 11 /19

Overview [How97] To find small roots of a bivariate modular equation ℎ 𝑦, 𝑧 = 0 mod 𝑓 where 𝑦 < 𝑌 and 𝑧 < Y, • Generate ℎ 1 𝑦, 𝑧 , … , ℎ 𝑜 (𝑦, 𝑧) that have the roots ) modulo 𝑓 𝑛 . (𝑦 , 𝑧 • If integer linear combinations of ℎ 1 𝑦, 𝑧 , … , ℎ 𝑜 (𝑦, 𝑧) ′ 𝑦, 𝑧 and ℎ 2 ′ (𝑦, 𝑧) satisfying become ℎ 1 < 𝑓 𝑛 , ℎ 𝑗 ′(𝑦𝑌, 𝑧𝑍) the original roots can be recovered. 11 /19

LLL Reduction to Find the Polynomials ′ 𝑦, 𝑧 and ℎ 2 ′ (𝑦, 𝑧) that are the integer • Polynomials ℎ 1 linear combinations of ℎ 1 𝑦, 𝑧 , … , ℎ 𝑜 (𝑦, 𝑧) and the norms of ℎ 𝑗 ′(𝑦𝑌, 𝑧𝑍) are small. 12 /19

LLL Reduction to Find the Polynomials ′ 𝑦, 𝑧 and ℎ 2 ′ (𝑦, 𝑧) that are the integer • Polynomials ℎ 1 linear combinations of ℎ 1 𝑦, 𝑧 , … , ℎ 𝑜 (𝑦, 𝑧) and the norms of ℎ 𝑗 ′(𝑦𝑌, 𝑧𝑍) are small. • LLL algorithm can efficiently find short lattice vectors 𝑐 1 ′ and 𝑐 2 ′ that are the integer linear combinations of 𝑐 1 , …, 𝑐 𝑜 and the Euclidean norms are small. 12 /19

LLL Reduction to Find the Polynomials ′ 𝑦, 𝑧 and ℎ 2 ′ (𝑦, 𝑧) that are the integer • Polynomials ℎ 1 linear combinations of ℎ 1 𝑦, 𝑧 , … , ℎ 𝑜 (𝑦, 𝑧) and the norms of ℎ 𝑗 ′(𝑦𝑌, 𝑧𝑍) are small. • LLL algorithm can efficiently find short lattice vectors 𝑐 1 ′ and 𝑐 2 ′ that are the integer linear combinations of 𝑐 1 , …, 𝑐 𝑜 and the Euclidean norms are small.  Build a lattice whose basis consists of coefficients of ℎ 1 𝑦𝑌, 𝑧𝑍 , … , ℎ 𝑜 (𝑦𝑌, 𝑧𝑍) and apply the LLL. 12 /19

SSE Attack on RSA [BD00] 𝑂 = 𝑞𝑟 and 𝑓𝑒 = 1 mod (𝑞 − 1)(𝑟 − 1) 𝑔 𝑦, 𝑧 = 1 + 𝑦 𝑂 + 1 + 𝑧 mod 𝑓 whose root (ℓ, − 𝑞 + 𝑟 ) discloses the factorization of 𝑂 . • A bivariate equation with three monomials ( 1, 𝑦, 𝑦𝑧 ) 13 /19

SSE Attack on RSA [BD00] 𝑂 = 𝑞𝑟 and 𝑓𝑒 = 1 mod (𝑞 − 1)(𝑟 − 1) 𝑔 𝑦, 𝑧 = 1 + 𝑦 𝑂 + 1 + 𝑧 mod 𝑓 whose root (ℓ, − 𝑞 + 𝑟 ) discloses the factorization of 𝑂 . Polynomials 𝑦 𝑗 𝑧 𝑘 𝑔 𝑣 𝑦, 𝑧 𝑓 𝑛−𝑣 g enerate a triangular matrix with diagonals 𝑌 𝑗+𝑣 𝑍 𝑘+𝑣 𝑓 𝑛−𝑣 .  The resulting lattice constructions are well-analyzed. 13 /19

SSE Attack on RSA [BD00] 𝑂 = 𝑞𝑟 and 𝑓𝑒 = 1 mod (𝑞 − 1)(𝑟 − 1) 𝑔 𝑦, 𝑧 = 1 + 𝑦 𝑂 + 1 + 𝑧 mod 𝑓 whose root (ℓ, − 𝑞 + 𝑟 ) discloses the factorization of 𝑂 . Polynomials 𝑦 𝑗 𝑧 𝑘 𝑔 𝑣 𝑦, 𝑧 𝑓 𝑛−𝑣 g enerate a triangular matrix with diagonals 𝑌 𝑗+𝑣 𝑍 𝑘+𝑣 𝑓 𝑛−𝑣 .  The resulting lattice constructions are well-analyzed. 13 /19

How to Generalize the Attacks 14 /19

SSE Attack on Takagi’s RSA 𝑂 = 𝑞 𝑠 𝑟 and 𝑓𝑒 = 1 mod (𝑞 − 1)(𝑟 − 1) 𝑔 𝑦, 𝑧 1 , 𝑧 2 = 1 + 𝑦 𝑧 1 − 1 (𝑧 2 − 1) mod 𝑓 whose root (ℓ, 𝑞, 𝑟) discloses the factorization of 𝑂 . • A trivariate equation with five monomials ( 1, 𝑦, 𝑦𝑧 1 , 𝑦𝑧 2 , 𝑦𝑧 1 𝑧 2 ) 𝑠 𝑧 2 = 𝑂 • Nontrivial algebraic relation 𝑧 1 15 /19

SSE Attack on Takagi’s RSA 𝑂 = 𝑞 𝑠 𝑟 and 𝑓𝑒 = 1 mod (𝑞 − 1)(𝑟 − 1) 𝑔 𝑦, 𝑧 1 , 𝑧 2 = 1 + 𝑦 𝑧 1 − 1 (𝑧 2 − 1) mod 𝑓 whose root (ℓ, 𝑞, 𝑟) discloses the factorization of 𝑂 . Polynomials 𝑘 𝑔 𝑣 𝑦, 𝑧 1 , 𝑧 2 𝑓 𝑛−𝑣 𝑠−1 𝑧 2 ⋅ 𝑦 𝑗 𝑧 1, 𝑧 2 , 𝑧 1 𝑧 2 , … , 𝑧 1 1 g enerate a triangular matrix with (sizes of ) diagonals 𝑍 0 , 𝑍 1 , … , 𝑍 𝑠 ⋅ 𝑌 𝑗+𝑣 𝑍 𝑘+𝑣 𝑓 𝑛−𝑣 . 15 /19

SSE Attack on Takagi’s RSA 𝑂 = 𝑞 𝑠 𝑟 and 𝑓𝑒 = 1 mod (𝑞 − 1)(𝑟 − 1) 𝑔 𝑦, 𝑧 1 , 𝑧 2 = 1 + 𝑦 𝑧 1 − 1 (𝑧 2 − 1) mod 𝑓 whose root (ℓ, 𝑞, 𝑟) discloses the factorization of 𝑂 . Polynomials 𝑘 𝑔 𝑣 𝑦, 𝑧 1 , 𝑧 2 𝑓 𝑛−𝑣 𝑠−1 𝑧 2 ⋅ 𝑦 𝑗 𝑧 1, 𝑧 2 , 𝑧 1 𝑧 2 , … , 𝑧 1 1 g enerate a triangular matrix with (sizes of ) diagonals 𝑍 0 , 𝑍 1 , … , 𝑍 𝑠 ⋅ 𝑌 𝑗+𝑣 𝑍 𝑘+𝑣 𝑓 𝑛−𝑣 . 15 /19

SSE Attack on the prime power RSA 𝑂 = 𝑞 𝑠 𝑟 and 𝑓𝑒 = 1 mod (𝑞 − 1)(𝑟 − 1) 𝑠−1 𝑧 1 − 1 (𝑧 2 − 1) mod 𝑓 𝑔 𝑦, 𝑧 1 , 𝑧 2 = 1 + 𝑦𝑧 1 whose roots (ℓ, 𝑞, 𝑟) offer the factorization of 𝑂 . • A trivariate equation with five monomials 𝑠−1 , 𝑦𝑧 1 𝑠 , 𝑦𝑧 1 𝑠−1 𝑧 2 ) ( 1, 𝑦, 𝑦𝑧 1 𝑠 𝑧 2 = 𝑂 • Nontrivial algebraic relation 𝑧 1 16 /19

SSE Attack on the prime power RSA 𝑂 = 𝑞 𝑠 𝑟 and 𝑓𝑒 = 1 mod (𝑞 − 1)(𝑟 − 1) 𝑠−1 𝑧 1 − 1 (𝑧 2 − 1) mod 𝑓 𝑔 𝑦, 𝑧 1 , 𝑧 2 = 1 + 𝑦𝑧 1 whose roots (ℓ, 𝑞, 𝑟) offer the factorization of 𝑂 . Polynomials 𝑏 , 𝑧 1 𝑧 2 𝑏 , … , 𝑧 1 𝑠−1 𝑧 2 𝑏 , 𝑧 1 𝑠−1 𝑧 2 𝑏+1 𝑧 2 𝑘 𝑔 𝑣 𝑦, 𝑧 1 , 𝑧 2 𝑓 𝑛−𝑣 ⋅ 𝑦 𝑗 𝑧 1 g enerate a triangular matrix with (sizes of ) diagonals 𝑍 𝑏 , 𝑍 𝑏+1 , … , 𝑍 𝑏+𝑠 ⋅ 𝑌 𝑗+𝑣 𝑍 𝑘+𝑣 𝑓 𝑛−𝑣 . 16 /19

Our Transformations PKE on RSA SSE on RSA 𝑠−1 𝑧 2 1, 𝑧 2 , 𝑧 1 𝑧 2 , … , 𝑧 1 SSE on Takagi RSA PKE on Takagi RSA 17 /19

Our Transformations PKE on RSA SSE on RSA 𝑏+1 𝑏 , 𝑧 1 𝑧 2 𝑏 , … , 𝑧 1 𝑠−1 𝑧 2 𝑏 , 𝑧 1 𝑠−1 𝑧 2 𝑧 2 SSE on PKE on prime power RSA prime power RSA 18 /19

Conclusion • We propose generic transformations that convert lattices on RSA to those on the Takagi RSA and the prime power RSA. As applications, we propose small secret exponent attacks and partial key exposure attacks on the variants.  Further applications of our transformations?  Better attacks can be obtained from other frameworks? 19 /19