Deterministic Polynomial-Time Equivalence of Factoring and Key-Recovery Attack on a Variant of RSA
Xianmeng Meng, Shili Duan · 2009
In the original paper of RSA, it is proved that there exists a probabilistic polynomial-time equivalence between computing d and factoring N. And later, May presented a deterministic polynomial time algorithm that factors N given (e,d) provided that e,d < ¿(N). Let p and q are balanced primes and N = pq, where gcd(p - 1, q - 1) = 2g with g being a prime, and (N - 1)/(2g) also being a prime. A variant RSA that defines the public/private exponents modulo lcm(p - 1, q - 1) is called common prime RSA. We show that there exists a deterministic polynomial time algorithm that factors N given (e, d) provided that e, d satisfying a given upper bound depending on g in this variant RSA.