Partial Key Exposure Attack on RSA

Zheng Yong · Journal of Information Engineering University · 2003

Let N=pq be an nbit RSA modulus, e and d be encryption and decryption exponents and ν denote the exact number of the least significant bits that p and q equal,i.e., p≡qmod 2ν and pqmod 2ν+1.In 1998, Boneh, Durfee and Frankel proposed the partial key exposure attack on RSA: for low encryption exponent RSA, given a quarter of the bits of the decryption exponent d,an adversary can recover the entire d when ν=1. However, R.Steinfeld and Y.Zheng showed in 2001 that the partial key known attack can be prevented by choosing the modulus with large ν. In this paper,the authors conclude that for low encryption exponent RSA, known as the as n/4 least significant bits of d,one can factor N in time polynomial in n and 2ν when ν is small.

Read the paper · More papers on PaperTik