RSA private key reconstruction from random bits using SAT solvers.
Constantinos Patsakis · 2013
Abstract. SAT solvers are being used more and more in Cryptanalysis. Their e ciency varies depending on the structure of the algorithm they are applied to. However, when it comes to integer factorization, or more specially the RSA problem, SAT solvers prove to be at least ine cient. The running times are too long to be compared with any well known integer factorization algorithm, even when it comes to small RSA moduli numbers. The recent work on cold boot attacks has sparkled again the interest on partial key exposure attacks and RSA key reconstruction. In this work, contrary to the search tree or lattice-based approaches that most of these works use, SAT solvers are used. The focus is on the study of two scenarios, one where there is disclosure of random bits of p and q and one for the case where the public exponent e is equal to three. In both cases, we provide a more e cient modeling of RSA as an instance of a satis ability problem, and manage to reconstruct the private key, given a part of the key, even for public keys of 1024 bits in few seconds.