New Cryptanalytic Attack on RSA Modulus <i>N</i> = <i>pq</i> Using Small Prime Difference Method

• Main Authors: Muhammad Rezal Kamel Ariffin, Saidu Isah Abubakar, Faridah Yunos, Muhammad Asyraf Asbullah
• Format: Article
• Language: English
• Published: MDPI AG 2018-12-01
• Series: Cryptography
• Subjects: RSA modulus; primes difference; cryptanalysis; short decryption exponent; attacks; continued fraction
• Online Access: https://www.mdpi.com/2410-387X/3/1/2

This paper presents new short decryption exponent attacks on RSA, which successfully leads to the factorization of RSA modulus <inline-formula> <math display="inline"> <semantics> <mrow> <mi>N</mi> <mo>=</mo> <mi>p</mi> <mi>q</mi> </mrow> </semantics> </math> </inline-formula> in polynomial time. The paper has two parts. In the first part, we report the usage of the small prime difference method of the form <inline-formula> <math display="inline"> <semantics> <mrow> <mrow> <mo stretchy="false">|</mo> </mrow> <msup> <mi>b</mi> <mn>2</mn> </msup> <mi>p</mi> <mo>&#8722;</mo> <msup> <mi>a</mi> <mn>2</mn> </msup> <mrow> <mi>q</mi> <mo stretchy="false">|</mo> <mo>&lt;</mo> </mrow> <msup> <mi>N</mi> <mi>&#947;</mi> </msup> </mrow> </semantics> </math> </inline-formula> where the ratio of <inline-formula> <math display="inline"> <semantics> <mfrac> <mi>q</mi> <mi>p</mi> </mfrac> </semantics> </math> </inline-formula> is close to <inline-formula> <math display="inline"> <semantics> <mfrac> <msup> <mi>b</mi> <mn>2</mn> </msup> <msup> <mi>a</mi> <mn>2</mn> </msup> </mfrac> </semantics> </math> </inline-formula>, which yields a bound <inline-formula> <math display="inline"> <semantics> <mrow> <mi>d</mi> <mo>&lt;</mo> <mfrac> <msqrt> <mn>3</mn> </msqrt> <msqrt> <mn>2</mn> </msqrt> </mfrac> <msup> <mi>N</mi> <mrow> <mfrac> <mn>3</mn> <mn>4</mn> </mfrac> <mo>&#8722;</mo> <mi>&#947;</mi> </mrow> </msup> </mrow> </semantics> </math> </inline-formula> from the convergents of the continued fraction expansion of <inline-formula> <math display="inline"> <semantics> <mfrac> <mi>e</mi> <mrow> <mi>N</mi> <mo>&#8722;</mo> <mo stretchy="false">&#8968;</mo> <mfrac> <mrow> <msup> <mi>a</mi> <mn>2</mn> </msup> <mo>+</mo> <msup> <mi>b</mi> <mn>2</mn> </msup> </mrow> <mrow> <mi>a</mi> <mi>b</mi> </mrow> </mfrac> <msqrt> <mi>N</mi> </msqrt> <mo stretchy="false">&rceil;</mo> <mo>+</mo> <mn>1</mn> </mrow> </mfrac> </semantics> </math> </inline-formula>. The second part of the paper reports four cryptanalytic attacks on <i>t</i> instances of RSA moduli <inline-formula> <math display="inline"> <semantics> <mrow> <msub> <mi>N</mi> <mi>s</mi> </msub> <mo>=</mo> <msub> <mi>p</mi> <mi>s</mi> </msub> <msub> <mi>q</mi> <mi>s</mi> </msub> </mrow> </semantics> </math> </inline-formula> for <inline-formula> <math display="inline"> <semantics> <mrow> <mi>s</mi> <mo>=</mo> <mn>1</mn> <mo>,</mo> <mn>2</mn> <mo>,</mo> <mo>&#8230;</mo> <mo>,</mo> <mi>t</mi> </mrow> </semantics> </math> </inline-formula> where we use <inline-formula> <math display="inline"> <semantics> <mrow> <mi>N</mi> <mo>&#8722;</mo> <mo stretchy="false">&#8968;</mo> <mfrac> <mrow> <msup> <mi>a</mi> <mn>2</mn> </msup> <mo>+</mo> <msup> <mi>b</mi> <mn>2</mn> </msup> </mrow> <mrow> <mi>a</mi> <mi>b</mi> </mrow> </mfrac> <msqrt> <mi>N</mi> </msqrt> <mo stretchy="false">&rceil;</mo> <mo>+</mo> <mn>1</mn> </mrow> </semantics> </math> </inline-formula> as an approximation of <inline-formula> <math display="inline"> <semantics> <mrow> <mi>ϕ</mi> <mo stretchy="false">(</mo> <mi>N</mi> <mo stretchy="false">)</mo> </mrow> </semantics> </math> </inline-formula> satisfying generalized key equations of the shape <inline-formula> <math display="inline"> <semantics> <mrow> <msub> <mi>e</mi> <mi>s</mi> </msub> <mi>d</mi> <mo>&#8722;</mo> <msub> <mi>k</mi> <mi>s</mi> </msub> <mi>ϕ</mi> <mrow> <mo stretchy="false">(</mo> <msub> <mi>N</mi> <mi>s</mi> </msub> <mo stretchy="false">)</mo> </mrow> <mo>=</mo> <mn>1</mn> </mrow> </semantics> </math> </inline-formula>, <inline-formula> <math display="inline"> <semantics> <mrow> <msub> <mi>e</mi> <mi>s</mi> </msub> <msub> <mi>d</mi> <mi>s</mi> </msub> <mo>&#8722;</mo> <mi>k</mi> <mi>ϕ</mi> <mrow> <mo stretchy="false">(</mo> <msub> <mi>N</mi> <mi>s</mi> </msub> <mo stretchy="false">)</mo> </mrow> <mo>=</mo> <mn>1</mn> </mrow> </semantics> </math> </inline-formula>, <inline-formula> <math display="inline"> <semantics> <mrow> <msub> <mi>e</mi> <mi>s</mi> </msub> <mi>d</mi> <mo>&#8722;</mo> <msub> <mi>k</mi> <mi>s</mi> </msub> <mi>ϕ</mi> <mrow> <mo stretchy="false">(</mo> <msub> <mi>N</mi> <mi>s</mi> </msub> <mo stretchy="false">)</mo> </mrow> <mo>=</mo> <msub> <mi>z</mi> <mi>s</mi> </msub> </mrow> </semantics> </math> </inline-formula>, and <inline-formula> <math display="inline"> <semantics> <mrow> <msub> <mi>e</mi> <mi>s</mi> </msub> <msub> <mi>d</mi> <mi>s</mi> </msub> <mo>&#8722;</mo> <mi>k</mi> <mi>ϕ</mi> <mrow> <mo stretchy="false">(</mo> <msub> <mi>N</mi> <mi>s</mi> </msub> <mo stretchy="false">)</mo> </mrow> <mo>=</mo> <msub> <mi>z</mi> <mi>s</mi> </msub> </mrow> </semantics> </math> </inline-formula> for unknown positive integers <inline-formula> <math display="inline"> <semantics> <mrow> <mi>d</mi> <mo>,</mo> <mspace width="4pt"></mspace> <msub> <mi>k</mi> <mi>s</mi> </msub> <mo>,</mo> <mspace width="4pt"></mspace> <msub> <mi>d</mi> <mi>s</mi> </msub> <mo>,</mo> <mspace width="4pt"></mspace> <msub> <mi>k</mi> <mi>s</mi> </msub> </mrow> </semantics> </math> </inline-formula>, and <inline-formula> <math display="inline"> <semantics> <msub> <mi>z</mi> <mi>s</mi> </msub> </semantics> </math> </inline-formula>, where we establish that <i>t</i> RSA moduli can be simultaneously factored in polynomial time using combinations of simultaneous Diophantine approximations and lattice basis reduction methods. In all the reported attacks, we have found an improved short secret exponent bound, which is considered to be better than some bounds as reported in the literature.