Partial Key Exposure on RSA with Private Exponents Larger Than N - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2012

Partial Key Exposure on RSA with Private Exponents Larger Than N

Abstract

In 1998, Boneh, Durfee and Frankel described several attacks against RSA enabling an attacker given a fraction of the bits of the private exponent d to recover all of d. These attacks were later improved and extended in various ways. They however always consider that the private exponent d is smaller than the RSA modulus N. When it comes to implementation, d can be enlarged to a value larger than N so as to improve the performance (by lowering its Hamming weight) or to increase the security (by preventing certain side-channel attacks). This paper studies this extended setting and quantifies the number of bits of d required to mount practical partial key exposure attacks. Both the cases of known most significant bits (MSBs) and least significant bits (LSBs) are analyzed. Our results are based on Coppersmith’s heuristic methods and validated by practical experiments run through the SAGE computer-algebra system.
No file

Dates and versions

hal-01111656 , version 1 (30-01-2015)

Identifiers

Cite

Marc Joye, Tancrède Lepoint. Partial Key Exposure on RSA with Private Exponents Larger Than N. ISPEC 2012 - 8th International Conference Information Security Practice and Experience, Apr 2012, Hangzhou, China. pp.369-380, ⟨10.1007/978-3-642-29101-2_25⟩. ⟨hal-01111656⟩
159 View
0 Download

Altmetric

Share

Gmail Facebook X LinkedIn More