When e-th Roots Become Easier Than Factoring - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2009

When e-th Roots Become Easier Than Factoring


We show that computing e-th roots modulo n is easier than factoring n with currently known methods, given subexponential access to an oracle outputting the roots of numbers of the form $x_i + c$. Here $c$ is fixed and $x_i$ denotes small integers of the attacker’s choosing.The attack comes in two flavors:– A first version is illustrated here by producing selective roots of the form $x_i + c$ in $L_n(1/3, \sqrt[3]{32/9})$. This matches the special number field sieve’s (SNFS) complexity.– A second variant computes arbitrary $e$-th roots in $L_n(1/3, γ)$ after a subexponential number of oracle queries. The constant γ depends onthe type of oracle used.This addresses in particular the One More RSA Inversion problem, where the $e$-th root oracle is not restricted to numbers of a special form. The aforementioned constant γ is then $\sqrt[3]{32/9}$.If the oracle is constrained to roots of the form $\sqrt[e]{x_i + c \mod n}$, then $γ = \sqrt[3]{6}$.Both methods are faster than factoring n using the GNFS ($L_n(1/3, \sqrt[3]{64/9})$). This sheds additional light on RSA’s malleability in general and on RSA’sresistance to affine forgeries in particular – a problem known to be polynomial for $x_i > \sqrt[3]{n}$, but for which no algorithm faster than factoringwas known before this work.
Fichier principal
Vignette du fichier
nfsforge.pdf (238.58 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

inria-00187782 , version 1 (15-11-2007)



Antoine Joux, David Naccache, Emmanuel Thomé. When e-th Roots Become Easier Than Factoring. Advances in Cryptology -- ASIACRYPT 2007, Dec 2007, Kuching, Malaysia. pp.13-28, ⟨10.1007/978-3-540-76900-2_2⟩. ⟨inria-00187782⟩
207 View
332 Download



Gmail Facebook Twitter LinkedIn More