When e-th Roots Become Easier Than Factoring
Résumé
We show that computing e-th roots modulo n is easier than factoring n with currently known methods, given subexponential access to an oracle outputting the roots of numbers of the form $x_i + c$. Here $c$ is fixed and $x_i$ denotes small integers of the attacker’s choosing.The attack comes in two flavors:– A first version is illustrated here by producing selective roots of the form $x_i + c$ in $L_n(1/3, \sqrt[3]{32/9})$. This matches the special number field sieve’s (SNFS) complexity.– A second variant computes arbitrary $e$-th roots in $L_n(1/3, γ)$ after a subexponential number of oracle queries. The constant γ depends onthe type of oracle used.This addresses in particular the One More RSA Inversion problem, where the $e$-th root oracle is not restricted to numbers of a special form. The aforementioned constant γ is then $\sqrt[3]{32/9}$.If the oracle is constrained to roots of the form $\sqrt[e]{x_i + c \mod n}$, then $γ = \sqrt[3]{6}$.Both methods are faster than factoring n using the GNFS ($L_n(1/3, \sqrt[3]{64/9})$). This sheds additional light on RSA’s malleability in general and on RSA’sresistance to affine forgeries in particular – a problem known to be polynomial for $x_i > \sqrt[3]{n}$, but for which no algorithm faster than factoringwas known before this work.
Origine | Fichiers produits par l'(les) auteur(s) |
---|
Loading...