Abstract:RSA is an incredibly successful and useful asymmetric encryption algorithm. One of the types of implementation flaws in RSA is low entropy of the key generation, specifically the prime number creation stage. This can occur due to flawed usage of random prime number generator libraries, or on computers where there is a lack of a source of external entropy. These implementation flaws result in some RSA keys sharing prime factors, which means that the full factorization of the public modulus can be recovered incredibly efficiently by performing a computation GCD between the two public key moduli that share the prime factor. However, since one does not know which of the composite moduli share a prime factor a-priori, to determine if any such shared prime factors exist, an all-to-all GCD attack (also known as a batch GCD attack, or a bulk GCD attack) can be performed on the available public keys so as to recover any shared prime factors. This study describes a novel all-to-all batch GCD algorithm, which will be referred to as the binary tree batch GCD algorithm, that is more efficient than the current best batch GCD algorithm (the remainder tree batch GCD algorithm). A comparison against the best existing batch GCD method (which is a product tree followed by a remainder tree computation) is given using a dataset of random RSA moduli that are constructed such that some of the moduli share prime factors. This proposed binary tree batch GCD algorithm has better runtime than the existing remainder tree batch GCD algorithm, although asymptotically it has nearly identical scaling and its complexity is dependent on how many shared prime factors exist in the set of RSA keys. In practice, the implementation of the proposed binary tree batch GCD algorithm has a roughly 6x speedup compared to the standard remainder tree batch GCD approach.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is: **In the RSA encryption algorithm, the problem of public - key modulus sharing prime factors due to low entropy in the key generation process**. Specifically, when a low - entropy pseudo - random number generator is used or there is a lack of an external entropy source during RSA key generation, it may lead to multiple RSA public - key moduli sharing the same prime factors. This enables an attacker to quickly factorize the public - key modulus by calculating the greatest common divisor (GCD) between these moduli, thereby undermining the security of RSA. To solve this problem, the author proposes a new batch GCD algorithm - **Binary Tree Batch GCD Algorithm**, aiming to detect and extract shared prime factors more efficiently. Compared with the existing best batch GCD algorithm (Residue Tree Batch GCD Algorithm), this algorithm shows a significant speed advantage in practical applications, especially when dealing with large - scale RSA public - key data sets. ### Main Problem Background 1. **Introduction to the RSA Encryption Algorithm**: - RSA is an asymmetric encryption algorithm, and its security depends on the difficulty of factoring large integers. - The RSA key generation process includes selecting two large prime numbers \( p \) and \( q \), calculating the public - key modulus \( N = p\cdot q \), and selecting appropriate public - key exponent \( e \) and private - key exponent \( d \). 2. **Low - Entropy Problem**: - In some cases, due to defects in the pseudo - random number generator or a lack of an external entropy source, the generated RSA keys may have low entropy. - This may lead to multiple RSA public - key moduli sharing the same prime factors, thus making these keys vulnerable to GCD attacks. 3. **Batch GCD Attack**: - The batch GCD attack detects shared prime factors by calculating the greatest common divisor among all RSA public - key moduli. - Traditional batch GCD attacks require performing GCD calculations on each pair of RSA public - key moduli, which is very time - consuming when dealing with large - scale data. ### Proposed Solution The author proposes a batch GCD algorithm based on a binary - tree structure. The main steps are as follows: 1. **Constructing the Product Tree**: - Construct all RSA public - key moduli into a binary tree and calculate the GCD of two child nodes at each node. 2. **Calculating the Product of Shared Factors**: - Perform a product operation on all GCD outputs to obtain a product \( B \) that contains all shared factors. 3. **Extracting Shared Factors**: - Calculate the GCD of each RSA public - key modulus and \( B \) to extract all shared factors. Through this method, the Binary Tree Batch GCD algorithm can handle large - scale RSA public - key data sets more efficiently and shows a faster running speed than existing algorithms in actual tests. ### Experimental Results The experimental results show that the Binary Tree Batch GCD algorithm shows a significant speed advantage when dealing with RSA public - key data sets of different scales and different bit lengths. Especially when dealing with large - scale data sets, the speed improvement of this algorithm is particularly obvious, with an average speed improvement of about 6 times. ### Conclusion The Binary Tree Batch GCD algorithm proposed in this study provides an efficient solution to the low - entropy problem in RSA key generation. It can detect and extract shared prime factors more quickly in larger - scale data sets, thereby improving the security analysis ability of the RSA system.

An Efficient All-to-All GCD Algorithm for Low Entropy RSA Key Factorization

A Scalable High-Speed Implementation of RSA Public-Key Processor

Unbalanced Exponent Modular Reduction over Binary Field and Its Implementation

Cryptanalysis of RSA Cryptosystem: Prime Factorization using Genetic Algorithm

RM- RSA algorithm

Progress in the prime factorization of large numbers

Continued Fractions Applied to the One Line Factoring Algorithm for Breaking RSA

Shor’s factoring algorithm and modern cryptography. An illustration of the capabilities inherent in quantum computers

Integer Factorization Based on the Tile Assembly Model

Implementation of efficient method of RSA key-pair generation algorithm

Analysis of RSA algorithm using GPU programming

Improving the success rate of quantum algorithm attacking RSA encryption system

Trading Decryption for Speeding Encryption in Rebalanced-RSA.

New simultaneous Diophantine attacks on generalized RSA key equations

Strategy of Relations Collection in Factoring RSA Modulus.

An Algebraic-Geometry Approach to Prime Factorization

On the Design of Rebalanced RSA-CRT

Improved Key Generation Algorithm for Gentry's Fully Homomorphic Encryption Scheme

State of the art parallel approaches for RSA public key based cryptosystem

An Improved Public Key Cryptographic Algorithm Based on Chebyshev Polynomials and RSA

How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits