On the Improvement of the BDF Attack on LSBS-RSA

Hung-Min Sun,Mu-En Wu,Huaxiong Wang,Jian Guo

DOI: https://doi.org/10.1007/978-3-540-70500-0_7

2008-01-01

Abstract:An $\left( \alpha ,\beta ,\gamma \right) $-LSBS RSA denotes an RSA system with primes sharing 驴least significant bits, private exponent dwith βleast significant bits leaked, and public exponent ewith bit-length 驴. Steinfeld and Zheng showed that LSBS-RSA with small eis inherently resistant to the BDF attack, but LSBS-RSA with large eis more vulnerable than standard RSA. In this paper, we improve the BDF attack on LSBS-RSA by reducing the cost of exhaustive search for k, where kis the parameter in RSA equation: $ed=k\cdot \varphi \left( N\right) +1$. Consequently, the complexity of the BDF attacks on LSBS-RSA can be further reduced. Denote 驴as the multiplicity of 2 in k. Our method gives the improvements, which depend on the two cases:1In the case $\gamma \leq \min \left\{ \beta ,2\alpha \right\} -\sigma $, the cost of exhaustive search for kin LSBS-RSA can be simplified to searching kin polynomial time. Thus, the complexity of the BDF attack is independent of 驴, but it still increases as 驴increases.1In the case $\gamma \min \left\{ \beta ,2\alpha \right\} -\sigma $, the complexity of the BDF attack on LSBS-RSA can be further reduced with increasing 驴or β.More precisely, we show that an LSBS-RSA is more vulnerable under the BDF attack as $\max \left\{ 2\alpha ,\beta \right\} $ increases proportionally with the size of N. In the last, we point out that although LSBS-RSA benefits the computational efficiency in some applications, one should be more careful in using LSBS-RSA.