Abstract:Prime Power RSA is a variant of the RSA scheme due to Takagi with modulus N=prq for r⩾2, where p,q are of the same bit-size. In this paper, we concentrate on one type of Prime Power RSA which assumes e·d≡1modpr−1(p−1)(q−1). Two new attacks on this type of Prime Power RSA are presented when given two pairs of public and private exponents, namely, (e1,d1) and (e2,d2) with the same modulus N. Suppose that d1<Nβ1,d2<Nβ2. In 2015, Zheng and Hu showed that when β1β2<(r−1)3/(r+1)3, N may be factored in probabilistic polynomial time. The first attack of this paper shows that one can obtain the factorization of N in probabilistic polynomial time, provided that β1β2<r/(r+1)3. Later, in the second attack, we improve both the first attack and the attack of Zheng and Hu, and show that the condition β1β2<r(r−1)2/(r+1)3 already suffices to break the Prime Power RSA. By introducing multiple parameters, our lattice constructions take full advantage of known information, and obtain the best known attack. Specifically, we make full use of the information that pr is a divisor of N, while the attack of Zheng and Hu only assumes that pr−1 is a divisor of N. As a consequence, this method implies a better lattice construction, and thus improves the previous attack. The experiments which reach a better upper bound than before also verify it. Our approaches are based on Coppersmith's method for finding small roots of bivariate modular polynomial equations.

Simple Backdoors on RSA Modulus by Using RSA Vulnerability.

A Comprehensive Study of Backdoors for RSA Key Generation

Cryptanalysis of the RSA Variant Based on Cubic Pell Equation.

Generalized Cryptanalysis of RSA with Small Public Exponent

Cryptoanalysis of RSA variants with special structure of RSA primes

Estimating the Prime-Factors of an RSA Modulus and an Extension of the Wiener Attack

Cryptanalysis of Short Exponent RSA with Primes Sharing Least Significant Bits

New Cryptanalysis of Prime Power RSA with Two Private Exponents

New simultaneous Diophantine attacks on generalized RSA key equations

Cryptanalysis of a Special Case of RSA Large Decryption Exponent Using Lattice Basis Reduction Method

Cryptanalysis of Exhaustive Search on Attacking RSA.

Implicit-Key Attack on the RSA Cryptosystem.

Lattice-Based Cryptanalysis of RSA with Implicitly Related Keys

Short-Exponent RSA.

Analysis of an Enhanced Dual RSA Algorithm Using Pell’s Equation to Hide Public Key Exponent and a Fake Modulus to Avoid Factorization Attack

On the Improvement of Wiener Attack on RSA with Small Private Exponent.

Cryptanalysis of RSA Variants with Modified Euler Quotient.

New Partial Key Exposure Attacks on CRT-RSA with Large Public Exponents.

Remarks on Cryptanalysis of RSA Using Lattice Basis Reduction

An Improved Cryptanalysis of Large RSA Decryption Exponent with Constrained Secret Key

Factoring RSA Modulus with Known Bits from Both p and q: A Lattice Method.