New attacks on RSA with Moduli N = p^r q

International audienceWe present three attacks on the Prime Power RSA with mod-ulus N = p^r q. In the first attack, we consider a public exponent e satisfying an equation ex − φ(N)y = z where φ(N) = p^(r−1 )(p − 1)(q − 1). We show that one can factor N if the parameters |x| and |z| satisfy |xz| < N r(r−1) (r+1)/ 2 thereby extending the recent results of Sakar [16]. In the second attack, we consider two public exponents e1 and e2 and their corresponding private exponents d1 and d2. We show that one can factor N when d1 and d2 share a suitable amount of their most significant bits, that is |d1 − d2| < N r(r−1) (r+1) /2. The third attack enables us to factor two Prime Power RSA moduli N1 = p1^r q1 and N2 = p2^r q2 when p1 and p2 share a suitable amount of their most significant bits, namely, |p1 − p2| < p1/(2rq1 q2)

New attacks on prime power N = prq using good approximation of φ(N)

This paper proposes three new attacks. Our first attack is based on the RSA key equation ed − kφ(N) = 1 where φ(N) = pr-1(p-1)(q-1). Let q <p <2q and 2p 3r+2/r+1 |p r-1/r+1 – q r-1/r+1| < 1/6Ny with d = Nδ. If δ < 1-y/2 we shows that k/d can be recovered among the convergents of the continued fractions expansions of e/N-2N r/r+1 + N r-1/r+1. We furthered our analysis on j prime power moduli Ni = priqi satisfying a variant of the above mentioned condition. We utilized the LLL algorithm on j prime power public keys (Ni, ei) with Ni = priqi and we were able to factorize the j prime power moduli Ni = priqi simultaneously in polynomial time

Secure and Efficient RNS Approach for Elliptic Curve Cryptography

Scalar multiplication, the main operation in elliptic curve cryptographic protocols, is vulnerable to side-channel (SCA) and fault injection (FA) attacks. An efficient countermeasure for scalar multiplication can be provided by using alternative number systems like the Residue Number System (RNS). In RNS, a number is represented as a set of smaller numbers, where each one is the result of the modular reduction with a given moduli basis. Under certain requirements, a number can be uniquely transformed from the integers to the RNS domain (and vice versa) and all arithmetic operations can be performed in RNS. This representation provides an inherent SCA and FA resistance to many attacks and can be further enhanced by RNS arithmetic manipulation or more traditional algorithmic countermeasures. In this paper, extending our previous work, we explore the potentials of RNS as an SCA and FA countermeasure and provide an description of RNS based SCA and FA resistance means. We propose a secure and efficient Montgomery Power Ladder based scalar multiplication algorithm on RNS and discuss its SCAFA resistance. The proposed algorithm is implemented on an ARM Cortex A7 processor and its SCA-FA resistance is evaluated by collecting preliminary leakage trace results that validate our initial assumptions

New vulnerability of RSA modulus type N = p2q

This paper proposes new attacks on modulus of type N = p2q. Given k moduli of the form Ni = p2iqi for k ≥ 2 and i = 1, …, k, the attack works when k public keys (Ni, ei) are such that there exist k relations of the shape eix – Niyi = zi – (ap2i + bq2i)yi or of the shape eixi – Niy = zi – (ap2i + bq2i)y where the parameters x, xi, y, yi and zi are suitably small in terms of the prime factors of the moduli. The proposed attacks utilizing the LLL algorithm enables one to factor the k moduli Ni simultaneously

Successful cryptanalytic attacks upon RSA moduli N = pq

This paper reports four new cryptanalytic attacks which show that t instances of RSA moduli Ns = psqs for s = 1, . . . , t where t ≥ 2 can be simultaneously factored in polynomial time using simultaneous Diophantine approximations and lattice basis reduction techniques. We construct four system of equations of the form esd − ksφ(Ns) = 1, esds − kφ(Ns) = 1, esd − kφ(Ns) = zs and esds − kφ(Ns) = zs using N – [(a i+1/i + b i+1/i / 2(ab) i+1/2i + a 1/j + b 1/j / 2(ab) 1/2j) √N] + 1 as a good approximations of φ(Ns) for unknown positive integers d, ds, ks, k, and zs . In our attacks, we found an improved short decryption exponent bound of some reported attacks