The RSA-768 (270 decimal digits) was factored by Kleinjung et al. on December 12 2009, and the RSA-704 (212 decimal digits) was factored by Bai et al. on July 2, 2012. And the RSA-200 (663 bits) was factored by Bahr et al. on May 9, 2005. Until right now, there is no body successful to break the RSA-210 (696 bits) currently. In this paper, we would discuss an estimation method to approach lower/upper bound of &#934;(n) in the RSA parameters. Our contribution may help researchers lock the &#934;(n) and the challenge RSA shortly

Chenglian Liu

Ziwei Ye

Cryptology ePrint Archive

Estimating the φ(n) of Upper/Lower Bound in its RSACryptosystemChenglian Liu1 and Ziwei Ye21Department of Electrical Engineering, National Tsing-HuaUniversity, Taiwanchenglian.liu@gmail.com2Department of Computer Science and Technology, Tsing-Hua University, Beijing, China.454109135@QQ.COMAbstract. The RSA-768 (270 decimal digits) was factored by Kleinjung et al. onDecember 12 2009, and the RSA-704 (212 decimal digits) was factored by Baiet al. on July 2, 2012. And the RSA-200 (663 bits) was factoredby Bahr et al.on May 9, 2005. Until right now, there is no body successful tobreak the RSA-210 (696 bits) currently. In this paper, we would discuss an estimation methodto approach lower/upper bound ofφ(n) in the RSA parameters. Our contributionmay help researchers lock theφ(n) and the challenge RSA shortly.Keywords: RSA cryptosystem; Euler’s totient function; Factoring;1 IntroductionChallenge RSA [12] is an interesting and difficult work. Recently, most scientists andresearchers [1, 4, 8] using general number field sieve (GNFS)algorithm to factor RSAmodulusn. In practical environment, it looks like if you to want to break the RSA,you may have best choice to choose GNFS when you already factor the modulusn. Intheoretical, Wiener [17] first proposed a cryptanalysis of short secret exponents wherethe d < N0.5 in 1990. Boneh [3] presented ‘Twenty years of attacks on RSA cryp-tosystem’ in 1999. He classified and described varieties attack. Followed by Boneh andDurfee [2], they suggested the provate keyd should be greater thanN0.292 for the se-curity problem. Even though, some bodies focus on secret keyd or factor compositenumbern. Their purpose are clearly. We can not help but think, does itxist a generalestimation way without factor to challenge RSA? In this article, we would introduce anew methodology where approach the lower bound and the upperbound ofφ(n). Forthis generalize conception, it may match any bit length compsite numbern.2 Review of RSA ConceptionThe signer prepares the prerequisite of a RSA signature: Twodistinct large primep andq, n = pq, Lete be a public key so thatgcd(e, φ(n)) = 1, whereφ(n) = (p−1)(q−1),then calculate the private keyd such thated ≡ 1 (mod φ(n)). The signer publishes(e, n) and keeps(p, q, d) secretly. The notation as same in [12].2 Chenglian Liu and Ziwei Ye2.1 RSA Encryption and DecryptionIn RSA public-key encryption, Alice encrypts a plaintextM for Bob using Bob’s publickey (n, e) by computing the ciphertextC ≡ M e (mod n) (1)wheren, the modulus, is the product of two or more large primes, ande, the publicexponent, is an (odd) integer≥ 3 that is relatively prime toφ(n), the order of themultiplicative groupZ∗n.2.2 RSA Digital Signatures ≡ Md (mod n) (2)where(n, d) is the signer’s RSA private key. The signature is verified by recovering themessageM with the signer’s RSA public key(n, e):M ≡ se (mod n) (3)3 Our MethodologyIn this section, we would calculate the upper bound and the low r bound ofφ(n) inRSA scheme. The detail described as below.Notation:ℓ: means lower bound.u: means upper bound.ε: a decimal expansion number (e.g99/100 = 0.99 · · · ).3.1 Approaching φ(n)If n is composite, henceφ(n) ≤ n −√n, (4)Sierpinski [15] mentioned it in 1964. It is know that if equation (4) is a good upperbound forφ(n). Is there a good lower bound forφ(n)? This question also be discussedby a newsgroup dialog between Ray Steiner and Bob Silverman in 1999 [16]. Forn >30, the φ(n) > n2/3, Kemdall and Osborn proved it [7]; forn ≥ 3, the φ(n) >log 22nlog n given by Hatalova and Salat [6].3.1.1 Estimate upper bound Does the equation (4) a good upper bound? In follows,we would estimate a new value where its smaller than previousand optimize.Theorem 1. Assumep, q are large prime numbers, wheren = pq, thenφ(n) = 4k,k ∈ Z where1 ≤ k ≤ ⌊n−2⌈√n⌉+14 ⌋.Estimating theφ(n) of Upper/Lower Bound in its RSA Cryptosystem 3nuφ(n)ℓqp10Upper BoundLower BoundCentral Approaching√nFig. 1. The lower/upper bound ofφ(n) in RSA scheme.Proof. As known two variantp andq are large prime numbers, andp, q > 2, since2 ∤ p, 2 ∤ q,therefore2 | p − 1, 2 | q − 1.4 | (p − 1)(q − 1), 4 | φ(n).φ(n) = 4k, k ∈ Z+.We will discuss how calculate the range of valuek.φ(n) = (p − 1)(q − 1)= pq − (p + q) + 1= n − (p + q) + 1. (5)Andp + q > 2√n,p + q ∈ Z+,2 | p + q.p + q > 2⌈√n⌉.φ(n) ≤ n + 1 − 2⌈√n⌉.φ(n) = 4k, k ∈ Z+.φ(n) ≤ 4 · ⌊n + 1 − 2⌈√n⌉4⌋. (6)Here, we know the maximum value (limit superior) fork ≤ ⌊n−2⌈√n⌉+14 ⌋, we callboundary value.Consequently, according to above inference, we obtain a best upper boundu of φ(n)whereφ(n) ≤ 4⌊n−2⌈√n⌉+14 ⌋.Theorem 2. Assumep, q are large prime numbers, andp, q > 2, n = pq, whereφ(n) ≤ t ≤ n, t ∈ Z. Thent = φ(n) ⇐⇒ x2 − (n + 1 − t)x + n = 0 have twopositive integer solutions.Proof. We describe two properties, necessary and sufficient conditi s as follow:Necessary condition:If t = φ(n) = (p−1)(q−1) = pq−(p+q)+1 = n−(p+q)+1, thenn+1−t = p+q,4 Chenglian Liu and Ziwei Yein the same time, the formula bex2 − (p + q)x + pq = 0. It is clearly, the equation ofthe two rootsp andq are needed to set up.Sufficient condition:If equationx2 − (n + 1 − t)x + n = 0 have two integer solutions.Assumex1, x2 be the equation of the two roots, wherex1, x2 ∈ Z+.The equation could be transformed to(x − x1)(x − x2) = 0.Promptly,x2 − (x1 + x2)x + x1x2 = 0.Thenn = x1x2, according ton’s structure, there are two choice:1) x1 = 1 andx2 = n (or x1 = n andx2 = 1).2) x1 = p andx2 = q (or x2 = q andx2 = p).If x1, x2 one for1 andn.Now,x1 + x2 = n + 1, becausex1 + x2 = n + 1 − t, hencet = 0.However, in our assumption, the condition ist > 0, so this inference contradiction.The equation have two integersp andq wherex1 + x2 = p + q, (7)thenp + q = n + 1 − t. (8)Promptly,t = n + 1 − (p + q), (9)andt = φ(n). (10)Thus, for the sufficient condition is setting up.Theorem 3. Assumep, q are large prime numbers, andp, q > 2, n = pq, t = 4kwhereφ(n) ≤ t ≤ n, t ∈ Z. If√(n + 1 − t)2 − 4n is an integer number, the equationx2 − (n + 1 − t)x + n = 0 has two integer solutions.Proof. Sincep, q are both prime numbers wheren = pq, 2 ∤ n, but2 | n + 1.Supposet = 4k, and2 | t. Thus2 | n + 1 − t.If√(n + 1 − t)2 − 4n ∈ Z, so2 |√(n + 1 − t)2 − 4n.The equationx2 − (n + 1 − t)x = 0 of the two solutions are:x =n+1−t±√(n+1−t)2−4n2 .Because2 | n + 1 − t, and while√(n + 1 − t)2 − 4n ∈ Z,it exists2 |√(n + 1 − t)2 − 4n.When√(n + 1 − t)2 − 4n ∈ Z, 2 | n + 1 − t ±√(n + 1 − t)2 − 4n.Due to√(n + 1 − t)2 − 4n ∈ Z, thex is also∈ Z.Here, the two solutions of equationx2 − (n + 1 − t)x + n = 0 are both integers.3.1.2 Estimate lower bound Loomis et al. [10] thought the Shapiro’s [13] lowerboundφ(n) > n(log 2)/(log 3) as a (naive) lower bound forEn, they can determinewhen all members of a givenEn have been found. Powell [11] pointed out that Konya-gin and Shparlinksi’s lower boundN1(n, p) > (p − 1)/2 − p3/2/n wheren > 1 is aEstimating theφ(n) of Upper/Lower Bound in its RSA Cryptosystem 5positive integer and thatp is an odd prime number withp ≡ 1 (mod n); that is a goodbound ifp is a small compared ton, and establishes thatN1(n, p) ≥ (√φ(n)(∏q primeq|nq1/(q−1))/n)p1−1/φ(n). Powell also discussed an improve-ment the upper and lower bounds in [11]. What is the optimal lower bound? The otherdiscuss in following:Theorem 4. For all n ≥ 3 we haveφ(n) ≥ neγ log log n + Ø( n(log log n)2 ), whereγis the Euler-Mascherone Constant, and the above holds with equality infinitely often.Remark:note in particular that sinceloglogn → ∞ asn grows large, we see that theresult nm < φ(n) can not hold for any fixed integerm.Proof. ConsiderR, set of alln such thatm < n implies φ(n)n <φ(m)m . This set is thenall of the ‘record breaking’n. If n ∈ Rhask prime factors, letn∗ be the product of thefirstk prime factors. Ifn 6= n∗ andφ(n)∗n∗ ≤φ(n)n , which is impossible. Hence,Rconsistentirely ofn of the formn =∏p≤y p for somey. Now for n ∈ R, we can chooseyso thatlog n =∑p≤y log p = θ(y). Then using one of Mertens estimates we see thatφ(n)n =∏p≤y(1− 1p ) = e−γlog y +O(1(log y)2 ). Sincelog log n = log(θ(y)) = log y+Ø(1)by Mertens estimates again, we have forn ∈ R, φ(n) = ne−rlog log n + O( 1(log log n)2 .Fig. 2. The same digits ofφ(n) and modulusn parameters in RSA.From above, it seems so complexity. Does it exist a simple computation method? Weobserved the modulusn with φ(n), there have some characteristics. An example forRSA-200, the modulusn and theφ(n) are 200 decimal digits. We comparedn andφ(n) each other, there are the same digits from left to right110 digits. The exampleshowed in Figure2. Discuss on RSA modulus number with haft of the bit prescribed,be introduced some literatures in [5, 9, 14]. To RSA-704, then and φ(n) had sameTable 1. Comparison of some types in RSA parameters. Unit: decimal digitstype Modulusn length φ(n) length p length q length same digitsn & φ(n) same digitsφ(n) &uRSA-200 200 200 100 100 110 101RSA-210 200 200 105 105 ? ?RSA-704 212 212 106 106 106 108RSA-768 232 232 116 116 115 1206 Chenglian Liu and Ziwei Yedigits 106, it amounts same length withp or q. We computed the upper bound valueaccording to Theorem1, this upper bound had same108 digits with its φ(n). Andanalyzed the RSA-768, then had115 digits same withφ(n); theφ(n) had120 digitssame with its upper boundu. Please see Table1 We observed the relationship ofφ(n)and its boundary valuek, whenφ(n) divided byk, we obtained this quotient are veryapproaching to number4, these lower bounders are very close to multiples of number4. We say3.999, and have106’s 9 after decimal point for case of RSA-210 type. Thelower bound approximation figure diagram be shown in figure4 and in Table2. AsFig. 3. The lower bound approximation curve status.Table 2. The relationship ofφ(n) and its boundary valuek.type φ(n)/k statementRSA-2003.99′s 9︷ ︸︸ ︷99999 8 there have99’s 9 after the decimal pointRSA-2103.106′s 9︷ ︸︸ ︷99999 2 Estimating have106’s 9 after decimal pointRSA-7043.107′s 9︷ ︸︸ ︷99999 8 there have107’s 9 after decimal pointRSA-7683.117′s 9︷ ︸︸ ︷99999 7 there have117’s 9 after decimal pointknown as the modulus numbern of RSA-210, we re-estimated its lower/upper bounds.We assume:(3 + ε)⌊n − 2⌈√n ⌉ + 14⌋ ≤ φ(n) ≤ 4⌊n − 2⌈√n ⌉ + 14⌋, (11)Estimating theφ(n) of Upper/Lower Bound in its RSA Cryptosystem 7whereε = 0.106′s 9︷ ︸︸ ︷99999. We therefore compute the upper boundu and lower boundℓ; thoseshown result in Figure4.Fig. 4. The lower/upper bound parameters ofφ(n) in RSA-210.4 ConclusionIn this paper, we re-estimated a new lower/upper bound values ofφ(n) in RSA-210, ourmethodology are easily, simply, clearly, no intricately and i tuitive. It may be usefulto researchers who would quickly reduce the searching ranges. Looking back, moreresearchers focus on secretd or modulusn, such as well known short exponent attack,side channel attack, or common modulus and cyclic attacks. Our method is differ toprevious literatures. Finally, We presented what we claimed actually.References1. Bai, S., Thomé, E., Zimmermann, P.: Factorisation of RSA-704 with cado-nfs. IACR Cryp-tology ePrint Archive p. 369 (2012)2. Boneh, D., Durfee, G.: Cryptanalysis of RSA with private key d less than N0.292. IEEETransactions on Information Theory 46(4), 1339–1349 (July2000)3. Boneh, D.: Twenty years of attacks on the RSA cryptosystem. Notices of the AMS 46, 203–213 (1999)4. F. Bahr, M. Boehm, J.F., Kleinjung, T.: RSA-200 is factored. Website (2005),http://www.rsa.com/rsalabs/node.asp?id=28795. Graham, S.W., Shparlinski, I.E.: On RSA moduli with almost half of the bits prescribed.Discrete Applied Mathematics 156(16), 3150–3154 (2008)6. Hatalova, H., Salat, T.: Remarks on two results in thelementary theory of numbers. Acta.FacRer. Natur Univ Comenian. Math. (20), 113–117 (1969)7. Kendall, D.G., Osborn, H.B.: Two Simple Lower Bounds for Euler’s Function, vol. 17. TexasJournal of Science (1965)8. Kleinjung, T., Aoki, K., Franke, J., Lenstra, A.K., Thom´e, E., Bos, J.W., Gaudry, P., Kruppa,A., Montgomery, P.L., Osvik, D.A., Te Riele, H., Timofeev, A., Zimmermann, P.: Factoriza-tion of a 768-bit RSA modulus. In: Proceedings of the 30th annu l conference on Advancesin cryptology. CRYPTO’10 (2010)8 Chenglian Liu and Ziwei Ye9. Meng, X.: On RSA moduli with half of the bits prescribed. Journal of NumberTheory 133(1), 105–109 (2013),http://www.sciencedirect.com/science/article/pii/S0022314X1200230210. Paul Loomis, M.P., Polhill, J.: Summing up the Eulerφ function. The College MathematicsJournal 39(1), 34–42 (2008)11. Powell, C.: Bounds for multiplicative cosets over fieldsof prime order. Mathematics of Com-putation 66(218), 807–822 (April 1997)12. Rivest, R., Shamir, A., Adleman, L.: A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM 21, 120–126 (1978)13. Shapiro, H.: An arithmetic function arising from theφ function. The American MathematicalMonthly 50, 18–30 (1943)14. Shparlinski, I.: On RSA moduli with prescribed bit patterns. Designs, Codes and Cryptog-raphy 39 (2006)15. Sierpinski, W.F.: Elementary Theory of Numbers. North-Holland PWN-Polish ScientificPublishers, Warsawa (1964)16. Silverman, B.: Euler’s phi functions. Website (2012),http://www.math.niu.edu/˜ rusin/known-math/99/min_phi17. Wiener, M.J.: Cryptanalysis of short RSA secret exponents. IEEE Transations on Informa-tion Theory

Estimating the Φ(n) of Upper/Lower Bound in its RSA Cryptosystem

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive