CONTINUED FRACTIONS AND RSA WITH SMALL SECRET EXPONENT

Transcription

1 CONTINUED FRACTIONS AND RSA WITH SMALL SECRET EXPONENT ANDREJ DUJELLA Abstract Extending the classical Legendre s result, we describe all solutions of the inequality α a/b < c/b in terms of convergents of continued fraction expansion of α Namely, we show that a/b = (rp m+1 ±sp m)/(r+1 ±s) for some nonnegative integers m, r, s such that rs < c As an application of this result, we describe a modification of Verheul and van Tilborg variant of Wiener s attac on RSA cryptosystem with small secret exponent 1 Introduction The most popular public ey cryptosystem in use today is the RSA [14] Its security is based on the difficulty of finding the prime factors of large integers The modulus n of a RSA cryptosystem is the product of two large primes p and q The public exponent e and the secret exponent d are related by ed 1 (mod ϕ(n)), where ϕ(n) = (p 1)(q 1) = n p q + 1 In a typical RSA cryptosystem p and q have approximately the same number of bits, and e < n The encryption and decryption algorithms are given by C = M e mod n, M = C d mod n To speed up the RSA encryption or decryption one may try to use small public or secret decryption exponent The choice of a small e or d is especially interesting when there is a large difference in computing power between two communicating devices, eg in communication between a smart card and a larger computer In this situation, it would be desirable for the smart card to have a small secret exponent, and for the larger computer to have a small public exponent in order to reduce the processing required in the smart card However, in 1990 Wiener [17] described an attac on a typical RSA with small secret exponent He showed that if d < n 05, then d is the denominator of some convergent of the continued fraction expansion of e/n, and therefore d can be computed efficiently from the public ey (n, e) His result is based on the classical Legendre s theorem on Diophantine approximations of the form α a b < 1 b Pinch [13] extended the attac to some Mathematics Subject Classification 11A55, 94A60 Key words and phrases Continued fractions, Diophantine approximations, RSA cryptosystem, cryptanalysis 1

2 ANDREJ DUJELLA other cryptosystems In 1997, Verheul and van Tilborg proposed an extension of Wiener s attac that allows the RSA cryptosystem to be broen by an exhaustive search when d is a few bits longer than n 05 In this paper, we will generalize Legendre s result to Diophantine approximations of the form α a b < c We will show that this result leads to the b more efficient variant of the above mentioned attacs Our attac on RSA will closely follow Wiener s ideas, but let us very briefly mention some other attacs on RSA with small exponent d In 1999, Boneh and Durfee [3] proposed an attac on RSA with small secret exponent which is based on Coppersmith s lattice-based technique for finding small roots of bivariate modular polynomial equation [4] The attac wors if d < n 09 Similar attac was proposed Blömer and May if d < n 09 Recently, it was noted by Hine, Low and Tese [8] (see also [7]) that these theoretical bounds on d are not correct (some quantity which appears in the analysis is not negligible) Also, it should be noted that the Coppersmith s theorem is for univariate case; in the bivariate case it is only a heuristic result for now On the other hand, it seems that these attacs wor well in practice Wiener s attac on RSA In 1990, Wiener [17] described a polynomial time algorithm for breaing a typical (ie p and q are of the same size and e < n) RSA cryptosystem if the secret exponent d has at most one-quarter as many bits as the modulus n The Wiener s attac is usually described in the following form (see [, 15]): If p < q < p, e < n and d < n, then d is the denominator of a convergent of the continued fraction expansion of e n The starting point is the basic relation between exponents ed 1 (mod ϕ(n)) This means that there is an integer such that ed ϕ(n) = 1 Now, ϕ(n) n implies d e n More precisely, we have n 3 n < ϕ(n) < n and d e < 3 n d n < 1 d Hence, by Legendre s theorem, d is a convergent of continued fraction expansion of e n If [a 0 ; a 1, a, ] is the continued fraction expansion of a real number α, then the convergents p j q j satisfy p 0 = a 0, q 0 = 1, p 1 = a 0 a 1 + 1, q 1 = a 1, p i = a i p i 1 + p i, q i = a i q i 1 + q i Therefore, the denominators grow exponentially This means that total number of convergents of e n is of order O(log n) If a convergent can be tested in polynomial time, this will give us a polynomial algorithm to determine d

3 CONTINUED FRACTIONS AND RSA 3 Wiener proposed the following method for testing convergents Let a b be a convergent of e n If it is the correct guess for d, than ϕ(n) can be computed from ϕ(n) = (p 1)(q 1) = (be 1)/a Now we can compute p+q from the identity pq (p 1)(q 1) + 1 = p + q, and q p from the identity ( p+q ) pq = ( q p ) If the numbers p+q and q p a, obtained by these identities, are positive integers, then the convergent b is correct guess for p+q d We can also recover easily p and q from and q p Another possibility for detecting the correct convergent is by testing which one gives a d which satisfies (M e ) d = M (mod n) for some random value of M Example 1 Let n = , e = , and assume that d < 561 Continued fraction expansion of e n is [0;, 4, 1, 1, 4, 1,, 31, 1, 1, 3, 1, 16, 3, 1, 114, 10, 1, 4, 5, 1, ], and the convergents are 0, 1, 4 9, 5 11, 9 0, 41 91, , , , Applying test ( e ) d (mod n), we obtain d = 313 Of course, the same result can be obtained with the original Wiener s test For a b = we find p+q = , q p = , and this yields the factorization n = We have seen in the previous example that the correct convergent was the last convergent with denominator less than n This suggests that perhaps it is not necessary to test all convergents We will justify this assertion To do that, we need more precise estimate of d e n, which corresponds to better approximation of ϕ(n) Assume that p < q < p Then (p+q) n = + p +q pq and thus n < p + q < 3 n < 114 n This implies Since d > e n (1) d e (p + q) 1 = n dn n n, we obtain n+1 In the opposite direction we have d e n > e n n d e n < 114 d n > ( n 1) dn

4 4 ANDREJ DUJELLA We may assume that n > 10 8 Then d < e n, and finally () d e n < 1 e n n Similarly we find that d e n < 3183 e n n if p < q < 8p In the rest of the paper we will wor under the assumption that p < q < p, but the arguments can be easily modified to the case p < q < 8p From (1) and () we may conclude that d is unique (odd) convergent satisfying e n n < d e n < 1 e n n Indeed, this follows from the fact that if p m / and p m+ /+ are two successive (odd) convergents of a real number α, then p m+ /+ at least twice better approximation of α than p m /, which is direct consequence of the following well-nown property of convergents (see [9, Theorems 9 and 13]) (3) 1 (+1 + ) < α p m < 1 +1 Furthermore, if d = pm, then n n 444e < +1 < n n e, and m is the unique odd positive integer satisfying this inequality This observations lead to an efficient algorithm for finding the correct convergent in the Wiener s attac Namely, d = pm, where m is the smallest odd positive integer such that +1 > n n 444e As suggested in the original Wiener s paper, the attac can be slightly improved by using better approximation to d, eg e f, where f = n n + 1 This can be combined with nown extensions of Legendre s theorem Namely, there is an old result of Fatou [6] (see also [11, p 16]) which says that if α a b < 1, then a b b = pm or p m+1±p m +1 ± In 1981, Worley [18] (see also [5] and [1]) proved that α a b < implies a b b = pm p m+1 ±p m +1 ±, 3p m+1+p m 3+1 +, p m+1±p m +1 ± We have or p m+1 3p m < d e f < 011 n, p m+1±p m +1 ±, If d < n, then 011 n < d and d can be found in polynomial time (which extends the Wiener s attac by the factor 1)

5 CONTINUED FRACTIONS AND RSA 5 More general extensions of Wiener s attac will be considered in next sections 3 Verheul and van Tilborg variant of Wiener s attac In 1997, Verheul and van Tilborg [16] proposed the following extension of Wiener s attac Let m be the largest (odd) integer satisfying pm e n > 1 e n Search for n d between fractions of the form rp m+1+sp m r+1 +s, ie consider the system rp m+1 + sp m = r+1 + s = d The determinant of the system satisfies p m+1 +1 p m = 1, and therefore the system has (positive) integer solutions: r = dp m s = +1 dp m+1 If r and s are small, then they can be found by an exhaustive search Let us estimate the number of steps in this exhaustive search, ie let us find upper bounds for r and s ( Let d = ) D 4 n From (3) it follows r = dq pm m qm d < d +1 The estimate for s depends on the sign of the number e n p m+1 (We may expect that this number +1 1e n n will be positive in 50% of the cases) Assume that e n p m+1 +1 > 1e n n Then Since we have ( s = d+1 d p ) ( m+1 e < d+1 +1 n p ) m+1 < d q m+ (a m+3 + ) < p m+ + e n < 1e n n < 1 n, + > 4 n 1(am+3 + ) Also, +1 > + a m+ +1 Putting all these estimates together we obtain r < 1(a m+3 + )(a m+ + 1)D, s < 1(a m+3 + )D Hence, in this case the number of steps is bounded by 1(a m+3 + )(a m+ + 1)D Assume now that e n p m e n n Then s = d+1 ( d p m+1 +1 ) < d+1 ( pm p m+1 +1 ) = d

6 6 ANDREJ DUJELLA Since in this case is already p m+1 +1 close enough to e n, we have the estimate for +1 which is analogous to the estimate for + in the previous case: 4 n +1 > 1(am+ + ) This implies r < 1(a m+ + )D, s < 1(a m+ + )(a m+1 + 1)D and in this case the number of steps is bounded by 1(a m+ + )(a m+1 + 1)D In [16], the authors propose that with reasonable probability (0%) the number of steps can be bounded by 56D It is indeed true if we have in mind that partial quotients a i s are usually very small In [10, p 35] the distribution of the partial quotients of a random real number α is given Approximately, a i will be 1 with probability 415%, a i = with probability 170%, a i = 3 with probability 93%, a i = 4 with probability 59%, etc Our analysis shows that the success of Verheul and van Tilborg attac (when D is of reasonable size) depends heavily on the size of corresponding partial quotients a m+1, a m+ and a m+3 And although they are usually small, we cannot exclude the possibility that at least one of them is large (see Examples and 3) Namely, the probability that a i x is equal to log (1 + 1 x ), and this is a slowly decreasing function In Section 5 we will propose a method how to overcome this problem and remove the dependence on partial quotients A general result on Diophantine approximation from the next section will allow us to obtain more precise information on r and s which will reduce the number of steps in the search 4 Extension of Legendre s theorem Theorem 1 Let α be an irrational number and let a, b be coprime nonzero integers, satisfying the inequality (4) α a < c b b, where c is a positive real number Then (a, b) = (rp m+1 ±sp m, r+1 ±s ), for some nonnegative integers m, r and s such that rs < c Proof Assume that α < a b, the other case is completely analogous Let m be the largest odd integer satisfying α < a b p m If a b > p 1 q 1, we will tae m = 1, following the convention that p 1 = 1, q 1 = 0

7 CONTINUED FRACTIONS AND RSA 7 Let us define the numbers r and s by: a = rp m+1 + sp m, b = r+1 + s Since p m+1 p m +1 = 1, we conclude that r and s are integers, and since p m+1 +1 < a b pm, we have that r 0 and s > 0 From the maximality of m, we have that p m+ a < α a < c + b b b But p m+ a = (a m++1 + )(rp m+1 +sp m ) (a m+ p m+1 +p m )(r+1 +s ) + b b+ = sa m+ r b+ Therefore, we obtain which implies b(sa m+ r) < c+ = c s ((sa m+ r)+1 + b), (sa m+ r)(b c s +1) < c s b Furthermore we have 1 sa m+ r > b c s +1 c s b = s c 1 s r + sqm +1 c 1 r Therefore, we obtain the following inequality (5) r sra m+ + ca m+ > 0 We will consider (5) as a quadratic inequality in r Assume for a moment that s a m+ 4c Then s 4 a m+ 4cs a m+ (s a m+ 4c), and therefore (5) implies or ( s a m+ s 4 a m+ 4cs a m+ ) r < 1 s ( ) s a m+ + s 4 a m+ 4cs a m+ 1 ( s a m+ c) s c s, r > 1 s The first possibility gives us the condition rs < c, as claimed in the theorem Let us consider the second possibility, ie (6) rs > s a m+ c Let us define t = sa m+ r Since p m+ + integer Now we have < a b, we conclude that t is a positive a = rp m+1 + sp m = (sa m+ t)p m+1 + sp m = sp m+ tp m+1, b = r+1 + s = (sa m+ t)+1 + s = s+ t+1, and the condition (6) becomes st < c

8 8 ANDREJ DUJELLA Hence we proved the statement of the theorem under assumption that s a m+ 4c Assume now that s a m+ < 4c Since r < sa m+, we have two possibilities If r < 1 sa m+, then rs < 1 s a n+ < c, and if r 1 sa m+, then t = sa m+ r 1 sa m+ and st 1 s a m+ < c Remar 1 It is not clear from the proof whether above theorem is valid for rationals a b such that a b < p 0 q 0 = α But this case corresponds to the minus case with m = 0 is the statement of the theorem Indeed, let s r = α a b Then a b = p 0 s r = rp 0 s r = rp 0 sp 1 rq 0 sq 1, and rs = b s r < b c = c b Remar The statement of the theorem is valid also for rational numbers α Indeed, if α Q, then there exist an integer j 0 such that α = p j q j The proof is identical as in the irrational case, unless α < a b α > a b > p j 1 q j 1 ) If we define positive integers r and s by a = rp j + sp j 1, < p j 1 q j 1 b = rq j + sq j 1, then the inequalities α a b = s bq j < c and b > rq b j imply rsq j < sb < cq j, and finally rs < c (or Similar result as our Theorem 1 was proved, with different methods, by Worley In [18, Theorem 1], it was shown that there are three types of solutions of the inequality (4) Two types correspond to + and signs in (rp m+1 ± sp m, r+1 ± s ), while Theorem 1 shows that the third type can be omitted Theorem 1 extends results for c = 1 and c = cited in Section The result for c = has already found applications in solving some Diophantine equations In [1], it is applied to the problem of finding positive integers a and b such that (a + b )/(ab + 1) is an integer, and in [5] it is used for solving the family of Thue inequalities x 4 4cx 3 y + (6c + )x y + 4cxy + y 4 6c + 4 We hope that Theorem 1 will also find its application in Diophantine analysis 5 A variant of Wiener s attac In this section we propose new variant of Wiener s attac It is very similar to Verheul and van Tilborg attac, but instead of exhaustive search after finding the appropriate starting convergent, this new variant also uses estimates which follow from Diophantine approximation (Theorem 1)

9 CONTINUED FRACTIONS AND RSA 9 Let m be the largest (odd) integer such that p m > e n + 1e n n We have two possibilities depending on whether the inequality p m+ + d is satisfied or not Assume first that p m+ + d We are searching for d among the fractions of the form r p m+3 +s p m+ r +3 +s + As in Section 3, we have + > Now we have ( r pm+ = d+ ) + d and < 0061 d +3 < n 1(am+3 + ) < d+ 01e n n < 0061d+ 1(am+3 + ) D a m+3 ( pm+ e ) + n ( s = d+3 d p ) ( m+3 pm+ d+3 p ) m+3 = d < 1(a m+3 + ) D Hence, d can be recovered in at most r s < 0195(a m+3+) a m+3 D D steps Here D = d/ 4 n, as before Assume now that p m+ + < d We have d e n < 1e n n < 1 n = 1D d We are in the conditions of the proof of Theorem 1, and we conclude that d = rp m+1 + sp m or r+1 + s d = sp m+ tp m+1, where r, s and t are positive s+ t+1 integers satisfying rs < 444D, st < 444D From the Dirichlet s formula for the number of divisors we obtain immediately that the number of possible pairs (r, s) and (s, t) is O(D log D) However, r and s (resp s and t) are not arbitrary They satisfy the inequalities r < a m+ s and t < a m+ s, which imply r < 061 a m+ D and t < 061 a m+ D In Section 3 we found that s s 1, where s 1 = 1(a m+ + )D if e n p m+1 > 1e +1 n n, and s 1 = 1(a m+ + ) (a m+1 + 1)D if e n p m e n n Let s 0 = D 061 We have am+

10 10 ANDREJ DUJELLA the following upper bound for the number of possible pairs (r, s): a m+ ( s 0 ) + D s D s D s 1 < a m+ s 0 + D s 1 (log s ) < 548D + D log(0707 max( (a m+3 +)a m+, (a m+ +1)(a m+1 +1))) We have the same upper bound for the number of possible pairs (s, t) Hence, the number of steps in this attac is O(D log A) (A = max{a i : i = m+1, m+, m+3}) We may compare this with Verheul & van Tilborg attac where the number of steps was O(D A ) Example Let n = , e = , and assume that d < Continued fraction expansion of e n is [0, 1, 1,, 1,, 1, 18, 10, 1, 3, 3, 1, 6, 57,, 1,, 14, 7, 1,, 1, 4, 6, ], and the convergents are We find that 0, 1, 1, 3 5, 4 7, 11 19, 15 6, , , < e n + 1e n n < Hence m = 5 and we are searching for the secret exponent among the numbers of the form 6r + 19s or 487s 6t or 4896r + 487s By applying Wiener s test, we find that s = 1195, t = 77 gives the correct value for d, d = Let us compare these numbers s and t with the numbers r and s obtained by an application of the Verheul and van Tilborg attac to the same problem We obtain the same number s = 1195, but the other number r = is much larger than t = 77, which is in a good agreement with our theoretical estimates Example 3 Let us tae n = again For 1000 d , we compare the quantities rs, obtained by Verheul and van Tilborg attac, with the quantity D The maximal value for rs/d is and it is attained for d = There are 591 d s for which rs/d is greater than 1000 The average value of rs/d for d in the given interval is 1569 Similar analysis for the attac introduced in this section gives that the average value of the quantity min(rs, st, r s )/D for d in interval 1000 d is 08397, with maximal value 406 attained for d =

11 CONTINUED FRACTIONS AND RSA 11 References [1] BLÖMER, J MAY, A: Low secret exponent RSA revisited, Cryptography and Lattice - Proceedings of CaLC 001, Lecture Notes in Comput Sci 146 (001), 4 19 [] BONEH, D: Twenty years of attacs on the RSA cryptosystem, Notices Amer Math Soc 46 (1999), [3] BONEH, D DURFEE, G: Cryptanalysis of RSA with private ey d less than N 09, Advances in Cryptology - Proceedings of Eurocrypt 99, Lecture Notes in Comput Sci 195 (1999), 1 11 [4] COPPERSMITH, D: Small solutions to polynomial equations, and low exponent RSA vulnerabilities, J Cryptology 10 (1997), [5] DUJELLA, A JADRIJEVIĆ, B: A family of quartic Thue inequalities, Acta Arith 111 (004), [6] FATOU, P: Sur l approximation des incommenurables et les series trigonometriques, C R Acad Sci (Paris) 139 (1904), [7] HINEK, M J: Low Public Exponent Partial Key and Low Private Exponent Attcs on Multi-prime RSA, Master s thesis, University of Waterloo, 00 [8] HINEK, M J LOW, M K TESKE, E: On some attacs on multi-prime RSA, Proceedings of SAC 00, Lecture Notes in Comput Sci 595 (003), [9] KHINCHIN, A Ya: Continued Fractions, Dover, New Yor, 1997 [10] KNUTH, D: The Art of Computer Programing, Vol, Seminumerical Algorithms, nd edition, Addison-Wesley, New Yor, 1981 [11] LANG, S: Introduction to Diophantine Approximations, Addison-Wesley, Reading, 1966 [1] OSGOOD, C F LUCA, F WALSH, P G: Diophantine approximations and a problem from the 1988 IMO, Rocy Mountain J Math, to appear [13] PINCH, R G E: Extending the Wiener attac to RSA-type cryptosystems, Electronics Letters 31 (1995), [14] RIVEST, R L SHAMIR, A ADLEMAN, L: A method for obtaining digital signatures and publi-ey cryptosystems, Communications of the ACM 1 (1978), [15] SMART, N: Cryptography: An Introduction, McGraw-Hill, London, 00 [16] VERHEUL, E R VAN TILBORG, H C A: Cryptanalysis of less short RSA secret exponents, Appl Algebra Engrg Comm Computing 8 (1997), [17] WIENER, M J: Cryptanalysis of short RSA secret exponents, IEEE Trans Inform Theory 36 (1990), [18] WORLEY, R T: Estimating α p/q, J Austral Math Soc 31 (1981), 0 06 Department of Mathematics University of Zagreb Bijeniča cesta 30, Zagreb Croatia address: duje@mathhr