Factoring RSA moduli with primes sharing bits in the middle

We revisit the factoring with known bits problem on RSA moduli. In 1996, Coppersmith showed that the RSA modulus $N = pq$ with balanced $p,q$ can be efficiently factored, if the high order $\frac{1}{4} \log_2 N$ bits of one prime factor is given. Later, this important result is also generalized to the factorization of RSA variants moduli such as $N = p^r q$ or $N = p_1 p_2 ··· p_n$. In 2000, Lim et al. proposed a new RSA variant with the modulus of the form $N = p^r q^s$, which is much faster in the decryption process than the standard RSA. Then from 2015 to 2018, in order to investigate the security property of this RSA variant, Lu et al. and Coron et al. have presented three works studying the polynomial-time factorization of $N = p^r q^s$ with partial known bits of $p^u q^v$ (or one of the prime factors $p,q$) for different choices of $u, v$. In this paper, we present a new lattice construction used for Coppersmith's method, and thus improve previous results. Namely, our result requires fewer known bits to recover the prime factors $p,q$. We also generalize our result to the factorization of $N = p_1^{r_1}p_2^{r_2}··· p_n^{r_n}$.

Let N = pq be an RSA modulus and e be a public exponent. Let j(N) = (p − 1)(q − 1) be the Euler’s totient function. The equation ex2 −j(N)y2 = z has infinitely many solutions in integers (x, y, z). We show that if x, y and z are suitably small, then one can factor the RSA modulus. Our bounds on the size of the solutions x, y, and z improve the existing bounds of some attacks on RSA such as Wiener’s continued fractions based attack, and Blömer-May’s lattice reduction based attack.

A common practice to encrypt with RSA is to first apply a padding scheme to the message and then to exponentiate the result with the public exponent; an example of this is OAEP. Similarly, the usual way of signing with RSA is to apply some padding scheme and then to exponentiate the result with the private exponent, as for example in PSS. Usually, the RSA modulus used for encrypting is different from the one used for signing. The goal of this paper is to simplify this common setting. First, we show that PSS can also be used for encryption, and gives an encryption scheme semantically secure against adaptive chosenciphertext attacks, in the random oracle model. As a result, PSS can be used indifferently for encryption or signature. Moreover, we show that PSS allows to safely use the same RSA key-pairs for both encryption and signature, in a concurrent manner. More generally, we show that using PSS the same set of keys can be used for both encryption and signature for any trapdoor partial-domain one-way permutation. The practical consequences of our result are important: PKIs and public-key implementations can be significantly simplified.

Let N = pq be an RSA modulus with a public exponent e and a private exponent d. Wiener’s famous attack on RSA with d < N 0.25 and its extension by Boneh and Durfee to d < N 0.292 show that using a small d makes RSA completely insecure. However, for larger d, it is known that RSA can be broken in polynomial time under special conditions. For example, various partial key exposure attacks on RSA and some attacks using additional information encoded in the public exponent e are efficient to factor the RSA modulus. These attacks were later improved and extended in various ways. In this paper, we present a new attack on RSA with a public exponent e satisfying an equation ed − k(N + 1 − ap − bq) = 1 where \(\frac{a}{b}\) is an unknown approximation of \(\frac{q}{p}\). We show that RSA is insecure when certain amount of the Least Significant Bits (LSBs) of ap and bq are known. Further, we show that the existence of good approximations \(\frac{a}{b}\) of \(\frac{q}{p}\) with small a and b substantially reduces the requirement of LSBs of ap and bq.KeywordsRSACryptanalysisFactorizationLatticeLLL algorithmCoppersmith’s method

This paper presents three new attacks on the RSA cryptosystem. The first two attacks work when k RSA public keys (N i ,e i ) are such that there exist k relations of the shape e i x − y i φ(N i ) = z i or of the shape e i x i − yφ(N i ) = z i where N i = p i q i , φ(N i ) = (p i − 1)(q i − 1) and the parameters x, x i , y, y i , z i are suitably small in terms of the prime factors of the moduli. We show that our attacks enable us to simultaneously factor the k RSA moduli N i . The third attack works when the prime factors p and q of the modulus N = pq share an amount of their least significant bits (LSBs) in the presence of two decryption exponents d 1 and d 2 sharing an amount of their most significant bits (MSBs). The three attacks improve the bounds of some former attacks that make RSA insecure.

Computing Jacobi Symbols modulo Sparse Integers and Polynomials and Some Applications

Modular multiplication forms the basis of many cryptographic functions such as RSA, Diffie-Hellman key exchange, and ElGamal encryption. For large RSA moduli, combining the fast Fourier transform (FFT) with McLaughlin's Montgomery modular multiplication (MLM) has been validated to offer cost-effective implementation results. However, the conditional selections in McLaughlin's algorithm are considered to be inefficient and vulnerable to timing attacks, since extra long additions or subtractions may take place and the running time of MLM varies. In this work, we restrict the parameters of MLM by a set of new bounds and present a modified MLM algorithm involving no conditional selection. Compared to the original MLM algorithm, we inhibit extra operations caused by the conditional selections and accomplish constant running time for modular multiplications with different inputs. As a result, we improve both area-time efficiency and security against timing attacks. Based on the proposed algorithm, efficient FFT-based modular multiplication and exponentiation are derived. Exponentiation architectures with dual FFT-based multipliers are designed obtaining area-latency efficient solutions. The results show that our work offers a better efficiency compared to the state-of-the-art works from and above 2048-bit operand sizes. For single FFT-based modular multiplication, we have achieved constant running time and obtained area-latency efficiency improvements up to 24.3 percent for 1,024-bit and 35.5 percent for 4,096-bit operands, respectively.

We consider the classic scheduling problem of minimizing the total weighted flow-time on a single machine (min-WPFT), when preemption is allowed. In this problem, we are given a set of $n$ jobs, each job having a release time $r_j$, a processing time $p_j$, and a weight $w_j$. The flow-time of a job is defined as the amount of time the job spends in the system before it completes; that is, $F_j = C_j - r_j$, where $C_j$ is the completion time of job. The objective is to minimize the total weighted flow-time of jobs. This NP-hard problem has been studied quite extensively for decades. In a recent breakthrough, Batra, Garg, and Kumar presented a {\em pseudo-polynomial} time algorithm that has an $O(1)$ approximation ratio. The design of a truly polynomial time algorithm, however, remained an open problem. In this paper, we show a transformation from pseudo-polynomial time algorithms to polynomial time algorithms in the context of min-WPFT. Our result combined with the result of Batra, Garg, and Kumar settles the long standing conjecture that there is a polynomial time algorithm with $O(1)$-approximation for min-WPFT.

A faster FPTAS for knapsack problem with cardinality constraint

Chudnovsky-type algorithms for the multiplication in finite extensions of finite fields are well-known for having a good bilinear complexity, both asymptotically and at finite distance. More precisely, for every degree n of the extension, the existence of a family of algorithms with linear bilinear complexity in n has been proved using the original method applied to an explicit recursive tower of function fields. However, there is currently no method to build these algorithms in polynomial time. Nevertheless, one can construct in polynomial time a Chudnovsky-type algorithm over the projective line for the multiplication in any extension degree, with a quasi-linear bilinear complexity. In this paper, we prove that we can obtain algorithms both constructible in polynomial time and having a linear bilinear complexity by mixing up these two strategies.

The closest string and substring problems find applications in PCR primer design, genetic probe design, motif finding, and antisense drug design. For their importance, the two problems have been extensively studied recently in computational biology. Unfortunately both problems are NP-complete. Researchers have developed both fixed-parameter algorithms and approximation algorithms for the two problems. In terms of fixed-parameter, when the radius d is the parameter, the best-known fixed-parameter algorithm for closest string has time complexity O(ndd+1), which is still superpolynomial even if d = O(log n). In this paper we provide an O(n|Σ|O(d)) algorithm where Σ is the alphabet. This gives a polynomial time algorithm when d = O(log n) and Σ has constant size. Using the same technique, we additionally provide a more efficient subexponential time algorithm for the closest substring problem. In terms of approximation, both closest string and closest substring problems admit polynomial time approximation schemes (PTAS). The best known time complexity of the PTAS is O(nO(Ɛ-2 log 1/Ɛ)). In this paper we present a PTAS with time complexity O(nO(Ɛ-2)). At last, we prove that a restricted version of the closest substring has the same parameterized complexity as closest substring, answering an open question in the literature.

How to Choose Between Exponentially Many Strategies In “Solving Zero-Sum Games Using Best-Response Oracles with Applications to Search Games,” L. Hellerstein, T. Lidbetter, and D. Pirutinsky consider zero-sum games between a minimizer and a maximizer, where the number of pure strategies of the minimizer is exponential in the number of pure strategies of the maximizer. Such games are frequent in the search-games literature. Solving them with standard algorithms typically takes exponential time. The authors show how to compute (approximate) solutions in polynomial time, provided that there is a polynomial time (approximate) algorithm solving the best-response problem: given a mixed (randomized) strategy of the maximizer, what is a best response of the minimizer? The paper presents both a learning approach using weight updates and an approach of solely theoretical interest based on the ellipsoid algorithm. The learning approach performs well experimentally compared with approaches in the literature. The results are applied to obtain new algorithms for solving specific search games.

It is known that embedding a graph G into a surface of minimum genus γmin(G) is NP-hard, whereas embedding a graph G into a surface of maximum genus γm(G) can be done in polynomial time. However, the complexity of embedding a graph G into a surface of genus between γmin(G) and γm(G) is still unknown. In this paper, it is proved that for any function f(n)=O(n)∈, 0 ≤e<1, the problem of embedding a graph G of n vertices into a surface of genus at most γmin(G)+f(n) remains NP-hard, while there is a linear time algorithm that approximates the minimum genus embedding either within a constant ratio or within a difference O(n). A polynomial time algorithm is also presented for embedding a graph G into a surface of genus γm(G)−1.

We study the integer maximum flow problem on wireless sensor networks with energy constraint. In this problem, sensor nodes gather data and then relay them to a base station, before they run out of battery power. Packets are considered as integral units and not splittable. The problem is to find the maximum data flow in the sensor network subject to the energy constraint of the sensors. We show that this integral version of the problem is strongly NP-complete and in fact APX-hard. It follows that the problem is unlikely to have a polynomial time approximation scheme. Even when restricted to graphs with concrete geometrically defined connectivity and transmission costs, the problem is still strongly NP-complete. We provide some interesting polynomial time algorithms that give good approximations for the general case nonetheless. For networks of bounded treewidth greater than two, we show that the problem is weakly NP-complete and provide pseudo-polynomial time algorithms. For a special case of graphs with treewidth two, we give a polynomial time algorithm.

We present the first polynomial time algorithm to learn nontrivial classes of languages of infinite trees. Specifically, our algorithm uses membership and equivalence queries to learn classes of omega-tree languages derived from weak regular omega-word languages in polynomial time. The method is a general polynomial time reduction of learning a class of derived omega-tree languages to learning the underlying class of omega-word languages, for any class of omega-word languages recognized by a deterministic Büchi acceptor. Our reduction, combined with the polynomial time learning algorithm of Maler and Pnueli [Maler and Pneuli, Inform. Comput., 1995] for the class of weak regular omega-word languages yields the main result. We also show that subset queries that return counterexamples can be implemented in polynomial time using subset queries that return no counterexamples for deterministic or non-deterministic finite word acceptors, and deterministic or non-deterministic Büchi omega-word acceptors. A previous claim of an algorithm to learn regular omega-trees due to Jayasrirani, Begam and Thomas [Jayasrirani et al., ICGI, 2008] is unfortunately incorrect, as shown in [Angluin, YALEU/DCS/TR-1528, 2016].