Improved cryptanalysis of RSA

<p>Let f(n)=1 if n=1, 2^(2^(n-2)) if n \\in {2,3,4,5}, (2+2^(2^(n-4)))^(2^(n-4)) if n \\in {6,7,8,...}. We conjecture that if a system T \\subseteq {x_i+1=x_k, x_i \\cdot x_j=x_k: i,j,k \\in {1,...,n}} has only finitely many solutions in integers x_1,...,x_n, then each such solution (x_1,...,x_n) satisfies |x_1|,...,|x_n| \\leq f(n). We prove that the function f cannot be decreased and the conjecture implies that there is an algorithm which takes as input a Diophantine equation, returns an integer, and this integer is greater than the heights of integer (non-negative integer, positive integer, rational) solutions, if the solution set is finite. We show that the conjecture and Matiyasevich's conjecture on finite-fold Diophantine representations are jointly inconsistent.</p>

Perfect powers in second order linear recurrences

We find 48 more solutions to a Diophantine equation investigated by Martin Davis. Before our work, only two solutions were known. Construction of the new solutions required the factorization of several large integers. Because the equation relates to Hilbert’s Tenth Problem it is desirable to know if it has only finitely many solutions. An elaborate argument is given for the conjecture that the equation has infinitely many solutions in integers.

has only finitely many solutions in integers x and yv. In the first part of this paper we shall establish upper bounds for the number of solutions of (1) in coprime integers x and y under the assumption that the discriminant D(F) of F is nonzero. For most integers h these bounds improve upon those obtained by Bombieri and Schmidt in [5]. In the course of proving these bounds we shall establish a result on polynomial congruences that extends earlier work of Nagell [30], Ore [32], Sandor [33], and Huxley [19]. In fact we shall establish an upper bound for the number of solutions of a polynomial congruence that is, in general, best possible. In the second part we shall address the problem of finding forms F for which (1) has many solutions for arbitrarily large integers h. Finally we shall obtain upper bounds for the number of solutions of certain Thue-Mahler and Ramanujan-Nagell equations by appealing to estimates of Evertse, Gy6ry, Stewart, and Tijdeman [17] for the number of solutions of S-unit equations.

Pure powers in recurrence sequences and some related diophantine equations

A common practice to encrypt with RSA is to first apply a padding scheme to the message and then to exponentiate the result with the public exponent; an example of this is OAEP. Similarly, the usual way of signing with RSA is to apply some padding scheme and then to exponentiate the result with the private exponent, as for example in PSS. Usually, the RSA modulus used for encrypting is different from the one used for signing. The goal of this paper is to simplify this common setting. First, we show that PSS can also be used for encryption, and gives an encryption scheme semantically secure against adaptive chosenciphertext attacks, in the random oracle model. As a result, PSS can be used indifferently for encryption or signature. Moreover, we show that PSS allows to safely use the same RSA key-pairs for both encryption and signature, in a concurrent manner. More generally, we show that using PSS the same set of keys can be used for both encryption and signature for any trapdoor partial-domain one-way permutation. The practical consequences of our result are important: PKIs and public-key implementations can be significantly simplified.

We address the problem of factoring a large RSA modulus $$N=pq$$ with p and q sharing a portion of bits in the middle. New polynomial time algorithms for computing the prime decomposition of N under certain conditions are presented. As an application, several attacks against RSA system using this class of moduli with low public exponent are described. Our results suggest that such integers are not appropriate for cryptographic purposes.

At Crypto’ 88, Matsumoto, Kato and Imai proposed a protocol, known as RSA-S1, in which a smart card computes an RSA signature, with the help of an untrusted powerful server. There exist two kinds of attacks against such protocols: passive attacks (where the server does not deviate from the protocol) and active attacks (where the server may return false values). Pfitzmann and Waidner presented at Eurocrypt ’92 a passive meet-in-the-middle attack and a few active attacks on RSAS1. They discussed two simple countermeasures to thwart such attacks: renewing the decomposition of the RSA private exponent, and checking the signature (in which case a small public exponent must be used). We present a new lattice-based provable passive attack on RSA-S1 which recovers the factorization of the RSA modulus when a very small public exponent is used, for many choices of the parameters. The first countermeasure does not prevent this attack because the attack is a one-round attack, that is, only a single execution of the protocol is required. Interestingly, Merkle and Werchner recently provided a security proof of RSA-S1 against one-round passive attacks in some generic model, even for parameters to which our attack provably applies. Thus, our result throws doubt on the real significance of security proofs in the generic model, at least for server-aided RSA protocols. We also present a simple analysis of a multi-round lattice-based passive attack proposed last year by Merkle.