1 Introduction

Secure communication up till the 70’s was executed through symmetrical ways. In other word, both of the encryption and decryption processes used the same key. Later in 1978, the first assymetric cryptosystem went public and solved the problematic issue of distributing keys. This cryptosystem used different keys to encrypt and decrypt the data. It is known as the RSA cryptosystem [1]. The construction of the RSA algorithms comprise of key generation, encryption and decryption. During the key generation process, two large balanced primes p and q are generated and the modulus N = pq is computed. Next, let e be a random integer such that gcd(e, ϕ(N)) = 1 where ϕ(N) = (p − 1)(q − 1) is the Euler totient function. Let d be its multiplicative inverse of e such that ed ≡ 1 mod ϕ(N). Let (N, e) be publicised for encryption purpose while p, q, ϕ(N), d are kept private. For decryption process, private parameter d is needed. The mathematical difficulty of the RSA cryptosystem relies on the hardness of solving the integer factorization problem on N = pq, solving the key equation ed − kϕ(N) = 1 and solving the RSA diophantine key equation that is, C ≡ M^e mod N. Up until today, the RSA cryptosystem has remained secure.

In 1990, [2] found out a potential weakness on this cryptosystem. He proved that if , then one can factor N by using the continued fractions expansion method. In the following years, more resarchers worked on the same objective as [2] and managed to enhance the bound d. Later in 1996, [3] came out with an astounding method that is very useful to find the roots of either univariate or multivariate polynomial. Since then, this method has been used extensively in both cryptography and cryptanalysis. [4] utilized this method in their attack and they improved the bound of [2] up to d < N^0.292.

Another potential weakness upon the RSA cryptosystem is when there is leaked information regarding either the MSB(s) or LSB(s) of the private keys which is known as partial key exposure attack. In 1998, [5] proved that the whole value of d could be retrieved if a quater of d is known [6], and [7] also showed that if the primes share either MSB(s) or LSB(s), then the modulus can be factored in polynomial time. Later in 2014, [8] published an attack on RSA cryptosystem when the primes share the LSB(s) and there exists two public exponents such that their private exponents share their MSB(s).

Multi-Power RSA is one of the variants of the RSA whereby the modulus N = p^r q for r ≥ 2 is utilized. This type of modulus provides advantage for both key generation and the decryption algorithms provided the Chinese Remainder Theorem is utilized [9]. Among cryptosystems that utilize this fact are designs by [10–12]. Through their papers, the designers managed to show that their cryptosystems had low computing costs compared to the standard RSA.

As such, the study of the Integer Factorization Problem of N = p^r q becomes important. [13] proved that N = p^r q is factorable for large r, when r ≅ log p. Since then, many attackers made an attempt to cryptanalyse the multi-power RSA modulus. For instance, [14] showed that the modulus N = p^r q is more vulnerable compared to N = pq. For r = 2, the author proved that N can be factored if d < N^0.292. In 2014, [15] presented his proof that N = p²q can be factored by using lattice reduction techniques provided d < N^0.395.

2 Materials and methods

This section will discuss briefly on lattice basis reduction, Howgrave-Graham theorem, and useful lemmas that will be needed in this study.

3 The new attack

This section presents the attack on modulus N = p²q which works when there has a known amount of LSBs shared between the primes p and q.

Theorem 3 Let N = p²q be modulus such that p − q = 2^b u where 2^b ≈ N^α. Let e be a public exponents satisfying e ≈ N^γ and ed − kϕ(N) = 1. Suppose that d < N^δ. Then N can be factored in time polynomial if

Proof. Suppose we have public exponent e and key equation (5) Suppose that p − q = 2^b u. Then, from Lemma 3, p² + pq − p can be rewritten in the form p² + pq − p = 2^3b s + s₀ − v where and u₀ is a solution of the modular equation p³ ≡ N (mod 2^b). Thus, substitutes (4) from Lemma 3 into (5), we get Rearranging the equation, (6) We transform (6) into and we fix the coefficients and the variables of the polynomial as follows: Now, we consider the polynomial Then (d, k, 2^3b s − v) is a root of f(x₁, x₂, x₃) and can be solved by using Coppersmith’s technique [3]. However, we choose to use the extended strategy of Jochemsz and May [21] due to its easier implementation. The following bounds will be needed:

• max(e₁, e₂) = N^γ.
• max(d) < X₁ = N^δ.
• .
• p − q = 2^b u with 2^b ≈ N^α and .
• p² + pq − p = 2^3b s + s₀ − v with 2^3b s − v < X₃ = N^2/3.

The bounds of the variables are fixed as follows: Let . The set S and M be defined as: and the set Neglecting the coefficients, we find the expansion of polynomial f^m−1(x₁, x₂, x₃) satisfies (7) The monomials in (7) can be categorised as: Consequently, the monomials for set M are Define Then W satisfies (8) Next, define Suppose that a₄ is coprime with R. We want to work with a polynomial that has constant term 1, thus we define . Next, define the polynomials g and h as: The basis of a lattice is built by using the coefficients of polynomials g and h with dimension In order to construct an upper triangular matrix, we perform the following ordering of the monomials: if then and the monomials are lexicographically ordered if . The diagonal entries of the matrix are of the form Refer S1 Table in S1 Appendix for the coefficient matrix of m = 3 and t = 1.

Next, define (9) The determinant of is then which can be simplified into All the polynomials g(x₁, x₂, x₃) and h(x₁, x₂, x₃) and their combinations share the root (d, k, 2^3b s − v) modulo R. A new basis with short vectors is produced after applying the LLL algorithm to the lattice . For i = 1, 2, let f_i(x₁ X₁, x₂ X₂, x₃ X₃) be two short vectors of the reduced basis. Each f_i shares the roots (d, k, 2^3b s − v). Then by Theorem 3, we have In order to fulfill the condition of the bound proposed by [18], we force the polynomials f_i for i = 1, 2 to fulfill the condition of which then can be transformed into det , that is

Using ω = |M| and |M| − |M∖S| = |S|, we get (10) Using (9), we get Correspondingly, we get Set t = τm, then, Using this, and after simplifying by m³, the inequality (10) transform into Substituting the values of X₁, X₂, X₃ and W from (8) we get or equivalently, Differentiate the equation above with respect to τ, we get the optimal value , this reduces to which is valid if Under this condition of δ, we find our reduced polynomials f, f₁, f₂ with the root of (d, k, 2^3b s − v). By Assumption 1 in Section 2, the solution of the roots can be extracted using resultant technique. By using the third root 2^3b s − v, we compute p² + pq − p = 2^3b s + s₀ − v. This value is then used to find ϕ(N) and since ϕ(N) = p(p − 1)(q − 1) we can factor out p by taking the gcd(N, ϕ(N)). By knowing the value of p, we can factor the modulus N.

3.1 Comparison with the former attack

We compare our bounds with these three former attacks, [14, 15 and 19] that also work on modulus N = p^r q but we specifically consider the case when r = 2. Their attacks focused on the RSA key equation ed − kϕ(N) = 1 where ϕ(N) = p^r−1(p^r − 1)(q − 1). Note that in these former attacks, their primes do not share any amount of LSBs. Their bounds depend only on the value of r. We compare the results with various values of γ = log_N(e). Our corollary is as follow.

Corollary 1 Let N = p²q be the modulus where q < p < 2q. Let e be a public exponent satisfying ed − kϕ(N) = 1 for ϕ(N) = p(p − 1)(q − 1). Suppose that d < N^δ. Then N can be factored in time polynomial if

Note that the bounds for δ of [14, 15 and 19] remain fixed because their bounds only depend on the value of r = 2. We describe their bound for d as in the Table 1 below.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Bounds for d from the former attacks.

https://doi.org/10.1371/journal.pone.0248888.t001

Table 2 shows that our bound improves the previous bounds. The value of δ increases inversely proportional to the value of γ.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Comparison of the new result with methods from [14, 15, 19].

https://doi.org/10.1371/journal.pone.0248888.t002

Remark 1 In Corollary 1, it states that N can be factored if Suppose e = N^γ. We have then From the fact that and combining it with results from Corollary 1, , we have From here, we can find the bound for the positive value of γ. A direct calculation shows that . For small values of γ, this translates into d ≈ N.

4 Conclusion

We describe an attack related to partial key exposure. Our attack works upon the modulus N = p²q where the primes share an amount of LSB(s). Based on the result of Nitaj et al. [8], we reformulate their lemma within our theorem and find the substitution for p² + pq − p which is the value of N − ϕ(N). We use the result from our lemma in our theorem which then yields a set of integer polynomials. By applying the extended strategy of Jochemsz and May, one is able to determine the small roots of our integer polynomial and thus factoring the modulus N. We show that N can be factored when d < N^δ for where . As such, we manage to improve the bounds of some previous attacks on the modulus N = p²q.

Supporting information