Attack on the Common Prime Version of Murru and Saettone’s RSA Cryptosystem

Abstract

In this paper, we study the security bounds of d for the Common Prime version of Murru and Saettone’s RSA cyptosystem. We show that this variant of RSA can be broken if $d<N^{\frac{3}{2}-\frac{\alpha }{2}+\epsilon }$, where $\alpha =\log _Ne$, and $\epsilon$ is a small constant. By using Jochemsz and May’s extended strategy, we improve this bound to $\delta <\min \{1,\frac{7-2\sqrt{3\alpha +1}}{3}+\epsilon \}$. Notice that if e is a full size exponent, the bound for d turns to be $d<N^{0.5695+\epsilon }$. Compared with the bound of d in the classical Common Prime RSA cryptosystem, that is $d<N^{\frac{1}{4}(4+4\gamma -\sqrt{13+20\gamma +4\gamma ^2})}$, where $\gamma =\log _Ng<\frac{1}{2}$, and $g=gcd(\frac{p-1}{2},\frac{q-1}{2})$, Murru and Saettone’s variant should be used with more care. Our algorithms apply Coppersmith’s method for solving trivariate polynomial equations.