Cryptanalysis of an RSA variant with moduli N=p^rq^l

Theorem 1.

For every ϵ>0, let N=pr⁢ql, where r,l (r>l) are two known positive integers and p,q are primes of the same bit-size. Let e be the public key exponent and let d be the private key exponent satisfying e⁢d≡1modϕ⁢(N). Suppose that

Then N can be factored in polynomial time.

Proof.

Since ϕ⁢(N)=pr-1⁢ql-1⁢(p-1)⁢(q-1), we have the following equation:

Then we want to find the root x0=d of the polynomial

Multiplying the inverse of e modulo N, we can obtain the equation

where E denotes the inverse of e modulo N. Note that N (N≡0modpr⁢ql) is a known multiple of the unknown pr-1⁢ql-1.

Since r>l, we define the following collection of polynomials:

for i=0,…,m and positive integer parameters m, t1 and t2 with t1=τ1⁢m,t2=τ2⁢m(0≤τ1,τ2<1), which will be optimized later. Note that for all i, gi⁢(d)≡0mod(p(r-1)⁢t1⁢q(l-1)⁢t2).

Let X(X=Nγ) be the upper bound on the desired root d. We built a lattice ℒ of dimension d=m+1 using the coefficient vectors of gi⁢(x⁢X) as basis vectors. We sorted the polynomials according to the ascending order of g, i.e., gi<gj if i<j.

From the triangular matrix of the lattice basis, we can compute the determinant as the product of the entries on the diagonal as det⁡(ℒ)=Xs⁢NsN. We can calculate s as

The computation of sN is somewhat complicated. At first, we have t1<t2. Otherwise, since r>l, we have

for i=0,…,t1, in this case, we only consider the exponents of p. Therefore, we let t1<t2 to consider the exponents of p and q at the same time.

Define Δ as

Note that Δ<t1<t2. In order to get Δ>0, we have to satisfy the condition

Notice that for i=0,1,…,Δ-1, we have

however, for i=Δ,Δ+1,…,t2, we have

Then we can calculate sN as

Here we rewrite

for i=0,…,Δ-1, and

for i=Δ,…,t2, where ci∈[0,1).

Furthermore, we rewrite

where c′∈[0,1); we have that

To obtain a polynomial with short coefficients that contains all small roots over integer, we apply the LLL-Basis Reduction Algorithm to the lattice ℒ. Lemma 1 gives us an upper bound on the norm of the shortest vector in the LLL-reduced basis; if the bound is smaller than the bound given in Lemma 2, we can obtain the desired polynomial. We require the following condition:

where ω=m+1. When plug in the value for det⁡(ℒ) and ω, we have that

To obtain the asymptotic bound, we let m grow to infinity. Note that for sufficiently large N the powers of 2 and m+1 are negligible. Thus we only consider the exponent of N. Then we obtain that

(3.2)

where t1=τ1⁢m and t2=τ2⁢m.

Now we have to decide the optimized values of τ1 and τ2. We consider the exponent of N as a function h⁢(τ1,τ2):

Using hτ1′⁢(τ1,τ2)=0 and hτ2′⁢(τ1,τ2)=0, we have

Solving the above equations, we get

Putting the values of τ1 and τ2 into equation (3.1), we note that the condition is satisfied. Moreover, since ∑i=0t2ci<t2+1, 1m2≤1m and c′-c′⁣2<14, inequality (3.2) can be reduced into,

We appropriate the terms m+1 by m, and obtain

We can express how m depends on the error term ϵ:

This concludes the proof of Theorem 1. ∎

Theorem 2.

For every ϵ>0, let N=pr⁢ql, where r,l (r>l) are two known positive integers and p,q are primes of the same bit-size. Let e be the public key exponent and let d be the private key exponent satisfying e⁢d≡1mod(p-1)⁢(q-1). Suppose that

Then N can be factored in polynomial time.

Proof.

Since e⁢d-1=k⁢(p-1)⁢(q-1) for some k∈ℕ, we have the following modular equation:

Obviously, (k,p,q) is the desired solution. Then we have an estimation on the desired roots. Since N=pr⁢ql and p,q are primes of the same bit-size, p and q can be estimated as N1r+l. Letting e=Nα, we have p,q≃e1α⁢(r+l). Furthermore, let d<Nδ. Then k can be bounded as follows:

Usually, α is chosen as 2r+l. In this case, we have p,q≃e12 and k≃er+l2⁢δ. Let X(X=er+l2⁢δ), Y(Y=e12) and Z(Z=e12) be the upper bounds of desired roots (p,q,k). In order to get desired solution, we define a list G of polynomials sharing the desired root modulo em,

To make the matrix triangular whose vectors are corresponding to the coefficients of polynomials, we need to append polynomials to list G as following ordered,

G=[] for u=0 to m for i=0 to u-1 do for j=0 to 1 do append gu-i,j,0,i to G for j=r-1 to 1 do append gu-i,j,1,i to G for j=l-1 to 1 do append gu-i,r,j,i to G for u=0 to m do for j=0 to s do append g0,j,0,u to G for i=l-1 in 1 do append g0,r+j,i,u to G for k=1 to t do for j=r-1 to 0 do append g0,j,k,u to G return G

where each occurrence of yr⁢zl is replaced by N since N=pr⁢ql, m,s,t are non-negative integers.

Then we construct a lattice ℒ1 which is spanned by the coefficient vectors of gi,j,k,l⁢(x⁢X,y⁢Y,z⁢Z). By some calculations, the determinant of ℒ1 is det⁡(ℒ1)=XSx⁢YSy⁢ZSz⁢eSe, where

with s=σ⁢m and t=τ⁢m. On the other hand,

Since there are three unknown variables, based on Lemma 1 and Lemma 2, one can obtain three polynomial equations which share the roots (k,p,q) over integers when

Putting the upper bounds and the value of dim⁢(ℒ1) into the above inequality and neglecting the terms that do not depend on N, we obtain that

or equivalently,

Setting σ=τ, moreover, since m<m2, 0≤τ≤1 and l<r, the left side of the above inequality can be bounded by