Breaking RSA Generically Is Equivalent to Factoring

Abstract

Let N be a random variable distributed according to some appropriate distribution over the set of products of two primes, such that factoring N is believed to be hard. The RSA assumption states that, given an a chosen uniformly at random from Z N and an e ∈ N \ {1}, it is computationally hard to find an x ∈ Z N such that x e − a ≡ 0 (mod N ).When complexity-theoretic (relative) lower bounds for certain cryptographic problems in a general model of computation seem to elude discovery, a common practice in cryptography is to give proofs of computational security in meaningful restricted models of computation. An example of such a restricted model that is interesting in cryptography is the generic group model that has been used for proving lower bounds for the discrete logarithm problem and other related problems. A generic model captures the cases in which an algorithm does not exploit the bit representation of the elements other than for testing equality.In this paper, we prove that the problem of factoring N can be efficiently reduced to solving the RSA problem on Z N in the generic ring model of computation, where an algorithm can perform ring operations, inverse ring operations, and test equality. This provides evidence towards the soundness of the RSA encryption and digital signature scheme, in particular showing that under the factoring assumption, they are not vulnerable to certain kinds of cryptanalytic attacks.

Zero-knowledge proofs of knowledge for group homomorphisms

“…If Peggy could answer, for a fixed t, two challenges c and c by r and r , respectively, so that Vic accepts, then she could compute x (and hence knows it). 1 This can be shown as follows: we have h r = t · z c and h r = t · z c and thus…”

“…For concreteness, one can think of m as being an RSA-modulus [17]. For a given exponent e (with gcd(e, ϕ(m)) = 1), breaking the RSA cryptosystem means to compute eth roots modulo m. This is considered hard and, for a generic model of computation, has been proved to be equivalent to factoring m [1]. Unlike for RSA, in our context e is considered to be prime.…”

“…. , x m ) of exponents such that z = h x 1 1 h x 2 2 · · · h x m m . (Note that such a representation is not unique.)…”

Arithmetic Cryptography

“…It is instructive to compare our arithmetic model to the Generic Group Model (GGM) and its extensions [48,42,41,2]. The generic group model is an idealized model, where the adversary's computation is independent of the representation of the underlying cryptographic group (or ring).…”

Contribution oo the Theory and Practice of Generating RSA Algorithm Keys

“…From the point of view of the safety of the generic RSA algorithm, the primary role is played by attacks that reconstruct the secret key ( ) , n d . In this context; attacks can be grouped according to the methods used to achieve this goal: ◆ Algorithms for factorization of the RSA algorithm module ◆ Characteristics of the applied public and secret key ◆ Properties induced by the method of implementing the RSA algorithm Details can be founded in [2], [3], [4], [5], [6].…”