Finding small roots of univariate modular equations revisited

Abstract

An alternative technique for finding small roots of univaxiate modular equations is described. This approach is then compared with that taken in (Coppersmith, 1996), which links the concept of the dual lattice (see (Cassels, 1971)) to the LLL algorithm (see (Lenstra et al., 1982)). Timing results comparing both algorithms are given, and practical considerations axe discussed. This work has direct applications to several low exponent attacks on the RSA cryptographic scheme (see (Coppersmith, 1996)). I n t r o d u c t i o nLet p ( x ) be a univariate modular polynomial of degree k;It is assumed that p ( x ) is monic and irreducible, and that N is not prime, but hard to factorise. In this paper we describe a new method for finding all the small integer roots, Ixol < N 1/k, of equation 1, and show the relationship between the approach taken here, and that taken in (Coppersmith, 1996). It will be proved, via a general result on dual lattices that these two algorithms are in fact equivalent, though the present approach may be preferred for computational efficiency.It has been shown in (Coppersmith, 1996) how finding small solutions to equation 1 can lead to various attacks on the RSA cryptographic scheme when using a small encrypting exponent.Since both approaches employ lattice basis reduction, the remainder of this section deals with the notation and technical results that will be required.Sections 2 and 3 give expositions of the algorithms in question, together with proofs of their validity; examples of both algorithms are shown in section 4.Section 5 proves a technical result about dual lattices with respect to the LLL algorithm, whilst section 6 shows that it is indeed this theory that links the two methods. Section 7 then discusses practical issues relating to the algorithms and gives relevant timing results. N o t a t i o nFor the sake of consistency, all the results stated in this paper will be with respect to the r o w s of the relevant matrices. We shall denote the i'th row of a matrix M by m~, and the i'th element of a vector v by v~.

On the Provable Security of an Efficient RSA-Based Pseudorandom Generator

“…To find the small zero (z 1 ,z 2 ) of (11) and (12) we use the bivariate modular polynomial lattice method of Coppersmith [11] as simplified by Howgrave-Graham [20] and used in many subsequent works. Namely, for an integer m we use the polynomials f (z 1 , z 2 ) and g(z 1 ) to construct the following family of polynomials h i,k (z 1 , z 2 ) indexed by a pair of integers i = 0, 1, .…”

Simplification of the Lattice Based Attack of Boneh and Durfee for RSA Cryptoanalysis

“…In general, solving modular equation is not easy, whereas there are some cases where we may be able to use the standard numerical method for solving this problem. The Howgrave-Graham lemma [7] provides us with one of such cases.…”

On the Broadcast and Validity-Checking Security of pkcs#1 v1.5 Encryption

“…Indeed, in 1996, Coppersmith [5] introduced a technique, based on lattice reduction, allowing to recover the root of a univariate modular polynomial provided that this root is small enough. This construction was reformulated in simpler terms by Howgrave-Graham [12] and its extensions to more variables found numerous cryptanalytic applications.…”