On the security of the KMOV public key cryptosystem

Abstract

Abstract. This paper analyzes the KMOV public key cryptosystem, which is an elliptic curve based analogue to RSA. It was believed that this cryptosystem is more secure against attacks without factoring such as the Hs in broadcast application. Some new attacks on KMOV are presented in this paper that show the converse. In particular, it is shown that some attacks on RSA which work only when a small public exponent e is used can be extended to KMOV, but with no restriction on e. The implication of these attacks on related cryptosystems are Mso discussed.

Cryptanalysis of the RSA Schemes with Short Secret Exponent from Asiacrypt ’99

“…It is still an open problem to state precisely when this can be guaranteed, although all experiments to date suggest this is an accurate heuristic assumption to make when inequality (3) holds. We note that a similar assumption is used in the work of Bleichenbacher [1] and Jutla [8].…”

“…More precisely, the scheme is a parametrized version of scheme II: p, k, d and h have respective bit-length p (less than 1 2 log 2 N ), k , d , and log 2 N − p − d . To resist various attacks, the following is required:…”

“…The attack is heuristic because it is based on the seminal lattice-based work by Coppersmith [5] on finding small roots to low-degree modular polynomial equations, in the bivariate case. 1 However, it should be emphasized that the attack works very well in practice.…”

Cryptanalysis of Unbalanced RSA with Small CRT-Exponent

“…In fact, many other works (e.g. [1,5,8]) are based on this useful heuristical multivariate approach.…”

“…Thus, this method does only work provided that β < 1 3 . Like the methods in [1,3,5,8], our approach is based on Coppersmith's technique [4] in the modular multivariate case. More precisely, we use a modular bivariate polynomial equation with a small root.…”