Session H1: Crypto Attacks CCS’17, October 30-November 3, 2017, Dallas, TX, USA The Return of Coppersmith’s Aack: Practical Factorization of Widely Used RSA Moduli Matus Nemec Marek Sys∗ Petr Svenda Masaryk University, Masaryk University Masaryk University Ca’ Foscari University of Venice
[email protected] [email protected] [email protected] Dusan Klinec Vashek Matyas EnigmaBridge, Masaryk University Masaryk University
[email protected] [email protected] ABSTRACT 1 INTRODUCTION We report on our discovery of an algorithmic aw in the construc- RSA [69] is a widespread algorithm for asymmetric cryptography tion of primes for RSA key generation in a widely-used library used for digital signatures and message encryption. RSA security of a major manufacturer of cryptographic hardware. e primes is based on the integer factorization problem, which is believed generated by the library suer from a signicant loss of entropy. to be computationally infeasible or at least extremely dicult for We propose a practical factorization method for various key lengths suciently large security parameters – the size of the private primes including 1024 and 2048 bits. Our method requires no additional and the resulting public modulus N . As of 2017, the most common information except for the value of the public modulus and does length of the modulus N is 2048 bits, with shorter key lengths not depend on a weak or a faulty random number generator. We such as 1024 bits still used in practice (although not recommend devised an extension of Coppersmith’s factorization aack utilizing anymore) and longer lengths like 4096 bits becoming increasingly an alternative form of the primes in question.