Twenty Years of Attacks on the RSA Cryptosystem Dan Boneh dab [email protected] 1 Intro duction The RSA cryptosystem, invented by Ron Rivest, Adi Shamir, and Len Adleman [21 ], was rst publicized in the August 1977 issue of Scienti c American. The cryptosystem is most commonly used for providing privacy and ensuring authenticity of digital data. These days RSA is deployed in many commercial systems. It is used by web servers and browsers to secure web trac, it is used to ensure privacy and authenticity of Email, it is used to secure remote login sessions, and it is at the heart of electronic credit-card payment systems. In short, RSA is frequently used in applications where security of digital data is a concern. Since its initial publication, the RSA system has b een analyzed for vulnerability by many researchers. Although twentyyears of researchhave led to a numb er of fascinating attacks, none of them is devastating. They mostly illustrate the dangers of improp er use of RSA. Indeed, securely implementing RSA is a nontrivial task. Our goal is to survey some of these attacks and describ e the underlying mathematical to ols they use. Throughout the survey we follow standard naming conventions and use Alice and Bob to denote two generic parties wishing to communicate with each other. We use Marvin to denote a malicious attacker wishing to eavesdrop or tamp er with the communication b etween Alice and Bob. We b egin by describing a simpli ed version of RSA encryption. Let N = pq b e the pro duct of two large primes of the same size n=2 bits each. A typical size for N is n = 1024 bits, i.e. 309 decimal digits. Each of the factors is 512 bits. Let e; d be twointegers satisfying ed =1mod'N where 'N = p 1q 1 is the order of the multiplicative group Z . We call N the RSA N modulus, e the encryption exponent, and d the decryption exponent. The pair hN; ei is the public key. As its name suggests, it is public and is used to encrypt messages. The pair hN; di is called the secret key or private key and is known only to the recipient of encrypted messages. The secret key enables decryption of ciphertexts. e A message is an integer M 2 Z . To encrypt M , one computes C = M mo d N . To decrypt N d the ciphertext, the legitimate receiver computes C mo d N . Indeed, d ed C = M = M mo d N ; 1 where the last equality follows by Euler's theorem . One de nes the RSA function as x 7! e x mo d N . If d is given, the function can b e easily inverted using the ab ove equality. We refer to d as a trapdoor enabling one to invert the function. In this survey we study the dicultyofinverting 1 Our description slightly oversimpli es RSA encryption. In practice, messages are padded prior to encryption using some randomness [1]. For instance, a simple but insucient padding algorithm may pad a plaintext M by app ending a few random bits to one of the ends prior to encryption. Adding randomness to the encryption pro cess is necessary for prop er security. 1 the RSA function without the trap do or. We refer to this as breaking RSA. More precisely, given th the triple hN ; e; C i, we ask how hard is it to compute the e ro ot of C mo dulo N = pq when the factorization of N is unknown. Since Z is a nite set, one mayenumerate all elements of Z until N N the correct M is found. Unfortunately, this results in an algorithm with running time of order N , namely exponential in the size of its input, which is of the order log N . We are interested mostly 2 c in algorithms with a substantially lower running time, namely on the order of n where n = log N 2 and c is some small constant less than 5, say. Such algorithms often p erform well in practice on the inputs in question. Throughout the pap er we refer to such algorithms as ecient. In this survey we mainly study the RSA function as opp osed to the RSA cryptosystem. Lo osely sp eaking, the dicultyofinverting the RSA function on random inputs implies that given hN ; e; C i an attacker cannot recover the plaintext M . However, a cryptosystem must resist more subtle attacks. If hN ; e; C i is given, it should b e intractable to recover any information ab out M . This is 2 known as semantic security . We do not discuss these subtle attacks, but p oint out that RSA as describ ed ab ove is not semantically secure: given hN ; e; C i, one can easily deduce some information ab out the plaintext M for instance, the Jacobi symbol of M over N can b e easily deduced from C . RSA can b e made semantically secure by adding randomness to the encryption pro cess [1]. e The RSA function x 7! x mo d N is an example of a trapdoor one-way function. It can b e easily computed, but as far as we know cannot b e eciently inverted without the trap do or d except in sp ecial circumstances. Trap do or one-way functions can b e used for digital signatures [19 ]. Digital signatures provide authenticity and nonrepudiation of electronic legal do cuments. For instance, they are used for signing digital checks or electronic purchase orders. To sign a message M 2 Z N d using RSA, Alice applies her private key hN; di to M and obtains a signature S = M mo d N . e Given hM; Si, anyone can verify Alice's signature on M by checking that S = M mo d N . Since only Alice can generate S , one may susp ect that an adversary cannot forge Alice's signature. Unfortunately, things are not so simple; extra measures are needed for prop er security. Digital signatures are an imp ortant application of RSA. Some of the attacks we survey sp eci cally target RSA digital signatures. n -bit primes and multiplying them to An RSA key pair is generated by picking two random 2 1 obtain N . Then, for a given encryption exp onent e < 'N , one computes d = e mo d 'N using the extended Euclidean algorithm. Since the set of primes is suciently dense, a random n n -bit prime can b e quickly generated by rep eatedly picking random -bit integers and testing each 2 2 one for primality using a probabilistic primality test [19 ]. 1.1 Factoring Large Integers The rst attack on an RSA public key hN; ei to consider is factoring the mo dulus N . Given the factorization of N , an attacker can easily construct 'N , from which the decryption exp onent 1 d = e mo d 'N can be found. We refer to factoring the mo dulus as a brute-force attack on RSA. Although factoring algorithms have b een steadily improving, the current state of the art is still far from p osing a threat to the security of RSA when RSA is used prop erly. Factoring large integers is one of the most b eautiful problems of computational mathematics [18 , 20 ], but it is not the topic of this article. For completeness we note that the current fastest factoring algorithm is 2=3 1=3 log n the General Numb er Field Sieve. Its running time on n-bit integers is exp c + o1n for some c<2. Attacks on RSA that take longer than this time b ound are not interesting. These 2 A source that explains semantic security and gives examples of semantically secure ciphers is [11 ]. 2 include attacks such as exhaustive search for M and some older attacks published right after the initial publication of RSA. Our ob jective is to survey attacks on RSA that decrypt messages without directly factoring the RSA mo dulus N . Nevertheless, it is worth noting that some sparse sets of RSA mo duli, N = pq , can b e easily factored. For instance, if p 1 is a pro duct of prime factors less than B , then N can 3 b e factored in time less than B . Some implementations explicitly reject primes p for which p 1 is a pro duct of small primes. As noted ab ove, if an ecient factoring algorithm exists, then RSA is insecure. The converse is th a long standing op en problem: must one factor N in order to eciently compute e ro ots mo dulo N ? Is breaking RSA as hard as factoring? We state the concrete op en problem b elow. Op en Problem 1 Given integers N and e satisfying gcde; 'N = 1, de ne the function f : e;N 1=e Z ! Z by f x = x mo d N . Is there a polynomial-time algorithm A that computes the e;N N N factorization of N given N and access to an \oracle" f x for some e? e;N An oracle for f x evaluates the function on any input x in unit time. Recently Boneh and Venkatesan [6] provided evidence that for small e the answer to the ab ove problem may b e \no". In other words, for small e there may not exist a p olynomial-time reduction from factoring to breaking RSA. They do so by showing that in a certain mo del, a p ositive answer to the problem for small e yields an ecient factoring algorithm.