├── .gitignore ├── README.md ├── boneh_durfee.sage ├── coppersmith.sage ├── rapport.tex ├── slides.pdf ├── slides.pptx └── survey_final.pdf /.gitignore: -------------------------------------------------------------------------------- 1 | *# 2 | .* 3 | *~ -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Lattice based attacks on RSA 2 | 3 | This repo host implementations and explanations of different RSA attacks using **lattice reduction** techniques (in particular **LLL**). 4 | 5 | First, we'll see how **Coppersmith** found out that you could use lattice reduction techniques to attack a relaxed model of RSA (we know parts of the message, or we know parts of one of the prime, ...). And how **Howgrave-Graham** reformulated his attack. 6 | 7 | Second we'll see how **Boneh and Durfee** used a coppersmith-like attack to factor the RSA modulus when the private key is too small (`d < N^0.292`). Followed by a simplification from **Herrman and May**. 8 | 9 | If you want to use the implementations, see below for explanations on [Coppersmith](#coppersmith) and [Boneh-Durfee](#boneh-durfee). If you want to dig deeper you can also read [my survey](survey_final.pdf) or watch [my video](https://www.youtube.com/watch?v=3cicTG3zeVQ). 10 | 11 | I've also done some personal researches on the Boneh-Durfee algorithm and they are being used in `boneh_durfee.sage` by default, just use `helpful_only = False` to disable the improvements. [I talk quantitatively about the improvements here](https://cryptologie.net/article/266/some-research-on-recovering-small-rsa-private-keys/). 12 | 13 | The latest research on the subject is: 14 | 15 | * [4 apr 2016 - General Bounds for Small Inverse Problems and Its Applications to Multi-Prime RSA (Atsushi Takayasu and Noboru Kunihiro)](http://eprint.iacr.org/2016/353) 16 | 17 | # Coppersmith 18 | 19 | I've implemented the work of **Coppersmith** (to be correct the reformulation of his attack by **Howgrave-Graham**) in [coppersmith.sage](coppersmith.sage). 20 | 21 | I've used it in two examples in the code: 22 | 23 | ## Stereotyped messages 24 | 25 | For example if **you know the most significant bits of the message**. You can **find the rest of the message** with this method. 26 | 27 | The usual RSA model is this one: you have a ciphertext `c` a modulus `N` and a public exponent `e`. Find `m` such that `m^e = c mod N`. 28 | 29 | Now, this is the **relaxed model** we can solve: you have `c = (m + x)^e`, you know a part of the message, `m`, but you don't know `x`. 30 | For example the message is always something like "*the password today is: [password]*". 31 | Coppersmith says that if you are looking for `N^1/e` of the message it is then a `small root` and you should be able to find it pretty quickly. 32 | 33 | let our polynomial be `f(x) = (m + x)^e - c` which has a root we want to find `modulo N`. Here's how to do it with my implementation: 34 | 35 | ``` 36 | dd = f.degree() 37 | beta = 1 38 | epsilon = beta / 7 39 | mm = ceil(beta**2 / (dd * epsilon)) 40 | tt = floor(dd * mm * ((1/beta) - 1)) 41 | XX = ceil(N**((beta**2/dd) - epsilon)) 42 | roots = coppersmith_howgrave_univariate(f, N, beta, mm, tt, XX) 43 | ``` 44 | 45 | You can play with the values until it finds the root. The default values should be a good start. If you want to tweak: 46 | * beta is always 1 in this case. 47 | * `XX` is your upper bound on the root. **The bigger is the unknown, the bigger XX should be**. And the bigger it is... the more time it takes. 48 | 49 | ## Factoring with high bits known 50 | 51 | Another case is factoring `N` knowing high bits of `q`. 52 | 53 | The Factorization problem normally is: give `N = pq`, find `q`. In our **relaxed** model we know an approximation `q'` of `q`. 54 | 55 | Here's how to do it with my implementation: 56 | 57 | let `f(x) = x - q'` which has a root modulo q 58 | 59 | ``` 60 | beta = 0.5 61 | dd = f.degree() 62 | epsilon = beta / 7 63 | mm = ceil(beta**2 / (dd * epsilon)) 64 | tt = floor(dd * mm * ((1/beta) - 1)) 65 | XX = ceil(N**((beta**2/dd) - epsilon)) + 1000000000000000000000000000000000 66 | roots = coppersmith_howgrave_univariate(f, N, beta, mm, tt, XX) 67 | ``` 68 | 69 | What is important here if you want to find a solution: 70 | 71 | * we should have `q >= N^beta` 72 | * as usual `XX` is the upper bound of the root, so the difference should be: |diff| < X 73 | 74 | note: `diff = |q-q'|` 75 | 76 | # Boneh Durfee 77 | 78 | The implementation of **Boneh and Durfee** attack (simplified by **Herrmann and May**) can be found in [boneh_durfee.sage](boneh_durfee.sage). 79 | 80 | The attack allows us to break RSA and the private exponent `d`. 81 | Here's why RSA works (where `e` is the public exponent, `phi` is euler's totient function, `N` is the public modulus): 82 | ``` 83 | ed = 1 mod phi(N) 84 | => ed = k phi(N) + 1 over Z 85 | => k phi(N) + 1 = 0 mod e 86 | => k (N + 1 - p - q) + 1 = 0 mod e 87 | => 2k [(N + 1)/2 + (-p -q)/2] + 1 = 0 mod e 88 | ``` 89 | 90 | The last equation gives us a bivariate polynomial `f(x,y) = 1 + x * (A + y)`. Finding the roots of this polynomial will allow us to easily compute the private exponent `d`. 91 | 92 | The attack works if the private exponent `d` is too small compared to the modulus: `d < N^0.292`. 93 | 94 | To use it: 95 | 96 | 1. look at the **how to use** section at the end of the file in [boneh_durfee.sage](boneh_durfee.sage) and replace the values according to your problem: the variable `delta` is your hypothesis on the private exponent `d`. If you don't have `d < N^delta` you will not find solutions. Start small (delta = 0.26) and increase slowly (maximum is `0.292`) 97 | 98 | 2. Run the program. If you get an error: "Try with highers m and t" you should increase `m`. The more you increase it, the longer the program will need to run. Increase it until you get rid of the error. 99 | 100 | 3. If you do not want to increase `m` (because it takes too long for example) you can try to decrease `X` because it happens that it is too high compared to the root of the `x` you are trying to find. This is a last recourse tweak though. 101 | 102 | 4. If you still don't find anything for high values of `delta`, `m` and `t` then you can try to do an exhaustive search on `d > N^0.292`. Good luck! 103 | 104 | 5. Once you found solutions for `x` and `y`, you can easily insert them into the equation: 105 | 106 | ``` 107 | e d = x [(N + 1)/2 + y] + 1 108 | ``` 109 | 110 | The example in the code should be clear enough, there is also [a write-up of a CTF challenge using this code](https://www.cryptologie.net/article/265/small-rsa-private-key-problem/). 111 | 112 | **PS**: You can also try to use `research.sage`. It tries to remove *unhelpful vectors* when it doesn't break the triangular form of the lattice's basis. It might help you to use a lower `m` than necessary! 113 | -------------------------------------------------------------------------------- /boneh_durfee.sage: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import time 3 | 4 | ############################################ 5 | # Config 6 | ########################################## 7 | 8 | """ 9 | Setting debug to true will display more informations 10 | about the lattice, the bounds, the vectors... 11 | """ 12 | debug = True 13 | 14 | """ 15 | Setting strict to true will stop the algorithm (and 16 | return (-1, -1)) if we don't have a correct 17 | upperbound on the determinant. Note that this 18 | doesn't necesseraly mean that no solutions 19 | will be found since the theoretical upperbound is 20 | usualy far away from actual results. That is why 21 | you should probably use `strict = False` 22 | """ 23 | strict = False 24 | 25 | """ 26 | This is experimental, but has provided remarkable results 27 | so far. It tries to reduce the lattice as much as it can 28 | while keeping its efficiency. I see no reason not to use 29 | this option, but if things don't work, you should try 30 | disabling it 31 | """ 32 | helpful_only = True 33 | dimension_min = 7 # stop removing if lattice reaches that dimension 34 | 35 | ############################################ 36 | # Functions 37 | ########################################## 38 | 39 | # display stats on helpful vectors 40 | def helpful_vectors(BB, modulus): 41 | nothelpful = 0 42 | for ii in range(BB.dimensions()[0]): 43 | if BB[ii,ii] >= modulus: 44 | nothelpful += 1 45 | 46 | print(nothelpful, "/", BB.dimensions()[0], " vectors are not helpful") 47 | 48 | # display matrix picture with 0 and X 49 | def matrix_overview(BB, bound): 50 | for ii in range(BB.dimensions()[0]): 51 | a = ('%02d ' % ii) 52 | for jj in range(BB.dimensions()[1]): 53 | a += '0' if BB[ii,jj] == 0 else 'X' 54 | if BB.dimensions()[0] < 60: 55 | a += ' ' 56 | if BB[ii, ii] >= bound: 57 | a += '~' 58 | print(a) 59 | 60 | # tries to remove unhelpful vectors 61 | # we start at current = n-1 (last vector) 62 | def remove_unhelpful(BB, monomials, bound, current): 63 | # end of our recursive function 64 | if current == -1 or BB.dimensions()[0] <= dimension_min: 65 | return BB 66 | 67 | # we start by checking from the end 68 | for ii in range(current, -1, -1): 69 | # if it is unhelpful: 70 | if BB[ii, ii] >= bound: 71 | affected_vectors = 0 72 | affected_vector_index = 0 73 | # let's check if it affects other vectors 74 | for jj in range(ii + 1, BB.dimensions()[0]): 75 | # if another vector is affected: 76 | # we increase the count 77 | if BB[jj, ii] != 0: 78 | affected_vectors += 1 79 | affected_vector_index = jj 80 | 81 | # level:0 82 | # if no other vectors end up affected 83 | # we remove it 84 | if affected_vectors == 0: 85 | print("* removing unhelpful vector", ii) 86 | BB = BB.delete_columns([ii]) 87 | BB = BB.delete_rows([ii]) 88 | monomials.pop(ii) 89 | BB = remove_unhelpful(BB, monomials, bound, ii-1) 90 | return BB 91 | 92 | # level:1 93 | # if just one was affected we check 94 | # if it is affecting someone else 95 | elif affected_vectors == 1: 96 | affected_deeper = True 97 | for kk in range(affected_vector_index + 1, BB.dimensions()[0]): 98 | # if it is affecting even one vector 99 | # we give up on this one 100 | if BB[kk, affected_vector_index] != 0: 101 | affected_deeper = False 102 | # remove both it if no other vector was affected and 103 | # this helpful vector is not helpful enough 104 | # compared to our unhelpful one 105 | if affected_deeper and abs(bound - BB[affected_vector_index, affected_vector_index]) < abs(bound - BB[ii, ii]): 106 | print("* removing unhelpful vectors", ii, "and", affected_vector_index) 107 | BB = BB.delete_columns([affected_vector_index, ii]) 108 | BB = BB.delete_rows([affected_vector_index, ii]) 109 | monomials.pop(affected_vector_index) 110 | monomials.pop(ii) 111 | BB = remove_unhelpful(BB, monomials, bound, ii-1) 112 | return BB 113 | # nothing happened 114 | return BB 115 | 116 | """ 117 | Returns: 118 | * 0,0 if it fails 119 | * -1,-1 if `strict=true`, and determinant doesn't bound 120 | * x0,y0 the solutions of `pol` 121 | """ 122 | def boneh_durfee(pol, modulus, mm, tt, XX, YY): 123 | """ 124 | Boneh and Durfee revisited by Herrmann and May 125 | 126 | finds a solution if: 127 | * d < N^delta 128 | * |x| < e^delta 129 | * |y| < e^0.5 130 | whenever delta < 1 - sqrt(2)/2 ~ 0.292 131 | """ 132 | 133 | # substitution (Herrman and May) 134 | PR. = PolynomialRing(ZZ) 135 | Q = PR.quotient(x*y + 1 - u) # u = xy + 1 136 | polZ = Q(pol).lift() 137 | 138 | UU = XX*YY + 1 139 | 140 | # x-shifts 141 | gg = [] 142 | for kk in range(mm + 1): 143 | for ii in range(mm - kk + 1): 144 | xshift = x^ii * modulus^(mm - kk) * polZ(u, x, y)^kk 145 | gg.append(xshift) 146 | gg.sort() 147 | 148 | # x-shifts list of monomials 149 | monomials = [] 150 | for polynomial in gg: 151 | for monomial in polynomial.monomials(): 152 | if monomial not in monomials: 153 | monomials.append(monomial) 154 | monomials.sort() 155 | 156 | # y-shifts (selected by Herrman and May) 157 | for jj in range(1, tt + 1): 158 | for kk in range(floor(mm/tt) * jj, mm + 1): 159 | yshift = y^jj * polZ(u, x, y)^kk * modulus^(mm - kk) 160 | yshift = Q(yshift).lift() 161 | gg.append(yshift) # substitution 162 | 163 | # y-shifts list of monomials 164 | for jj in range(1, tt + 1): 165 | for kk in range(floor(mm/tt) * jj, mm + 1): 166 | monomials.append(u^kk * y^jj) 167 | 168 | # construct lattice B 169 | nn = len(monomials) 170 | BB = Matrix(ZZ, nn) 171 | for ii in range(nn): 172 | BB[ii, 0] = gg[ii](0, 0, 0) 173 | for jj in range(1, ii + 1): 174 | if monomials[jj] in gg[ii].monomials(): 175 | BB[ii, jj] = gg[ii].monomial_coefficient(monomials[jj]) * monomials[jj](UU,XX,YY) 176 | 177 | # Prototype to reduce the lattice 178 | if helpful_only: 179 | # automatically remove 180 | BB = remove_unhelpful(BB, monomials, modulus^mm, nn-1) 181 | # reset dimension 182 | nn = BB.dimensions()[0] 183 | if nn == 0: 184 | print("failure") 185 | return 0,0 186 | 187 | # check if vectors are helpful 188 | if debug: 189 | helpful_vectors(BB, modulus^mm) 190 | 191 | # check if determinant is correctly bounded 192 | det = BB.det() 193 | bound = modulus^(mm*nn) 194 | if det >= bound: 195 | print("We do not have det < bound. Solutions might not be found.") 196 | print("Try with highers m and t.") 197 | if debug: 198 | diff = (log(det) - log(bound)) / log(2) 199 | print("size det(L) - size e^(m*n) = ", floor(diff)) 200 | if strict: 201 | return -1, -1 202 | else: 203 | print("det(L) < e^(m*n) (good! If a solution exists < N^delta, it will be found)") 204 | 205 | # display the lattice basis 206 | if debug: 207 | matrix_overview(BB, modulus^mm) 208 | 209 | # LLL 210 | if debug: 211 | print("optimizing basis of the lattice via LLL, this can take a long time") 212 | 213 | BB = BB.LLL() 214 | 215 | if debug: 216 | print("LLL is done!") 217 | 218 | # transform vector i & j -> polynomials 1 & 2 219 | if debug: 220 | print("looking for independent vectors in the lattice") 221 | found_polynomials = False 222 | 223 | for pol1_idx in range(nn - 1): 224 | for pol2_idx in range(pol1_idx + 1, nn): 225 | # for i and j, create the two polynomials 226 | PR. = PolynomialRing(ZZ) 227 | pol1 = pol2 = 0 228 | for jj in range(nn): 229 | pol1 += monomials[jj](w*z+1,w,z) * BB[pol1_idx, jj] / monomials[jj](UU,XX,YY) 230 | pol2 += monomials[jj](w*z+1,w,z) * BB[pol2_idx, jj] / monomials[jj](UU,XX,YY) 231 | 232 | # resultant 233 | PR. = PolynomialRing(ZZ) 234 | rr = pol1.resultant(pol2) 235 | 236 | # are these good polynomials? 237 | if rr.is_zero() or rr.monomials() == [1]: 238 | continue 239 | else: 240 | print("found them, using vectors", pol1_idx, "and", pol2_idx) 241 | found_polynomials = True 242 | break 243 | if found_polynomials: 244 | break 245 | 246 | if not found_polynomials: 247 | print("no independant vectors could be found. This should very rarely happen...") 248 | return 0, 0 249 | 250 | rr = rr(q, q) 251 | 252 | # solutions 253 | soly = rr.roots() 254 | 255 | if len(soly) == 0: 256 | print("Your prediction (delta) is too small") 257 | return 0, 0 258 | 259 | soly = soly[0][0] 260 | ss = pol1(q, soly) 261 | solx = ss.roots()[0][0] 262 | 263 | # 264 | return solx, soly 265 | 266 | def example(): 267 | ############################################ 268 | # How To Use This Script 269 | ########################################## 270 | 271 | # 272 | # The problem to solve (edit the following values) 273 | # 274 | 275 | # the modulus 276 | N = 0xc2fd2913bae61f845ac94e4ee1bb10d8531dda830d31bb221dac5f179a8f883f15046d7aa179aff848db2734b8f88cc73d09f35c445c74ee35b01a96eb7b0a6ad9cb9ccd6c02c3f8c55ecabb55501bb2c318a38cac2db69d510e152756054aaed064ac2a454e46d9b3b755b67b46906fbff8dd9aeca6755909333f5f81bf74db 277 | # the public exponent 278 | e = 0x19441f679c9609f2484eb9b2658d7138252b847b2ed8ad182be7976ed57a3e441af14897ce041f3e07916445b88181c22f510150584eee4b0f776a5a487a4472a99f2ddc95efdd2b380ab4480533808b8c92e63ace57fb42bac8315fa487d03bec86d854314bc2ec4f99b192bb98710be151599d60f224114f6b33f47e357517 279 | 280 | # the hypothesis on the private exponent (the theoretical maximum is 0.292) 281 | delta = .18 # this means that d < N^delta 282 | 283 | # 284 | # Lattice (tweak those values) 285 | # 286 | 287 | # you should tweak this (after a first run), (e.g. increment it until a solution is found) 288 | m = 4 # size of the lattice (bigger the better/slower) 289 | 290 | # you need to be a lattice master to tweak these 291 | t = int((1-2*delta) * m) # optimization from Herrmann and May 292 | X = 2*floor(N^delta) # this _might_ be too much 293 | Y = floor(N^(1/2)) # correct if p, q are ~ same size 294 | 295 | # 296 | # Don't touch anything below 297 | # 298 | 299 | # Problem put in equation 300 | P. = PolynomialRing(ZZ) 301 | A = int((N+1)/2) 302 | pol = 1 + x * (A + y) 303 | 304 | # 305 | # Find the solutions! 306 | # 307 | 308 | # Checking bounds 309 | if debug: 310 | print("=== checking values ===") 311 | print("* delta:", delta) 312 | print("* delta < 0.292", delta < 0.292) 313 | print("* size of e:", int(log(e)/log(2))) 314 | print("* size of N:", int(log(N)/log(2))) 315 | print("* m:", m, ", t:", t) 316 | 317 | # boneh_durfee 318 | if debug: 319 | print("=== running algorithm ===") 320 | start_time = time.time() 321 | 322 | solx, soly = boneh_durfee(pol, e, m, t, X, Y) 323 | 324 | # found a solution? 325 | if solx > 0: 326 | print("=== solution found ===") 327 | if False: 328 | print("x:", solx) 329 | print("y:", soly) 330 | 331 | d = int(pol(solx, soly) / e) 332 | print("private key found:", d) 333 | else: 334 | print("=== no solution was found ===") 335 | 336 | if debug: 337 | print(("=== %s seconds ===" % (time.time() - start_time))) 338 | 339 | if __name__ == "__main__": 340 | example() 341 | -------------------------------------------------------------------------------- /coppersmith.sage: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import time 3 | 4 | debug = True 5 | 6 | # display matrix picture with 0 and X 7 | def matrix_overview(BB, bound): 8 | for ii in range(BB.dimensions()[0]): 9 | a = ('%02d ' % ii) 10 | for jj in range(BB.dimensions()[1]): 11 | a += '0' if BB[ii,jj] == 0 else 'X' 12 | a += ' ' 13 | if BB[ii, ii] >= bound: 14 | a += '~' 15 | print(a) 16 | 17 | def coppersmith_howgrave_univariate(pol, modulus, beta, mm, tt, XX): 18 | """ 19 | Coppersmith revisited by Howgrave-Graham 20 | 21 | finds a solution if: 22 | * b|modulus, b >= modulus^beta , 0 < beta <= 1 23 | * |x| < XX 24 | """ 25 | # 26 | # init 27 | # 28 | dd = pol.degree() 29 | nn = dd * mm + tt 30 | 31 | # 32 | # checks 33 | # 34 | if not 0 < beta <= 1: 35 | raise ValueError("beta should belongs in (0, 1]") 36 | 37 | if not pol.is_monic(): 38 | raise ArithmeticError("Polynomial must be monic.") 39 | 40 | # 41 | # calculate bounds and display them 42 | # 43 | """ 44 | * we want to find g(x) such that ||g(xX)|| <= b^m / sqrt(n) 45 | 46 | * we know LLL will give us a short vector v such that: 47 | ||v|| <= 2^((n - 1)/4) * det(L)^(1/n) 48 | 49 | * we will use that vector as a coefficient vector for our g(x) 50 | 51 | * so we want to satisfy: 52 | 2^((n - 1)/4) * det(L)^(1/n) < N^(beta*m) / sqrt(n) 53 | 54 | so we can obtain ||v|| < N^(beta*m) / sqrt(n) <= b^m / sqrt(n) 55 | (it's important to use N because we might not know b) 56 | """ 57 | if debug: 58 | # t optimized? 59 | print("\n# Optimized t?\n") 60 | print("we want X^(n-1) < N^(beta*m) so that each vector is helpful") 61 | cond1 = RR(XX^(nn-1)) 62 | print("* X^(n-1) = ", cond1) 63 | cond2 = pow(modulus, beta*mm) 64 | print("* N^(beta*m) = ", cond2) 65 | print("* X^(n-1) < N^(beta*m) \n-> GOOD" if cond1 < cond2 else "* X^(n-1) >= N^(beta*m) \n-> NOT GOOD") 66 | 67 | # bound for X 68 | print("\n# X bound respected?\n") 69 | print("we want X <= N^(((2*beta*m)/(n-1)) - ((delta*m*(m+1))/(n*(n-1)))) / 2 = M") 70 | print("* X =", XX) 71 | cond2 = RR(modulus^(((2*beta*mm)/(nn-1)) - ((dd*mm*(mm+1))/(nn*(nn-1)))) / 2) 72 | print("* M =", cond2) 73 | print("* X <= M \n-> GOOD" if XX <= cond2 else "* X > M \n-> NOT GOOD") 74 | 75 | # solution possible? 76 | print("\n# Solutions possible?\n") 77 | detL = RR(modulus^(dd * mm * (mm + 1) / 2) * XX^(nn * (nn - 1) / 2)) 78 | print("we can find a solution if 2^((n - 1)/4) * det(L)^(1/n) < N^(beta*m) / sqrt(n)") 79 | cond1 = RR(2^((nn - 1)/4) * detL^(1/nn)) 80 | print("* 2^((n - 1)/4) * det(L)^(1/n) = ", cond1) 81 | cond2 = RR(modulus^(beta*mm) / sqrt(nn)) 82 | print("* N^(beta*m) / sqrt(n) = ", cond2) 83 | print("* 2^((n - 1)/4) * det(L)^(1/n) < N^(beta*m) / sqrt(n) \n-> SOLUTION WILL BE FOUND" if cond1 < cond2 else "* 2^((n - 1)/4) * det(L)^(1/n) >= N^(beta*m) / sqroot(n) \n-> NO SOLUTIONS MIGHT BE FOUND (but we never know)") 84 | 85 | # warning about X 86 | print("\n# Note that no solutions will be found _for sure_ if you don't respect:\n* |root| < X \n* b >= modulus^beta\n") 87 | 88 | # 89 | # Coppersmith revisited algo for univariate 90 | # 91 | 92 | # change ring of pol and x 93 | polZ = pol.change_ring(ZZ) 94 | x = polZ.parent().gen() 95 | 96 | # compute polynomials 97 | gg = [] 98 | for ii in range(mm): 99 | for jj in range(dd): 100 | gg.append((x * XX)**jj * modulus**(mm - ii) * polZ(x * XX)**ii) 101 | for ii in range(tt): 102 | gg.append((x * XX)**ii * polZ(x * XX)**mm) 103 | 104 | # construct lattice B 105 | BB = Matrix(ZZ, nn) 106 | 107 | for ii in range(nn): 108 | for jj in range(ii+1): 109 | BB[ii, jj] = gg[ii][jj] 110 | 111 | # display basis matrix 112 | if debug: 113 | matrix_overview(BB, modulus^mm) 114 | 115 | # LLL 116 | BB = BB.LLL() 117 | 118 | # transform shortest vector in polynomial 119 | new_pol = 0 120 | for ii in range(nn): 121 | new_pol += x**ii * BB[0, ii] / XX**ii 122 | 123 | # factor polynomial 124 | potential_roots = new_pol.roots() 125 | print("potential roots:", potential_roots) 126 | 127 | # test roots 128 | roots = [] 129 | for root in potential_roots: 130 | if root[0].is_integer(): 131 | result = polZ(ZZ(root[0])) 132 | if gcd(modulus, result) >= modulus^beta: 133 | roots.append(ZZ(root[0])) 134 | 135 | # 136 | return roots 137 | 138 | ############################################ 139 | # Test on Stereotyped Messages 140 | ########################################## 141 | 142 | print("//////////////////////////////////") 143 | print("// TEST 1") 144 | print("////////////////////////////////") 145 | 146 | # RSA gen options (for the demo) 147 | length_N = 1024 # size of the modulus 148 | Kbits = 200 # size of the root 149 | e = 3 150 | 151 | # RSA gen (for the demo) 152 | p = next_prime(2^int(round(length_N/2))) 153 | q = next_prime(p) 154 | N = p*q 155 | ZmodN = Zmod(N); 156 | 157 | # Create problem (for the demo) 158 | K = ZZ.random_element(0, 2^Kbits) 159 | Kdigits = K.digits(2) 160 | M = [0]*Kbits + [1]*(length_N-Kbits); 161 | for i in range(len(Kdigits)): 162 | M[i] = Kdigits[i] 163 | M = ZZ(M, 2) 164 | C = ZmodN(M)^e 165 | 166 | # Problem to equation (default) 167 | P. = PolynomialRing(ZmodN) #, implementation='NTL') 168 | pol = (2^length_N - 2^Kbits + x)^e - C 169 | dd = pol.degree() 170 | 171 | # Tweak those 172 | beta = 1 # b = N 173 | epsilon = beta / 7 # <= beta / 7 174 | mm = ceil(beta**2 / (dd * epsilon)) # optimized value 175 | tt = floor(dd * mm * ((1/beta) - 1)) # optimized value 176 | XX = ceil(N**((beta**2/dd) - epsilon)) # optimized value 177 | 178 | # Coppersmith 179 | start_time = time.time() 180 | roots = coppersmith_howgrave_univariate(pol, N, beta, mm, tt, XX) 181 | 182 | # output 183 | print("\n# Solutions") 184 | print("we want to find:",str(K)) 185 | print("we found:", str(roots)) 186 | print(("in: %s seconds " % (time.time() - start_time))) 187 | print("\n") 188 | 189 | ############################################ 190 | # Test on Factoring with High Bits Known 191 | ########################################## 192 | print("//////////////////////////////////") 193 | print("// TEST 2") 194 | print("////////////////////////////////") 195 | 196 | # RSA gen 197 | length_N = 1024; 198 | p = next_prime(2^int(round(length_N/2))); 199 | q = next_prime( round(pi.n()*p) ); 200 | N = p*q; 201 | 202 | # qbar is q + [hidden_size_random] 203 | hidden = 200; 204 | diff = ZZ.random_element(0, 2^hidden-1) 205 | qbar = q + diff; 206 | 207 | F. = PolynomialRing(Zmod(N), implementation='NTL'); 208 | pol = x - qbar 209 | dd = pol.degree() 210 | 211 | # PLAY WITH THOSE: 212 | beta = 0.5 # we should have q >= N^beta 213 | epsilon = beta / 7 # <= beta/7 214 | mm = ceil(beta**2 / (dd * epsilon)) # optimized 215 | tt = floor(dd * mm * ((1/beta) - 1)) # optimized 216 | XX = ceil(N**((beta**2/dd) - epsilon)) # we should have |diff| < X 217 | 218 | # Coppersmith 219 | start_time = time.time() 220 | roots = coppersmith_howgrave_univariate(pol, N, beta, mm, tt, XX) 221 | 222 | # output 223 | print("\n# Solutions") 224 | print("we want to find:", qbar - q) 225 | print("we found:", roots) 226 | print(("in: %s seconds " % (time.time() - start_time))) 227 | -------------------------------------------------------------------------------- /rapport.tex: -------------------------------------------------------------------------------- 1 | \documentclass[a4paper,11pt]{article} 2 | 3 | % fonts 4 | \usepackage[utf8]{inputenc} 5 | \usepackage[francais]{babel} 6 | 7 | % asm 8 | \usepackage{amsmath} 9 | \usepackage{amssymb} 10 | \usepackage{amsthm} 11 | 12 | % for right cases 13 | \newenvironment{rcases} 14 | {\left.\begin{aligned}} 15 | {\end{aligned}\right\rbrace} 16 | 17 | % diagrams 18 | \usepackage{tikz} 19 | \usetikzlibrary{matrix} 20 | \usetikzlibrary{positioning} 21 | 22 | % tables 23 | \usepackage{booktabs} 24 | 25 | % no identation 26 | \setlength{\parindent}{0pt} 27 | 28 | % theorem 29 | \newtheorem{definition}{Definition} 30 | \newtheorem{property}{Property} 31 | \newtheorem{theorem}{Theorem} 32 | 33 | % header 34 | \title{Survey: Lattice Reduction Attacks on RSA} 35 | \author{David Wong\\ 36 | \small{supervised by Guilhem Castagnos}} 37 | \date{\emph{University of Bordeaux}, March 2015} 38 | 39 | % 40 | \begin{document} 41 | 42 | \maketitle 43 | 44 | \renewcommand{\abstractname}{Abstract} 45 | \begin{abstract} 46 | \textbf{RSA}, carrying the names of \textbf{Ron Rivest}, \textbf{Adi Shamir} and \textbf{Leonard Adleman}, is one of the first practicable \textbf{public-key} cryptosystem. The algorithm was publicly described for the first time in \textbf{1977} and has since been the most used cryptosystem when it comes to asymmetric problems. For now more than \textbf{30 years}, Cryptanalysts and Researchers have looked for ways to \textbf{attack RSA}.\\ 47 | One branch of cryptanalysis on RSA is to take an interest in a \textbf{relaxed model} of RSA. A model where we know part of the message, or we know an approximation of the primes, or the private exponent is too small... In these sorts of problems, \textbf{lattice reduction techniques} have proved to be very relevant. \textbf{Coppersmith} opened the way with his constructive theorem on how to find small roots of \textbf{univariate} polynomials using reductions of lattices. \textbf{Boneh} and \textbf{Durfee} followed with a method on how to find small roots of \textbf{bivariate} polynomials using Coppersmith's heuristics on multivariate polynomials. In this survey we will see how each algorithm work and how they were respectively made simpler by \textbf{Howgrave-Graham} and the duo \textbf{Herrmann} and \textbf{May}.\\ 48 | \\ 49 | \textbf{Keywords:} RSA, lattice, LLL, Coppersmith, Howgrave-Graham, Boneh-Durfee, Herrmann-May.\\ 50 | 51 | \end{abstract} 52 | 53 | \section{Introduction}\label{introduction} 54 | 55 | In 1995, \textbf{Coppersmith} released a paper on how to attack RSA using \textbf{Lattices} and \textbf{Lattice reduction techniques} such as \textbf{LLL}. A few years later, \textbf{Howgrave-Graham} revisited Coppersmith's algorithm and made it easier to understand and apply. His work was implemented for various problems from revealing part of a message if most of the message was known, to breaking RSA if a good enough approximation of one of the prime was known.\\ 56 | Attacks based on Lattice reduction techniques caught up and several researches were done on the subject. In 1990, \textbf{Wiener} had found that you could successfully break RSA if the private exponent was too small ($d] (0,5) -- (10,5); 122 | \draw [lightgray] [<->] (5,10) -- (5,0); 123 | \draw [thick,purple] [->] (5,5) -- (6, 8); 124 | \draw [thick,purple] [->] (5,5) -- (6, 6); 125 | 126 | \draw [thick,black] [->] (11,5) -- (12,5); 127 | 128 | \draw [lightgray] [<->] (13,5) -- (23,5); 129 | \draw [lightgray] [<->] (18,10) -- (18,0); 130 | %\path [fill=purple] (18,5) to (20.5,10) to (23,10) to (18,5); 131 | \path [fill=purple] (15.5,0) to (20.5,10) to (23,10) to (13,0); 132 | \end{tikzpicture}\\ 133 | 134 | Now imagine that our vector space's \textbf{scalars are the integers}, taken in $\mathbb{Z}$. The space spanned by the vectors is now made out of points. It's \textbf{discrete}. Meaning that for any point of this lattice there is a ball centered around that point of radius different from zero that contains only that point. Nothing else. 135 | 136 | \begin{figure}[!h] 137 | \centering 138 | \begin{tikzpicture}[scale=.5] 139 | \draw [lightgray] [<->] (0,5) -- (10,5); 140 | \draw [lightgray] [<->] (5,10) -- (5,0); 141 | 142 | \draw [fill,purple] (9,1) circle [radius=0.1]; 143 | 144 | \draw [fill,purple] (7,1) circle [radius=0.1]; 145 | \draw [fill,purple] (8,2) circle [radius=0.1]; 146 | \draw [fill,purple] (9,3) circle [radius=0.1]; 147 | 148 | \draw [fill,purple] (5,1) circle [radius=0.1]; 149 | \draw [fill,purple] (6,2) circle [radius=0.1]; 150 | \draw [fill,purple] (7,3) circle [radius=0.1]; 151 | \draw [fill,purple] (8,4) circle [radius=0.1]; 152 | \draw [fill,purple] (9,5) circle [radius=0.1]; 153 | 154 | \draw [fill,purple] (3,1) circle [radius=0.1]; 155 | \draw [fill,purple] (4,2) circle [radius=0.1]; 156 | \draw [fill,purple] (5,3) circle [radius=0.1]; 157 | \draw [fill,purple] (6,4) circle [radius=0.1]; 158 | \draw [fill,purple] (7,5) circle [radius=0.1]; 159 | \draw [fill,purple] (8,6) circle [radius=0.1]; 160 | \draw [fill,purple] (9,7) circle [radius=0.1]; 161 | 162 | \draw [fill,purple] (1,1) circle [radius=0.1]; 163 | \draw [fill,purple] (2,2) circle [radius=0.1]; 164 | \draw [fill,purple] (3,3) circle [radius=0.1]; 165 | \draw [fill,purple] (4,4) circle [radius=0.1]; 166 | \draw [fill,purple] (5,5) circle [radius=0.1]; 167 | \draw [fill,purple] (6,6) circle [radius=0.1]; 168 | \draw [fill,purple] (7,7) circle [radius=0.1]; 169 | \draw [fill,purple] (8,8) circle [radius=0.1]; 170 | \draw [fill,purple] (9,9) circle [radius=0.1]; 171 | 172 | \draw [fill,purple] (1,3) circle [radius=0.1]; 173 | \draw [fill,purple] (2,4) circle [radius=0.1]; 174 | \draw [fill,purple] (3,5) circle [radius=0.1]; 175 | \draw [fill,purple] (4,6) circle [radius=0.1]; 176 | \draw [fill,purple] (5,7) circle [radius=0.1]; 177 | \draw [fill,purple] (6,8) circle [radius=0.1]; 178 | \draw [fill,purple] (7,9) circle [radius=0.1]; 179 | 180 | \draw [fill,purple] (1,5) circle [radius=0.1]; 181 | \draw [fill,purple] (2,6) circle [radius=0.1]; 182 | \draw [fill,purple] (3,7) circle [radius=0.1]; 183 | \draw [fill,purple] (4,8) circle [radius=0.1]; 184 | \draw [fill,purple] (5,9) circle [radius=0.1]; 185 | 186 | \draw [fill,purple] (1,7) circle [radius=0.1]; 187 | \draw [fill,purple] (2,8) circle [radius=0.1]; 188 | \draw [fill,purple] (3,9) circle [radius=0.1]; 189 | 190 | \draw [fill,purple] (1,9) circle [radius=0.1]; 191 | \end{tikzpicture} 192 | \end{figure} 193 | 194 | Lattice are interesting in cryptography because we seldom deal with real numbers and they bring us a lot of tools to deal with integers. 195 | 196 | Just as vector spaces, lattices can also be described by different basis represented as \textbf{matrices}. Contrary to vector spaces, we generally represent the vectors of the basis as \textbf{rows} in their corresponding matrices.\\ 197 | 198 | Last but not least, if $\{\tilde{b}_1\,\hdots,\tilde{b}_w\}$ are the vectors of the Gram-Schmidt basis of a lattice $L$ then we define the \textbf{determinant} of the lattice as such: 199 | 200 | \[ det(L) := \prod_{i=1}^{w} \|\tilde{b}_i\| \] 201 | 202 | You will see that in the technique we present, to easily compute the determinant of a lattice we will make the lattice \textbf{full rank} (dimension = rank) and \textbf{triangular}. So that the determinant is computable by doing the products of the \textbf{diagonal terms} of the lattice basis. 203 | 204 | \subsection{LLL} 205 | 206 | The \textbf{Lenstra–Lenstra–Lovász} \textit{lattice basis reduction algorithm} is a step by step calculus that reduces a lattice basis in polynomial time. The lattice is left unchanged but the row vectors of its new basis are ``\textbf{smaller}'' according to some definitions: 207 | 208 | \begin{definition} 209 | Let $L$ be a lattice with a basis $B$. The $\delta$-LLL algorithm applied on $L$'s basis $B$ produces a new basis of $L$: $B' = \{b_1,\hdots,b_n\}$ satisfying: 210 | \begin{eqnarray} 211 | \forall \hspace{1mm} 1 \leq j < i \leq n \text{ we have } |\mu_{i,j}| \leq \frac{_1}{^2}\\ 212 | \forall \hspace{1mm} 1 \leq i < n \text{ we have } \delta \cdot \|\tilde{b_i}\|^2 \leq \| \mu_{i+1,i}\cdot \tilde{b}_i + \tilde{b}_{i + 1}\|^2 213 | \end{eqnarray} 214 | \begin{center} 215 | with $\mu_{i,j} = \frac{b_i \cdot \tilde{b}_j}{\tilde{b}_j \cdot \tilde{b}_j}$ and $\tilde{b}_1 = b_1$ (Gram-Schmidt) 216 | \end{center} 217 | \end{definition} 218 | 219 | \begin{tikzpicture}[scale=.55] 220 | \node [above] at (5,10) {\textbf{random basis}}; 221 | \node [above] at (18,10) {\textbf{reduced basis}}; 222 | \draw [lightgray] [<->] (0,5) -- (10,5); 223 | \draw [lightgray] [<->] (5,10) -- (5,0); 224 | 225 | \draw [fill,purple,opacity=.4] (9,1) circle [radius=0.1]; 226 | 227 | \draw [fill,purple,opacity=.4] (7,1) circle [radius=0.1]; 228 | \draw [fill,purple,opacity=.4] (8,2) circle [radius=0.1]; 229 | \draw [fill,purple,opacity=.4] (9,3) circle [radius=0.1]; 230 | 231 | \draw [fill,purple,opacity=.4] (5,1) circle [radius=0.1]; 232 | \draw [fill,purple,opacity=.4] (6,2) circle [radius=0.1]; 233 | \draw [fill,purple,opacity=.4] (7,3) circle [radius=0.1]; 234 | \draw [fill,purple,opacity=.4] (8,4) circle [radius=0.1]; 235 | \draw [fill,purple,opacity=.4] (9,5) circle [radius=0.1]; 236 | 237 | \draw [fill,purple,opacity=.4] (3,1) circle [radius=0.1]; 238 | \draw [fill,purple,opacity=.4] (4,2) circle [radius=0.1]; 239 | \draw [fill,purple,opacity=.4] (5,3) circle [radius=0.1]; 240 | \draw [fill,purple,opacity=.4] (6,4) circle [radius=0.1]; 241 | \draw [fill,purple,opacity=.4] (7,5) circle [radius=0.1]; 242 | \draw [fill,purple,opacity=.4] (8,6) circle [radius=0.1]; 243 | \draw [fill,purple,opacity=.4] (9,7) circle [radius=0.1]; 244 | 245 | \draw [fill,purple,opacity=.4] (1,1) circle [radius=0.1]; 246 | \draw [fill,purple,opacity=.4] (2,2) circle [radius=0.1]; 247 | \draw [fill,purple,opacity=.4] (3,3) circle [radius=0.1]; 248 | \draw [fill,purple,opacity=.4] (4,4) circle [radius=0.1]; 249 | \draw [fill,purple,opacity=.4] (5,5) circle [radius=0.1]; 250 | \draw [fill,purple,opacity=.4] (6,6) circle [radius=0.1]; 251 | \draw [fill,purple,opacity=.4] (7,7) circle [radius=0.1]; 252 | \draw [fill,purple,opacity=.4] (8,8) circle [radius=0.1]; 253 | \draw [fill,purple,opacity=.4] (9,9) circle [radius=0.1]; 254 | 255 | \draw [fill,purple,opacity=.4] (1,3) circle [radius=0.1]; 256 | \draw [fill,purple,opacity=.4] (2,4) circle [radius=0.1]; 257 | \draw [fill,purple,opacity=.4] (3,5) circle [radius=0.1]; 258 | \draw [fill,purple,opacity=.4] (4,6) circle [radius=0.1]; 259 | \draw [fill,purple,opacity=.4] (5,7) circle [radius=0.1]; 260 | \draw [fill,purple,opacity=.4] (6,8) circle [radius=0.1]; 261 | \draw [fill,purple,opacity=.4] (7,9) circle [radius=0.1]; 262 | 263 | \draw [fill,purple,opacity=.4] (1,5) circle [radius=0.1]; 264 | \draw [fill,purple,opacity=.4] (2,6) circle [radius=0.1]; 265 | \draw [fill,purple,opacity=.4] (3,7) circle [radius=0.1]; 266 | \draw [fill,purple,opacity=.4] (4,8) circle [radius=0.1]; 267 | \draw [fill,purple,opacity=.4] (5,9) circle [radius=0.1]; 268 | 269 | \draw [fill,purple,opacity=.4] (1,7) circle [radius=0.1]; 270 | \draw [fill,purple,opacity=.4] (2,8) circle [radius=0.1]; 271 | \draw [fill,purple,opacity=.4] (3,9) circle [radius=0.1]; 272 | 273 | \draw [fill,purple,opacity=.4] (1,9) circle [radius=0.1]; 274 | 275 | % 276 | \draw [thick,black] [->] (11,5) -- (12,5); 277 | \node [above] at (11.5,5) {$_{LLL}$}; 278 | % 279 | 280 | \draw [lightgray] [<->] (13,5) -- (23,5); 281 | \draw [lightgray] [<->] (18,10) -- (18,0); 282 | 283 | \draw [fill,purple,opacity=.4] (22,1) circle [radius=0.1]; 284 | 285 | \draw [fill,purple,opacity=.4] (20,1) circle [radius=0.1]; 286 | \draw [fill,purple,opacity=.4] (21,2) circle [radius=0.1]; 287 | \draw [fill,purple,opacity=.4] (22,3) circle [radius=0.1]; 288 | 289 | \draw [fill,purple,opacity=.4] (18,1) circle [radius=0.1]; 290 | \draw [fill,purple,opacity=.4] (19,2) circle [radius=0.1]; 291 | \draw [fill,purple,opacity=.4] (20,3) circle [radius=0.1]; 292 | \draw [fill,purple,opacity=.4] (21,4) circle [radius=0.1]; 293 | \draw [fill,purple,opacity=.4] (22,5) circle [radius=0.1]; 294 | 295 | \draw [fill,purple,opacity=.4] (16,1) circle [radius=0.1]; 296 | \draw [fill,purple,opacity=.4] (17,2) circle [radius=0.1]; 297 | \draw [fill,purple,opacity=.4] (18,3) circle [radius=0.1]; 298 | \draw [fill,purple,opacity=.4] (19,4) circle [radius=0.1]; 299 | \draw [fill,purple,opacity=.4] (20,5) circle [radius=0.1]; 300 | \draw [fill,purple,opacity=.4] (21,6) circle [radius=0.1]; 301 | \draw [fill,purple,opacity=.4] (22,7) circle [radius=0.1]; 302 | 303 | \draw [fill,purple,opacity=.4] (14,1) circle [radius=0.1]; 304 | \draw [fill,purple,opacity=.4] (15,2) circle [radius=0.1]; 305 | \draw [fill,purple,opacity=.4] (16,3) circle [radius=0.1]; 306 | \draw [fill,purple,opacity=.4] (17,4) circle [radius=0.1]; 307 | \draw [fill,purple,opacity=.4] (18,5) circle [radius=0.1]; 308 | \draw [fill,purple,opacity=.4] (19,6) circle [radius=0.1]; 309 | \draw [fill,purple,opacity=.4] (20,7) circle [radius=0.1]; 310 | \draw [fill,purple,opacity=.4] (21,8) circle [radius=0.1]; 311 | \draw [fill,purple,opacity=.4] (22,9) circle [radius=0.1]; 312 | 313 | \draw [fill,purple,opacity=.4] (14,3) circle [radius=0.1]; 314 | \draw [fill,purple,opacity=.4] (15,4) circle [radius=0.1]; 315 | \draw [fill,purple,opacity=.4] (16,5) circle [radius=0.1]; 316 | \draw [fill,purple,opacity=.4] (17,6) circle [radius=0.1]; 317 | \draw [fill,purple,opacity=.4] (18,7) circle [radius=0.1]; 318 | \draw [fill,purple,opacity=.4] (19,8) circle [radius=0.1]; 319 | \draw [fill,purple,opacity=.4] (20,9) circle [radius=0.1]; 320 | 321 | \draw [fill,purple,opacity=.4] (14,5) circle [radius=0.1]; 322 | \draw [fill,purple,opacity=.4] (15,6) circle [radius=0.1]; 323 | \draw [fill,purple,opacity=.4] (16,7) circle [radius=0.1]; 324 | \draw [fill,purple,opacity=.4] (17,8) circle [radius=0.1]; 325 | \draw [fill,purple,opacity=.4] (18,9) circle [radius=0.1]; 326 | 327 | \draw [fill,purple,opacity=.4] (14,7) circle [radius=0.1]; 328 | \draw [fill,purple,opacity=.4] (15,8) circle [radius=0.1]; 329 | \draw [fill,purple,opacity=.4] (16,9) circle [radius=0.1]; 330 | 331 | \draw [fill,purple,opacity=.4] (14,9) circle [radius=0.1]; 332 | 333 | % vectors 334 | \draw [thick,purple] [->] (5,5) -- (7, 9); 335 | \draw [thick,purple] [->] (5,5) -- (6, 8); 336 | 337 | \draw [thick,purple] [->] (18,5) -- (19, 4); 338 | \draw [thick,purple] [->] (18,5) -- (19, 6); 339 | \end{tikzpicture}\\ 340 | 341 | We will not dig into the internals of LLL here, see Chris Peikert's course\cite{chrispeikert} for detailed explanations of the algorithm. 342 | 343 | \subsection{Wanted properties of LLL} 344 | 345 | LLL yields an approximation of the \textbf{Shortest Vector Problem}. This is useful for us because if we consider the row vectors of a lattice's basis as \textbf{coefficient vectors of polynomials}. We can find a \textbf{linear combination} of those polynomials that has \textbf{``particularly small'' coefficients}. But let's not unveil too much too soon. Here is the relevant property of a LLL reduced basis that we will need later: 346 | 347 | \begin{property} 348 | Let $L$ be a lattice of dimension $n$. In polynomial time, the LLL algorithm outputs reduced basis vectors $v_i$, for $1 \leq i \leq n$, satisfying: 349 | 350 | \[ \|v_1\| \leq \|v_2\| \leq \hdots \leq \|v_i\| \leq 2^{\frac{n(n-1)}{4(n+1-i)}} \cdot det(L)^{\frac{1}{n+1-i}} \] 351 | \end{property} 352 | 353 | We can see that we can modify the bound on our vectors by modifying the dimension and the determinant of the lattice basis. 354 | 355 | \section{Relaxed models and small roots problem}\label{attacks} 356 | 357 | Attacks on RSA falls into two categories: the attacks on the \textbf{implementation} or the \textbf{mathematical attacks}. Over the years the mathematical cryptanalysis on RSA have proven to be hard and thus the cryptosystem is still considered as secure nowadays (march 2015). But what a researcher could find interesting is to attack a \textbf{relaxed} model of the RSA problem. What if we knew ``a part'' of the message, or what if we knew ``an approximation'' of one of the prime, or what if the private exponent was ``too small''...\\ 358 | 359 | Let's imagine for an instant that Alice used RSA to encrypt the same message to 3 different people, all using the \textbf{same ``small'' public exponent} $e = 3$ as it's common to do. There is an attack, called \textbf{Håstad's Broadcast Attack}, that breaks this model.\\ 360 | 361 | \begin{center} 362 | \begin{tikzpicture}[scale=2] 363 | \tikzstyle{every node}=[draw, shape=circle, ultra thick]; 364 | \node (D) at (2,2) {Alice}; 365 | \node (A) at (0,0) {David}; 366 | \node (B) at (2,0) {Bob}; 367 | \node (C) at (4,0) {Charles}; 368 | 369 | \tikzstyle{every node}=[draw,shape=rectangle,solid,fill=white]; 370 | \draw [->,dashed] (D) -- (A) node [above right=10mm] {$m^3 \pmod{N_1}$}; 371 | \draw [->,dashed] (D) -- (B) node [above=15mm] {$m^3 \pmod{N_2}$}; 372 | \draw [->,dashed] (D) -- (C) node [above left=10mm] {$m^3 \pmod{N_3}$}; 373 | \end{tikzpicture} 374 | \end{center} 375 | 376 | \begin{align*} 377 | c_1 &= m^3 \pmod{N_1}\\ 378 | c_2 &= m^3 \pmod{N_2}\\ 379 | c_3 &= m^3 \pmod{N_3} 380 | \end{align*} 381 | 382 | Here the trick is to use the \textbf{Chinese Remainder Theorem} to create an equation modulo $N_1 \times N_2 \times N_3$: 383 | \begin{align*} 384 | m^3 = &c_1 \cdot N_2 N_3 \cdot [(N_2 N_3)^{-1} \pmod{N_1}] \\ 385 | + &c_2 \cdot N_1 N_3 \cdot [(N_1 N_3)^{-1} \pmod{N_2}] \\ 386 | + &c_3 \cdot N_1 N_2 \cdot [(N_1 N_2)^{-1} \pmod{N_3}] 387 | \pmod{N_1 N_2 N_3} 388 | \end{align*} 389 | 390 | The method is similar to \textbf{Lagrange Interpolation}. For example let me quickly explain the first term, this $m^e$ has to be equal to $c_1$ only when modulo $N_1$, so we can multiply the term $c_1$ by $N_2$ and $N_3$ so that it cancels out when modulo $N_2$ or $N_3$. But when it is modulo $N_1$ we don't want those terms, so we multiply our term by their inverse modulo $N_1$ as well. Easy no? All the variables are known so calculating $m^e \pmod{N_1 N_2 N_3}$ is straight forward. 391 | 392 | Let's notice that since $m < N_1, m < N_2, m < N_3$, we must have: 393 | 394 | \[ m \times m \times m = m^3 < N_1 \times N_2 \times N_3 \] 395 | 396 | So our $m^3$ modulo $N_1 N_2 N_3$ is actually just $m^3$ over $\mathbb{Z}$. 397 | 398 | To recover the message we just have to compute the cubic root of that big value we just calculated.\\ 399 | 400 | Generalizing it is pretty easy and let's formulate \textbf{Håstad}'s findings: 401 | 402 | \begin{theorem} 403 | If $c = m^e \pmod{N}$, then we can find $m$ in time polynomial if $|m| < N^{1/e}$. 404 | \end{theorem} 405 | 406 | That's the introduction to our ``small root'' problem. Now what about if $|m| > N^{1/e}$ but we know a part of the message $m_0$: 407 | 408 | \[ c = (m_0 + x)^e \pmod{N} \] 409 | 410 | Can we efficiently recover x? That's the question Coppersmith is answering. 411 | 412 | 413 | \section{Coppersmith}\label{coppersmith} 414 | 415 | This survey is no replacement for the original papers of Coppersmith\cite{coppersmith} and Howgrave-Graham\cite{howgrave-graham}. If you want to get a real understanding of those techniques I also advise you to read the survey from May\cite{may}. 416 | 417 | \subsection{Known modulus}\label{knownmodulus} 418 | 419 | That being said, let's dig into Coppersmith's use of LLL to crack RSA. We'll first see one of the problem it solves and build it from there.\\ 420 | Imagine that you know a part of the message: this is called the \textbf{Stereotyped Messages Attack}. For example you know that Alice always sends her messages this way: ``the password is: cupcake''. 421 | 422 | Let's say we know $m_0$ of the message $m = m_0 + x_0$. And of course we don't know $x_0$. We have \textbf{our problem} translated to the following polynomial: 423 | 424 | \[ f(x) = (m_0 + x)^e - c \text{ with } f(x_0) = 0 \pmod{N} \] 425 | 426 | Well. \textbf{Coppersmith} says we can solve this in polynomial time if $x_0$ and $e$ are small enough: 427 | 428 | \begin{theorem} 429 | Let $N$ be an integer of unknown factorization, which has a divisor $b \geq N^{\beta}$, $0 < \beta \leq 1$. Let $f(x)$ be a univariate monic polynomial of degree $\delta$ and let $c \geq 1$.\\ 430 | Then we can find in time $\mathcal{O}(c\delta^5log^9(N))$ all solutions $x_0$ of the equation 431 | 432 | \[ f(x) = 0 \pmod{b} \hspace{2mm} \text{ with } \hspace{2mm} |x_0| \leq c \cdot N^{\frac{\beta^2}{\delta}} \] 433 | \end{theorem} 434 | 435 | In our case that would mean that for $c=1$ and $\beta=1$ we could find a solution of our previous equation if $|x_0| \leq N^{\frac{1}{e}}$. And here we find something very similar to Håstad's Broadcast Attack. 436 | 437 | To find the roots of a polynomial \textbf{over a ring of integers modulo} $N$ is a very \textbf{difficult} task, whereas we possess efficient tools to find roots of polynomials \textbf{over the integers} (Berlekamp–Zassenhaus, van Hoeij, Hensel lifting...). Hence Coppersmith's intuition to look for such a polynomial: 438 | 439 | \begin{tikzpicture} 440 | \node [above] at (2,1) {$f(x_0) = 0 \pmod{N}$ with $|x_0| < X$}; 441 | \draw [<-,purple] (0,0) -- (0,1); 442 | \node [below] at (0.6,0) {$g(x_0) = 0$ over $\mathbb{Z}$}; 443 | \end{tikzpicture} 444 | 445 | 446 | But how can we go from $f$ to $g$ here? The theorem of \textbf{Howgrave-Graham} gives us a clue: 447 | 448 | \begin{theorem} 449 | Let $g(x)$ be an univariate polynomial with $n$ monomials. Further, let $m$ be a positive integer. Suppose that 450 | \setcounter{equation}{0} 451 | \begin{align} 452 | &g(x_0) = 0 \pmod{N^m} \hspace{2mm} \text{ where } \hspace{2mm} |x_0| \leq X\\ 453 | &\|g(xX)\| < \frac{_{N^m}}{^{\sqrt{n}}} 454 | \end{align} 455 | 456 | Then $g(x_0)=0$ holds over the integers. 457 | \end{theorem} 458 | 459 | What Howgrave-Graham is saying is that we need to \textbf{find a polynomial} that shares the same root as our function $f$ but modulo $N^m$ and it has to have \textbf{``small'' coefficients} so that its norm would be ``small'' as well.\\ 460 | 461 | \begin{tikzpicture} 462 | \node [above] at (2,4) {$f(x_0) = 0 \pmod{N}$ with $|x_0| < X$}; 463 | \draw [<-] (0,0) -- (0,4); 464 | \node [below] at (0.6,0) {$g(x_0) = 0$ over $\mathbb{Z}$}; 465 | \draw [purple,<-] (0,1) -- (1,1); 466 | \node [right] at (1.2,1.35) {$g(x_0) = 0 \pmod{N^m}$}; 467 | \node [right] at (1.2,.65) {$\|g(xX)\| < \frac{N^m}{\sqrt{n}}$}; 468 | \draw [purple,<-] (3,2) -- (3,4); 469 | \end{tikzpicture} 470 | 471 | Howgrave-Graham's idea is that we need to find this polynomial $g$ by \textbf{combining} polynomials who also have $x_0$ as roots. The more polynomials we can play with, the better. We will see later that it is very easy for us to create polynomials $f_i$ such that $f_i(x_0) = 0 \pmod{N^m}$. And that is the reason why we choose to find a polynomial over $N^m$ and not over $N$.\\ 472 | 473 | The \textbf{LLL reduction} has two properties that are useful to us: 474 | \begin{itemize} 475 | \item{It only does \textbf{integer linear operations} on the basis vectors} 476 | \item{The \textbf{shortest vector of the output basis is bound} (as seen in \textbf{Property 1})}\\ 477 | \end{itemize} 478 | The first point allows us to combine them to build a function that still has $x_0$ as root modulo $N^m$: 479 | 480 | \[ g(x_0) = \sum^n_{i=1}a_i\cdot f_i(x_0) = 0 \pmod{N^m}\hspace{5mm} a_i \in \mathbb{Z} \] 481 | 482 | The second point allows us to get Howgrave-Graham's second point ($\|g(xX)\| < \frac{_{b^m}}{^{\sqrt{n}}}$).\\ 483 | 484 | But first let's see how to \textbf{build the polynomials} $f_i$ (we will call them $g_{i,j}$ and $h_i$) we will build our $g(x_0) = 0$ with. Note that $\delta$ is the degree of $f$: 485 | 486 | \begin{align*} 487 | g_{i,j}(x) &= x^j \cdot N^i \cdot f^{m-i}(x) \text{ for } i = 0,\hdots,m-1,\hspace{2mm} j=0,\hdots,\delta-1\\ 488 | h_i(x) &= x^i \cdot f^m(x) \text{ for } i = 0,\hdots,t-1 489 | \end{align*} 490 | 491 | Those polynomials achieve two things: 492 | \begin{itemize} 493 | \item{they have the \textbf{same root} $x_0$ but modulo $N^m$} 494 | \item{each iteration introduce a new monomial. That allows us to build a \textbf{triangular} lattice (so that the determinant is easier to calculate)}\\ 495 | \end{itemize} 496 | 497 | If you don't understand how they have the same root $x_0$ remember that since $f(x_0) = 0 \pmod{N}$ we know that $f(x_0) = k \cdot N$\\ 498 | 499 | Now we just have to create a lattice basis with $f_i(xX)$ as row vectors (because we want them to build a polynomial $g(xX)$ to test Howgrave-Graham second point).\\ 500 | 501 | 502 | Let's take a look at the \textbf{overview} again:\\ 503 | 504 | \begin{tikzpicture} 505 | % 1 506 | \node [above right] at (.5,10) {$f(x_0) = 0 \pmod{N}$ with $|x_0| < X$}; 507 | \draw [<-] (1,0) -- (1,10); 508 | \node [below right] at (0.5,0) {$g(x_0) = 0$ over $\mathbb{Z}$}; 509 | % 2 510 | \draw [<-] (1,1) -- (1.5,1); 511 | \node [right] at (1.7,1.35) {$g(x_0) = 0 \pmod{N^m}$}; 512 | \node [right] at (1.7,.65) {$\|g(xX)\| < \frac{N^m}{\sqrt{n}}$}; 513 | \draw [<-] (3.5,2) -- (3.5,10); 514 | % new 3 515 | \draw [purple,->] (6,10) -- (6,9.5); 516 | \node [below right] at (4,9.3) {generate $f_i$ s.t. $f_i(x_0) = 0 \pmod{N^m}$}; 517 | 518 | \draw [purple,->] (6,8.6) -- (6,7.8); 519 | \node [below right] at (4,7.5) {$B = \begin{pmatrix} 520 | f_i(xX) \\ 521 | \vdots \\ 522 | f_n(xX) 523 | \end{pmatrix}$}; 524 | 525 | \draw [purple,->] (6,5.5) -- (6,4.4); 526 | \node [right] at (6.3,5) {LLL}; 527 | 528 | \node [below right] at (4,4.1) {$B' = \begin{pmatrix} 529 | b_1 = g(xX) \\ 530 | b_2\\ 531 | \vdots \\ 532 | b_n 533 | \end{pmatrix}$}; 534 | 535 | \draw [<-,purple] (3.5,3) -- (4,3); 536 | \end{tikzpicture}\\ 537 | 538 | Now the shortest vector of $B'$ (the LLL-reduced basis) should be the coefficient vector of $g(xX)$. \\ 539 | 540 | As I said earlier, the LLL reduction allows us to achieve an \textbf{upper bound} on this shortest vector: 541 | 542 | \[ \|b_1\| \leq 2^{\frac{n-1}{4}} \cdot det(L)^{\frac{1}{n}} \] 543 | 544 | And recall \textbf{Howgrave-Graham Theorem}'s second point: 545 | 546 | \[ \|b1\| = \|g(xX)\| < \frac{_{N^m}}{^{\sqrt{n}}} \] 547 | 548 | Now, to obtain Howgrave-Graham's second point on our $g$ we have to manipulate $g_{i,j}(xX)$ and $h_i(xX)$ to obtain a small enough determinant. From the previous equations we \textbf{bound the determinant}: 549 | 550 | \[ det(L) < 2^{-\frac{n(n-1)}{4}} \cdot n^{-\frac{n}{2}} \cdot N^{n \cdot m} \] 551 | 552 | The small terms can be considered as ``error terms'' to \textbf{simplify our bound}: 553 | 554 | \[ det(L) < N^{m \cdot n}\] 555 | 556 | It is from these equations that Coppersmith bounded the value of $x$ in his theorem. Now if we want to use this algorithm we will have to \textbf{tweak} $m$ and $t$ until we obtain the correct bounds. Note that the bound on the shortest vector of the reduced lattice basis is generous. That means that even if we don't correctly bound our determinant, we might find an answer. 557 | 558 | \subsection{Any modulus}\label{anymodulus} 559 | 560 | Coppersmith method is actually more general: it also works for unknown modulus.\\ 561 | We will see how the \textbf{Factoring with High Bits Known Attack} works to understand this part. Imagine the relaxed problem of RSA where we know an approximation $\tilde{p}$ of one of the prime $p$. The approximation is bounded as followed: 562 | 563 | \[ |\tilde{p} - p| < N^{\frac{1}{4}} \] 564 | 565 | Now we have an equation with one unknown, modulo another unknown: 566 | 567 | \[ \tilde{p} = x_0 \pmod{p} \] 568 | 569 | This gives us an equation $f(x) = \tilde{p} - x$ such that $f(x_0) = 0 \pmod{p}$. We can use that in the Coppersmith algorithm we have seen earlier. This is because Howgrave-Graham's theorem works for unknown modulus. Let's see this theorem again: 570 | 571 | \begin{theorem} 572 | Let $g(x)$ be an univariate polynomial with $n$ monomials. Further, let $m$ be a positive integer. Suppose that 573 | \setcounter{equation}{0} 574 | \begin{align} 575 | &g(x_0) = 0 \pmod{b^m} \hspace{2mm} \text{ where } \hspace{2mm} |x_0| \leq X\\ 576 | &\|g(xX)\| < \frac{_{b^m}}{^{\sqrt{n}}} 577 | \end{align} 578 | 579 | Then $g(x_0)=0$ holds over the integers. 580 | \end{theorem} 581 | 582 | We know we can build the $f_i$ polynomials as we did before. And here instead of bounding $\|g(xX)\|$ with $p^m$ we can bound it with $N^{\beta m}$ (since we have $p > N^\beta$ in Coppersmith Theorem). This allows us to formulate problems with unknown modulus. 583 | 584 | And now obtain a bound on the determinant: 585 | 586 | \[ det(L) < N^{m \cdot n \cdot \beta} \] 587 | 588 | \subsection{How were the bounds calculated?}\label{bounds} 589 | 590 | Let's go back from the start. Here's our new \textbf{general equation} with this time an unknown modulus $b$: 591 | 592 | \[ f(x) = (m_0 + x)^e - c = 0 \pmod{b} \] 593 | 594 | we know $m_0$, $e$, $c$, $N$ and $\beta$. We don't know $b$, and $x$. Here are the relations we know: 595 | 596 | \[ \begin{cases} 597 | b \geq N^\beta \text{, } 0 < \beta \leq 1 \\ 598 | |x_0| < X 599 | \end{cases} \] 600 | 601 | What we want is to find the \textbf{biggest possible} $X$ for which it is possible to find the root $x_0$ of this polynomial $f$. 602 | So we have to find that upperbound $X$ such that there exists $m$ and $t$ to construct a lattice basis of dimensions $n = \delta m + t$ that will yield satisfactory results after a LLL reduction. This happens if we respect \textbf{Howgrave-Graham's second point}, that we couple with our \textbf{LLL's property} to \textbf{bound the determinant}: 603 | 604 | \[ 605 | \begin{rcases} 606 | \|g(xX)\| < \frac{b^m}{\sqrt{n}}\\ 607 | \|v_1\| \leq 2^{\frac{n-1}{4}}det(L)^{\frac{1}{n}} 608 | \end{rcases} 609 | \implies 2^{\frac{n-1}{4}}det(L)^{\frac{1}{n}} < \frac{b^m}{\sqrt{n}} 610 | \] 611 | 612 | Since we don't know $b$, as I explained earlier we use $N^\beta$ instead: 613 | 614 | \[ \implies 2^{\frac{n-1}{4}}det(L)^{\frac{1}{n}} < \frac{N^{\beta m}}{\sqrt{n}} \] 615 | 616 | And here's the \textbf{determinant}: 617 | 618 | \[ det(L) = N^{\frac{1}{2}\delta m (m+1)}X^{\frac{1}{2}n(n-1)} \] 619 | 620 | We can use both equations to bound $X$ as such: 621 | 622 | 623 | \setcounter{equation}{0} 624 | \begin{eqnarray} 625 | \implies X \leq \frac{1}{2} N^{\frac{2\beta m}{n-1} - \frac{\delta m ( m + 1)}{n(n-1)}} 626 | \end{eqnarray} 627 | 628 | Earlier I said that we wanted the row vectors in our basis to be \textbf{helpful}. Meaning their highest monomial, the one appearing in the diagonal thus in the determinant, had to be less than $N^{\beta m}$. Bounding the last and highest monomial of the diagonal of the basis gives us: 629 | 630 | \begin{eqnarray} 631 | X^{n-1} < N^{\beta m} 632 | \end{eqnarray} 633 | 634 | Coppersmith's \textbf{constructive proof} showed that using $X = \frac{1}{2} N^{\frac{\beta^2}{\delta}-\epsilon}$ we could satisfy these two previous inequalities for those values: 635 | 636 | \[ \begin{cases} 637 | 0 < \epsilon \leq \frac{1}{7} \beta\\ 638 | m = \left\lfloor \frac{\beta^2}{\delta \epsilon}\right\rfloor\\ 639 | t = \left\lfloor \delta m (\frac{1}{\beta}-1)\right\rfloor\\ 640 | \end{cases} \] 641 | 642 | \subsection{Experiments}\label{coppersmith-experiments} 643 | 644 | I used Sage 6.4 in a Virtualbox with 512Mo of RAM and 1 core from an Intel i7 @ 2.30GHz. 645 | 646 | Here are the experiments for the \textbf{Stereotyped Message Attack}: 647 | 648 | \begin{center} 649 | \begin{tabular}{@{} *6c @{}} 650 | \toprule 651 | size of $x_0$ & size of $N$ & $e$ & m & t & running time \\ 652 | \midrule 653 | 100 & 512 & 3 & 3 & 0 & 0.02s\\ 654 | 200 & 1024 & 3 & 3 & 0 & 0.05s\\ 655 | \bottomrule 656 | \end{tabular} 657 | \end{center} 658 | 659 | Here are the experiments for the \textbf{Factoring with High Bits Known Attack}: 660 | 661 | \begin{center} 662 | \begin{tabular}{@{} *6c @{}} 663 | \toprule 664 | size of $|p - \tilde{p}|$ & size of $N$ & $m$ & $t$ & running time \\ 665 | \midrule 666 | 110 & 512 & 4 & 4 & 0.01s\\ 667 | 200 & 1024 & 4 & 4 & 0.03s\\ 668 | \bottomrule 669 | \end{tabular} 670 | \end{center} 671 | 672 | \section{Boneh-Durfee}\label{bonehdurfee} 673 | 674 | \subsection{Overview of the method}\label{overview} 675 | This survey is no replacement for the original papers of Boneh and Durfee\cite{bonehdurfee} and Herrmann and May\cite{herrmannmay}. 676 | 677 | We've seen how Coppersmith found a way of using lattices and the LLL algorithm to find small roots to particular univariate polynomials. What about problems that have two unknowns? Coppersmith gave an heuristic for finding roots of \textbf{bivariate polynomials} but left it at that. More recently, Boneh and Durfee have released papers on some RSA attacks that make use of the initial ideas of Coppersmith for finding small roots of bivariate polynomials. 678 | 679 | Let's introduce the problem: 680 | 681 | Boneh and Durfee are telling us we can, \textbf{most of the time} (they released a heuristic and not a theorem), successfully \textbf{factor} $\textbf{N}$ if the \textbf{private exponent $\textbf{d}$ is too small}. Precisely if $d < N^{0.292}$.\\ 682 | 683 | Recall how RSA works: 684 | \begin{align*} 685 | &e \cdot d = 1 \pmod{\varphi(N)}\\ 686 | \implies& e \cdot d = k \cdot \varphi(N) + 1\\ 687 | \implies& k \cdot \varphi(N) + 1 = 0 \pmod{e}\\ 688 | \implies& k \cdot (N + 1 - p - q) + 1 = 0 \pmod{e} 689 | \end{align*} 690 | Here the unknowns are $k$ and $(-p-q)$. We can write that problem as a polynomial with root $x_0$ and $y_0$: 691 | \[ f(x,y) = x \cdot (A + y) \text{ such that } f(x_0,y_0) = 0 \pmod{e} \] 692 | 693 | with $A = N + 1$ and $y = -p -q$.\\ 694 | 695 | Now we use \textbf{Coppersmith's heuristic for multivariate polynomials}. Coupled with \textbf{Howgrave-Graham's Theorem} for bivariate polynomials: 696 | 697 | \begin{theorem} 698 | Let $g(x)$ be an bivariate polynomial with at most $n$ monomials. Further, let $m$ be a positive integer. Suppose that 699 | \setcounter{equation}{0} 700 | \begin{align} 701 | &g(x_0,y_0) = 0 \pmod{e^m} \hspace{2mm} \text{ where } \hspace{2mm} |x_0| \leq X \text{ and } |y_0| \leq Y\\ 702 | &\|g(xX,yY)\| < \frac{_{e^m}}{^{\sqrt{n}}} 703 | \end{align} 704 | Then $g(x_0,y_0)=0$ holds over the integers.\\ 705 | \end{theorem} 706 | 707 | But the problem here is that \textbf{one polynomial is not enough} to get the roots of a bivariate equation. What we need are \textbf{two polynomials}, then we could use the \textbf{resultant} or a Gröbner basis to find the roots. 708 | 709 | Coppersmith proposed to take \textbf{the two shortest vectors}, of the LLL-reduced basis, as polynomials. Let's take a look at what it should look from a distance:\\ 710 | 711 | \begin{tikzpicture} 712 | % 1 713 | \node [above right] at (.5,10) {$f(x_0, y_0) = 0 \pmod{e}$ with $|x_0| < X$ and $|y_0| < Y$}; 714 | \draw [<-] (1,0) -- (1,10); 715 | \node [below right] at (0.5,0) {$g_1(x_0,y_0) = 0$ over $\mathbb{Z}$}; 716 | % new 1 717 | \node [below right] at (0.5,-.6) {$g_2(x_0,y_0) = 0$ over $\mathbb{Z}$}; 718 | \draw [->] (1,-1.4) -- (1,-2.1); 719 | \node [below right] at (0.5,-2.1) {$r(x) = resultant_x(g_1, g_2)$}; 720 | % 2 721 | \draw [<-] (1,1) -- (1.5,1); 722 | \node [right] at (1.7,1.35) {$g_1(x_0,y_0) = 0 \pmod{e^m}$ and $\|g_1(xX,yY)\| < \frac{e^m}{\sqrt{n}}$}; 723 | \node [right] at (1.7,.65) {$g_2(x_0,y_0) = 0 \pmod{e^m}$ and $\|g_2(xX,yY)\| < \frac{e^m}{\sqrt{n}}$}; 724 | \draw [<-] (3.5,2) -- (3.5,10); 725 | % new 3 726 | \draw [->] (6,10) -- (6,9.5); 727 | \node [below right] at (4,9.3) {generate $f_i$ s.t. $f_i(x_0,y_0) = 0 \pmod{e^m}$}; 728 | 729 | \draw [->] (6,8.6) -- (6,7.8); 730 | \node [below right] at (4,7.5) {$B = \begin{pmatrix} 731 | f_i(xX,yY) \\ 732 | \vdots \\ 733 | f_n(xX,yY) 734 | \end{pmatrix}$}; 735 | 736 | \draw [->] (6,5.5) -- (6,4.4); 737 | \node [right] at (6.3,5) {LLL}; 738 | 739 | \node [below right] at (4,4.1) {$B' = \begin{pmatrix} 740 | b_1 = g_1(xX, yY) \\ 741 | b_2 = g_2(xX, yY)\\ 742 | \vdots \\ 743 | b_n 744 | \end{pmatrix}$}; 745 | 746 | \draw [<-] (3.5,3) -- (4,3); 747 | \end{tikzpicture}\\ 748 | 749 | And once we find the root $x_0$ of $r$ we can re-inject it in $g_1$ to find $y_0$. 750 | 751 | \textbf{This doesn't always yield a solution}. For example, if the two polynomials $g_1$ and $g_2$ are not independent, the resultant will be zero.\\ 752 | 753 | \textbf{Boneh and Durfee} proposed a construction of the $f_i$ polynomials as follow: 754 | \begin{align*} 755 | \text{for } k = 0,\hdots,m&:\\ 756 | g_{i,k}(x) &= x^i \cdot f^k(x,y) \cdot e^{m-k} \text{ for } i=0,\hdots,m-k\\ 757 | h_{j,k}(x) &= y^j \cdot f^k(x,y) \cdot e^{m-k} \text{ for } j = 0,\hdots,t 758 | \end{align*} 759 | 760 | They called the $g_{i,k}$ \textbf{x-shifts} and the $h_{j,k}$ \textbf{y-shifts}.\\ 761 | 762 | By using these polynomials to build the lattice, carefully balancing the variables so that the determinant of the triangular basis doesn't exceed $e^{mn}$, Boneh and Durfee showed that LLL successfuly yielded useful results if $d < N^{0.284}$.\\ 763 | 764 | To achieve their \textbf{improved results} of $d < N^{0.292}$, they showed that using a sublattice by \textbf{ignoring some of the y-shifts}, the bounds on the shortest vectors found by LLL were improved.\\ 765 | This is because of the ``\textbf{helpful vectors}'' notion of Howgrave-Graham. A vector is helpful if his contribution to the determinant (its monomial that appears in the diagonal of the lattice basis) is less than $e^m$. Boneh and Durfee's method is to discard all y-shifts when their highest monomial exceeds $e^m$. 766 | 767 | \begin{tikzpicture}[thick,scale=0.9, every node/.style={transform shape}] 768 | \fill [purple!20!white] (-7,-.9) to (7,-.9) to (7, -1.9) to (-7,-1.9) to cycle; 769 | 770 | \node (matrix1) {$\bordermatrix{ 771 | &1 &x &xy &x^2 &x^2y &x^2y^2 &y &xy^2 &x^2y^3\cr 772 | e^2& e^2\cr 773 | xe^2& &e^2X\cr 774 | fe& e& eAX& eXY\cr 775 | x^2e^2& & & & e^2X^2\cr 776 | xfe& & eX& & eAX^2& eX^2Y\cr 777 | f^2& 1& 2AX& 2XY& A^2X^2& 2AX^2Y& X^2Y^2\cr 778 | ye^2 & & & & & & & e^2Y&\cr 779 | yfe& & & eAXY& & & & eY& eXY^2\cr 780 | yf^2& & & 2AXY& & A^2X^2Y& 2AX^2Y^2& Y& 2XY^2& X^2Y^3}$}; 781 | 782 | \node (caption1) [below =.3cm of matrix1] {Boneh-Durfee basis matrix for $m=2$, $t=1$}; 783 | 784 | \node (matrix2) [below =.5cm of caption1] {$\bordermatrix{ 785 | &1 &x &xy &x^2 &x^2y &x^2y^2 &y &xy^2 &x^2y^3\cr 786 | e^2& e^2\cr 787 | xe^2& & e^2X\cr 788 | fe& e& eAX& eXY\cr 789 | x^2e^2& & & & e^2X^2\cr 790 | xfe& & eX& & eAX^2& eX^2Y\cr 791 | f^2& 1& 2AX& 2XY& A^2X^2& 2AX^2Y& X^2Y^2\cr 792 | yf^2& & & 2AXY& & A^2X^2Y& 2AX^2Y^2& Y& 2XY^2& X^2Y^3}$}; 793 | 794 | \node (caption2) [below =.3cm of matrix2] {After removing the damaging y-shifts' coefficient vectors}; 795 | 796 | \end{tikzpicture}\\ 797 | 798 | Unfortunately by doing this we \textbf{lose the triangular structure} of the basis and evaluating the determinant of the new rectangular basis is tricky. 799 | 800 | \textbf{Boneh and Durfee} developed the notion of \textbf{Geometrically progressive matrices} to handle these non-triangular lattice basis. Later \textbf{Blömer and May} took a different approach by noticing that some of the columns could be removed without affecting the determinant too much, that allowed the lattice basis to return to a triangular structure. Both those methods are quite difficult to handle and it's more recently that \textbf{Herrmann and May} found a clever and better way:\\ 801 | 802 | The \textbf{Unravelled Linearization} technique consists in \textbf{modifying} our initial polynomial $f$. Done cleverly this will modify the $f_i$ so that after removing the y-shifts, our sublattice basis will \textbf{directly be triangular}. 803 | 804 | Herrmann and May propose to do the following \textbf{substitution} on $f$: 805 | 806 | \[ f(x,y)=\underbrace{1 + xy}_u + Ax \pmod{e} \] 807 | 808 | This leaves us with the \textbf{linear polynomial} $\bar{f}(u, x) = u + Ax$ (note the lexicographic order, $u$ before $x$) and a relation $xy = u - 1$. 809 | 810 | The x-shifts are still constructed as usual: 811 | \[ \bar{g}_{i,k}(u,x) = x^i \cdot \bar{f}^k \cdot e^{m-k} \text{ for } k = 0,\hdots,m \text{ and } i=0,\hdots,m-k \] 812 | 813 | The y-shifts are constructed the same way, but we need to apply our relation again afterward to completely perform our unravelled linearization: 814 | \[ \bar{h}_{j,k}(u,x,y) = y^j \cdot \bar{f}^k \cdot e^{m-k} \text{ for } j = 1,\hdots,t \text{ and } k=\left\lfloor\frac{m}{t}\right\rfloor\cdot j,\hdots,m \] 815 | 816 | They are \textbf{selected} with the notion of ``\textbf{increasing pattern}'' in mind, so that using the previous relation $xy = u - 1$ we end up with a \textbf{triangular} lattice basis: 817 | 818 | \begin{tikzpicture}[thick] 819 | \node [scale=1.2] (matrix3) {$\bordermatrix{ 820 | &1 &x &u &x^2 &ux &u^2 &u^2y\cr 821 | e^2& e^2\cr 822 | xe^2& &e^2X\cr 823 | \bar{f}e& & eAX& eU\cr 824 | x^2e^2& & & & e^2X^2\cr 825 | x\bar{f}e& & & & eAX^2& eUX\cr 826 | \bar{f}^2& & & & A^2X^2& 2AUX& U^2\cr 827 | y\bar{f}^2& & -A^2X& -2AU& & A^2UX& 2AU^2& U^2Y}$}; 828 | 829 | \node [below =.3cm of matrix3] {The same matrix previously, after the unravelled linearization step}; 830 | 831 | \end{tikzpicture}\\ 832 | 833 | Now that we have built a lattice basis, we have to know how we need to \textbf{bound our two shortest vectors} so that Howgrave-Graham second point is respected. From LLL's property: 834 | 835 | \[ \|v_1\| \leq \|v_2\| \leq 2^{\frac{n}{4}} \cdot det(L)^{\frac{1}{n-1}} \] 836 | 837 | We need to bound $v_1$ and $v_2$ so that they respect Howgrave-Graham's theorem second point. This is the bound we end up with on the determinant: 838 | 839 | \[ det(L) < \frac{e^{m(n-1)}}{(n2^n)^{\frac{n-1}{2}}} \] 840 | 841 | That can be reduced by removing the ``error terms'': 842 | 843 | \[ det(L) < e^{mn} \] 844 | 845 | \subsection{How was the bound on $d$ calculated?}\label{bound-boneh-durfee} 846 | 847 | Let's go back to our first equation: 848 | 849 | \[ e \cdot d = k \cdot \varphi{N} + 1 = k \cdot (N + 1 - p - q) \] 850 | 851 | Let's recap what we know: 852 | 853 | \begin{itemize} 854 | \item{$p$ and $q$ should be half the size of $N$:\\ 855 | \begin{align*} 856 | \frac{log(p)}{log(N)} \approx \frac{1}{2}\\ 857 | \implies p,q \approx N^{\frac{1}{2}} 858 | \end{align*}} 859 | \item{$e \approx N$} 860 | \item{$d < N^\delta$\\} 861 | \end{itemize} 862 | 863 | The first two are what we usually use in RSA. Our last one is the bound we are trying to define. Of course we want a $\delta$ as big as possible. Now that we have defined all these, let's go back to our previous equation and let's bound our unknowns: 864 | 865 | \[ k \cdot ( \underbrace{N + 1}_A + \underbrace{-p-q}_s) \pmod{e} \hspace{2mm} \mbox{ with } \begin{cases} |s| \approx 2N^{\frac{1}{2}} \\ 866 | |k| < \frac{N^\delta - 1}{N - 1 + 2N^{\frac{1}{2}}} 867 | \end{cases} \] 868 | 869 | $s$ should be pretty close to our prediction. But $k$? It could be way lower, this incertitude tells us we have the possibility to play with its bound. 870 | 871 | Let's note that $s >> k$ and that reducing the size of our unknown $s$ is a good idea. Notice that both $s$ and $A$ are even, that allows us to reformulate our problem with a smaller $s$: 872 | 873 | \[ f(x,y) = x \cdot ( A + y) \pmod{e} \hspace{2mm} \mbox{ with } \begin{cases} x = 2k \\ 874 | y = (-p-q)/2\\ 875 | A = (N+1)/2 876 | \end{cases} \] 877 | 878 | We can now reformulate our bounds and remove the negligible terms: 879 | 880 | \[ \begin{cases} |y| \approx N^{\frac{1}{2}}\\ 881 | |x| < 2N^\delta 882 | \end{cases}\] 883 | 884 | We do not need to bound them accurately as the LLL property on the shortest vector bound is a dramatic one. 885 | 886 | Now for our algorithm we need to fix a $m$ and a $t$ such that $dim(L) = n$. For Herrmann and May's selection of the y-shifts we need $m \geq t$ so we will write $t = \tau m$ with $\tau < 1$. 887 | 888 | Remember earlier we said that we need to bound our determinant to obtain \textbf{Howgrave-Graham's Theorem second point}, and \textbf{LLL's property} gave us this \textbf{bound}: 889 | 890 | \[ det(L) < e^{mn} \] 891 | 892 | $det(L)$ being a function of $e \approx N$, $\delta$, $m$ and $t$. The bound being a function of $e$, $m$ and $t$. 893 | 894 | from Herrmann and May's proof we end up with this formula as \textbf{determinant} (after removing negligible terms that were calculated for $m \rightarrow \infty$): 895 | 896 | \[ det(L) = X^{\frac{1}{6}m^3} Y^{\frac{\tau^2}{6}m^3} U^{(\frac{1}{6} + \frac{\tau}{3})m^3} e^{(\frac{1}{3} + \frac{\tau}{2})m^2} \] 897 | 898 | with this dimension of the lattice: 899 | 900 | \[ dim(L) = n = \left(\frac{1}{2} + \frac{\tau}{2}\right)m^2 \] 901 | 902 | We can now develop the previous bound, and we inject our $t = \tau m$: 903 | \[ X^{\frac{1+\tau}{3}m^3}Y^{\frac{(\tau +1)^2}{6}m^3} e^{(\frac{1}{3} + \frac{\tau}{6})m^3} < e^{(\frac{1}{2} + \frac{\tau}{2})m^2} \text{ for } m \rightarrow \infty \] 904 | 905 | We then inject $X = e^\delta$ and $Y = e^{\frac{1}{2}}$ (since we said $e \approx N$) in our equation: 906 | \[ (e^\delta)^{\frac{1+\tau}{3}m^3} 907 | (e^{\frac{1}{2}})^{\frac{(\tau+1)^2}{6} m^3} 908 | e^{(\frac{\tau+2}{6})m^3} < e^{\frac{1+\tau}{2}m^2} \] 909 | 910 | Boneh and Durfee derived an optimized value of $\tau = (1 - 2\delta)$ that simplifies the inequality to: 911 | 912 | \[ -\frac{1}{3}\delta^2 + \frac{2}{3} \delta -\frac{1}{6} < 0 \] 913 | 914 | And thus can be derived the \textbf{Boneh-Durfee bound}: 915 | 916 | \[ \delta < \frac{1}{2} (2 - \sqrt{2}) \approx 0.292 \] 917 | 918 | \subsection{Experiments}\label{boneh-durfee-experiments} 919 | 920 | My experiments were far from Boneh and Durfee's. When they took hours to solve for small $m$ and $t$, I took seconds. This is mostly due to the gap of computation power and LLL's implementation between 1999 and now (2015): I used Sage 6.4 in a Virtualbox with 512Mo of RAM and 1 core from an Intel i7 @ 2.30GHz. I found out that in practice, the bound of $X$ was often way higher than the root $x_0$, decreasing $X$ until the algorithm worked was a good way to find the roots.\\ 921 | I also found out that increasing $m$ (and $t$) would increase the running time of LLL way too much, thus our equation calculated for $m \rightarrow \infty$ didn't work for practical small values $m$ and $t$. 922 | 923 | \begin{center} 924 | \begin{tabular}{@{} *7c @{}} 925 | \toprule 926 | $\delta$ & size of $N$ (bits) & size of $d$ (bits) & m & t & dim(L) & running time \\ 927 | \midrule 928 | 0.25 & 2048 & 512 & 3 & 1 & 11 & 0.5s\\ 929 | 0.26 & 2048 & 532 & 3 & 1 & 11 & 1.9s \\ 930 | 0.27 & 2048 & 553 & 6 & 2 & 33 & 2m 27s \\ 931 | \bottomrule 932 | \end{tabular} 933 | \end{center} 934 | 935 | \section{Summary} 936 | 937 | Boneh and Durfee were the last ones to improve the bound on the low private exponent problem. At the end of their paper they claimed that ``a bound of $d