On an attack on RSA with small CRT-exponents  

作　　者：HAN LiDong 1,2 , WANG XiaoYun 3 & XU GuangWu 3,4 1 Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan 250100, China 2 School of Mathematics, Shandong University, Jinan 250100, China 3 Institute for Advanced Study, Tsinghua University, Beijing 100084, China 4 Department of Electrical Engineering and Computer Science, University of Wisconsin-Milwaukee, Milwaukee, WI 53201, USA 

出　　处：《Science China(Information Sciences)》2010年第8期1511-1518,共8页中国科学（信息科学）（英文版）

基　　金：supported by the National Natural Science Foundation of China (Grant No. 60910118);the National Basic Research Program of China (Grant No. 2007CB807902);Tsinghua University Initiative Scientific Research Program (Grant No. 2009THZ01002)

摘　　要：This paper concerns the RSA system with private CRT-exponents. Since Chinese remainder rep- resentation provides efficiency in computation, such system is of some practical significance. In this paper, an existing attack to small private CRT-exponents is analyzed. It is indicated that this attack makes nice use of lattice in RSA analysis, but some argument does not hold in general. Several counterexamples are constructed. Refinements and more precise statements of the attack are given.This paper concerns the RSA system with private CRT-exponents. Since Chinese remainder rep- resentation provides efficiency in computation, such system is of some practical significance. In this paper, an existing attack to small private CRT-exponents is analyzed. It is indicated that this attack makes nice use of lattice in RSA analysis, but some argument does not hold in general. Several counterexamples are constructed. Refinements and more precise statements of the attack are given.

关 键 词：RSA CRT CRYPTANALYSIS continued fraction lattice reduction 

分 类 号：TN918.1[电子电信—通信与信息系统]