31.7 The RSA public-key cryptosystem
31.7-1¶
Consider an RSA key set with $p = 11$, $q = 29$, $n = 319$, and $e = 3$. What value of $d$ should be used in the secret key? What is the encryption of the message $M = 100$?
$\phi(n) = (p - 1) \cdot (q - 1) = 280$.
$d = e^{-1} \mod \phi(n) = 187$.
$P(M) = M^e \mod n = 254$.
$S(C) = C^d \mod n = 254^{187} \mod n = 100$.
31.7-2¶
Prove that if Alice's public exponent $e$ is $3$ and an adversary obtains Alice's secret exponent $d$, where $0 < d < \phi(n)$, then the adversary can factor Alice's modulus $n$ in time polynomial in the number of bits in $n$. (Although you are not asked to prove it, you may be interested to know that this result remains true even if the condition $e = 3$ is removed. See Miller [255].)
$$ed \equiv 1 \mod \phi(n)$$
$$ed - 1 = 3d - 1 = k \phi(n)$$
If $p, q < n / 4$, then
$$\phi(n) = n - (p + q) + 1 > n - n / 2 + 1 = n / 2 + 1 > n / 2.$$
$kn / 2 < 3d - 1 < 3d < 3n$, then $k < 6$, then we can solve $3d - 1 = n - p - n / p + 1$.
31.7-3 $\star$¶
Prove that RSA is multiplicative in the sense that
$P_A(M_1) P_A(M_2) \equiv P_A(M_1, M_2) \pmod n$.
Use this fact to prove that if an adversary had a procedure that could efficiently decrypt $1$ percent of messages from $\mathbb Z_n$ encrypted with $P_A$, then he could employ a probabilistic algorithm to decrypt every message encrypted with $P_A$ with high probability.
Multiplicative: $e$ is relatively prime to $n$.
Decrypt: In each iteration randomly choose a prime number $m$ that $m$ is relatively prime to $n$, if we can decrypt $m \cdot M$, then we can return $m^{-1}M$ since $m^{-1} = m^{n - 2}$.