Search

The Rivest-Shamir-Adleman (RSA) algorithm is a widely utilized technique in asymmetric cryptography, primarily for verifying digital signatures and encrypting messages. Its security relies on the integer factorization problem's difficulty, which is computationally infeasible with large security parameters. However, this study revealed scenarios where an attacker can concurrently factorize multiple RSA moduli $ N_i = p_i q_i $ under specific conditions. The attack is feasible when the attacker possesses a set of RSA key pairs with certain flaws, allowing each $ N_i $ to be factored in polynomial time. We identified vulnerabilities in RSA keys that satisfy particular equations by applying Diophantine approximation and Coppersmith's lattice-based technique. For instance, the study demonstrates that if RSA public exponents $ e_i $ and moduli $ N_i $ adhere to $ e_i r - (N_i - p_i - q_i + u_i) s_i = t_i $, where $ r, s_i, u_i $, and $ t_i $ are small integers, then all $ N_i $ can be factorized simultaneously. Additionally, another vulnerability arises when RSA parameters satisfy $ e_i r_i - s(N_i - p_i - q_i + u_i) = t_i $, enabling concurrent factorization with small integers $ s, r_i, u_i $, and $ t_i $. This research expands the understanding of RSA security by identifying specific conditions under which RSA public-key pairs can be compromised. These findings are relevant to the broader field of cryptography and the ongoing efforts to secure communication systems against sophisticated adversaries.

RSA stands as a widely adopted method within asymmetric cryptography, commonly applied for digital signature validation and message encryption. The security of RSA relies on the challenge of integer factorization, a problem considered either computationally infeasible or highly intricate, especially when dealing with sufficiently large security parameters. Effective exploits of the integer factorization problem in RSA can allow an adversary to assume the identity of the key holder and decrypt such confidential messages. The keys employed in secure hardware are particularly significant due to the typically greater value of the information they safeguard, such as in the context of securing payment transactions. In general, RSA faces various attacks exploiting weaknesses in its key equations. This paper introduces a new vulnerability that enables the concurrent factorization of multiple RSA moduli. By working with pairs (Ni,ei) and a fixed value y satisfying the Diophantine equation eixi2−y2ϕ(Ni)=zi, we successfully factorized these moduli simultaneously using the lattice basis reduction technique. Notably, our research expands the scope of RSA decryption exponents considered as insecure.

In 1999, the Polynomial Reconstruction Problem (PRP) was put forward as a new hard mathematics problem. A univariate PRP scheme by Augot and Finiasz was introduced at Eurocrypt in 2003, and this cryptosystem was fully cryptanalyzed in 2004. In 2013, a bivariate PRP cryptosystem was developed, which is a modified version of Augot and Finiasz's original work. This study describes a decryption failure that can occur in both cryptosystems. We demonstrate that when the error has a weight greater than the number of monomials in a secret polynomial, p, decryption failure can occur. The result of this study also determines the upper bound that should be applied to avoid decryption failure.

In recent research, Durandal, a signature scheme based on rank metrics following Schnorr's approach, was introduced to conceal secret key information by selectively manipulating the vector subspace of signatures. Later, an enhancement, namely the SHMW signature scheme, with smaller keys and signatures while maintaining EUF-CMA security, was proposed. Both Durandal and SHMW require adversaries to solve hard problems (i.e., Rank Support Learning, Rank Syndrome Decoding, and Affine Rank Syndrome Decoding) for secret key retrieval, in which the parameters are designed to withstand at least 128-bit computational complexity. The authors claimed that the security of the SHMW scheme is deemed superior to that of the original Durandal scheme. In this paper, we introduce a novel approach to identifying weak keys within the Durandal framework to prove the superiority of the SHMW scheme. This approach exploits the extra information in the signature to compute an intersection space that contains the secret key. Consequently, a cryptanalysis of the SHMW signature scheme was carried out to demonstrate the insecurity of the selected keys within the SHWM scheme. In particular, we proposed an algorithm to recover an extended support that contains the secret key used in the signature schemes. Applying our approach to the SHMW scheme, we can recover its secret key with only 97-bit complexity, although it was claimed that the proposed parameters achieve a 128-bit security level. The results of our proposed approaches show that the security level of the SHMW signature scheme is inferior compared to that of the original Durandal scheme.

Abstract Since the first coronavirus disease 2019 (COVID-19) outbreak appeared in Wuhan, mainland China on December 31, 2019, the geographical spread of the epidemic was swift. Malaysia is one of the countries that were hit substantially by the outbreak, particularly in the second wave. This study aims to simulate the infectious trend and trajectory of COVID-19 to understand the severity of the disease and determine the approximate number of days required for the trend to decline. The number of confirmed positive infectious cases [as reported by Ministry of Health, Malaysia (MOH)] were used from January 25, 2020 to March 31, 2020. This study simulated the infectious count for the same duration to assess the predictive capability of the Susceptible-Infectious-Recovered (SIR) model. The same model was used to project the simulation trajectory of confirmed positive infectious cases for 80 days from the beginning of the outbreak and extended the trajectory for another 30 days to obtain an overall picture of the severity of the disease in Malaysia. The transmission rate, β also been utilized to predict the cumulative number of infectious individuals. Using the SIR model, the simulated infectious cases count obtained was not far from the actual count. The simulated trend was able to mimic the actual count and capture the actual spikes approximately. The infectious trajectory simulation for 80 days and the extended trajectory for 110 days depicts that the inclining trend has peaked and ended and will decline towards late April 2020. Furthermore, the predicted cumulative number of infectious individuals tallies with the preparations undertaken by the MOH. The simulation indicates the severity of COVID-19 disease in Malaysia, suggesting a peak of infectiousness in mid-March 2020 and a probable decline in late April 2020. Overall, the study findings indicate that outbreak control measures such as the Movement Control Order (MCO), social distancing and increased hygienic awareness is needed to control the transmission of the outbreak in Malaysia.

Let N = pq be an RSA modulus where p and q are primes not necessarily of the same bit size. Previous cryptanalysis results on the difficulty of factoring the public modulus N = pq deployed on variants of RSA cryptosystem are revisited. Each of these variants share a common key relation utilizing the modified Euler quotient (p2 - 1)(q2 - 1), given by the key relation ed - k(p2 - 1)(q2 - 1) = 1 where e and d are the public and private keys respectively. By conducting continuous midpoint subdivision analysis upon an interval containing (p2 - 1)(q2 - 1) together with continued fractions on the key relation, we increase the security bound for d exponentially.

The Polynomial Reconstruction Problem (PRP) was introduced in 1999 as a new hard problem in post-quantum cryptography. Augot and Finiasz were the first to design a cryptographic system based on a univariate PRP, which was published at Eurocrypt 2003 and was broken in 2004. In 2013, a bivariate PRP was proposed. The design is a modified version of Augot and Finiasz’s design. Our strategic method, comprising the modified Berlekamp–Welch algorithm and Coron strategies, allowed us to obtain certain secret parameters of the bivariate PRP. This finding resulted in us concluding that the bivariate PRP is not secure against Indistinguishable Chosen-Plaintext Attack (IND-CPA).

The identification protocol is a type of zero-knowledge proof. One party (the prover) needs to prove his identity to another party (the verifier) without revealing the secret key to the verifier. One can apply the Fiat–Shamir transformation to convert an identification scheme into a signature scheme which can be used for achieving security purposes and cryptographic purposes, especially for authentication. In this paper, we recall an identification protocol, namely the RankID scheme, and show that the scheme is incorrect and insecure. Then, we proposed a more natural approach to construct the rank version of the AGS identification protocol and show that our construction overcomes the security flaws in the RankID scheme. Our proposal achieves better results when comparing the public key size, secret key size, and signature size with the existing identification schemes, such as Rank RVDC and Rank CVE schemes. Our proposal also achieves 90%, 50%, and 96% reduction for the signature size, secret key size, and public key size when compared to the Rank CVE signature scheme.

A rogue certificate authority (RCA) is a dishonest entity that has the trust of web browsers and users to produce valid key pairs which are vulnerable. This work analyses two acknowledged post-quantum secure Multivariate Quadratic Problem (MQP) based signature schemes, namely the UOV and Rainbow signature schemes that obtain their key pair from a potential RCA methodology. We revisit two and provide a novel RCA methodology that would enable adversaries to forge UOV and Rainbow signatures. We also lay out two strategies to identify whether the public parameters are generated by the first two methodologies. To this end, strategies to identify the third strategy remain elusive. As such, the UOV and Rainbow schemes remain vulnerable to forgery if it was forged via the third methodology.

The invention in 1978 of the first practical asymmetric cryptosystem known as RSA was a breakthrough within the long history of secret communications. Since its inception, the RSA cryptosystem has become embedded in millions of digital applications with the objectives of ensuring confidentiality, integrity, authenticity, and disallowing repudiation. However, the generation of the RSA modulus, N=pq which requires p and q to be random primes, may accidentally entail the choice of a special type of prime called a near-square prime. This structure of N may be used unknowingly en masse in real-world applications since no current cryptographic implementation prevents its generation. In this study, we show that use of this type of prime will potentially lead to total destruction of RSA. We present three cases of near-square primes used as RSA primes, set in the form of (i) N=pq=(am−ra)(bm−rb); (ii) N=pq=(am+ra)(bm−rb); and (iii) N=pq=(am−ra)(bm+rb). Although (ii) and (iii) are quite similar, p and q must be within the same size range of n-bits, which results in different conditions for both cases. We formulate attacks using three different algorithms to better understand their feasibility. We also provide an efficient countermeasure that it is recommended is adopted by current cryptographic libraries with RSA implementation.

Symmetric cryptography allows faster and more secure communication between two entities using the identical pre-established secret key. However, identifying the honest entity with the same secret key before initiating symmetric encryption is vital since the communication may be impersonated. Tea and Ariffin, in 2014, proposed a new identification (ID) scheme based on the Bivariate Function Hard Problem (BFHP) that proved secure against impersonation under passive, active and concurrent attacks via the BFHP-hardness assumption. In this paper, we upgrade the ID scheme and improve some of its settings. Next, we provide the security proof against impersonation under active and concurrent attacks in the random oracle model via the hardness assumption of the One-More BFHP. Finally, we include an additional discussion about the computational efficiency of the upgraded ID scheme based on BFHP and present its comparison with other selected ID schemes.

Rogue certificate authorities (RCA) are third-party entities that intentionally produce key pairs that satisfy publicly known security requirements but contain weaknesses only known to the RCA. This work analyses the Murru–Saettone RSA variant scheme that obtains its key pair from a potential RCA methodology. The Murru–Saettone scheme is based on the cubic Pell equation x3+ry3+r2z3−3rxyz=1. The public, e, and private, d key generation process uses the secret parameter ψ=(p2+p+1)(q2+q+1) in place of the standard Euler–phi function ϕ(N)=(p−1)(q−1), where ed≡1(modψ). We prove that, upon obtaining an approximation of ψ, we are able to identify the provided key pair that was maliciously provided even if the private key d size is approximate to ψ. In fact, we are able to factor the modulus N=pq.

This paper presents a cryptanalytic approach on the variants of the RSA which utilizes the modulus N = p2q where p and q are balanced large primes. Suppose [Formula: see text] satisfying gcd(e, ϕ(N)) = 1 where ϕ(N) = p(p - 1)(q - 1) and d < Nδ be its multiplicative inverse. From ed - kϕ(N) = 1, by utilizing the extended strategy of Jochemsz and May, our attack works when the primes share a known amount of Least Significant Bits(LSBs). This is achievable since we obtain the small roots of our specially constructed integer polynomial which leads to the factorization of N. More specifically we show that N can be factored when the bound [Formula: see text]. Our attack enhances the bound of some former attacks upon N = p2q.

The modulus of type N=p2q is often used in many variants of factoring-based cryptosystems due to its ability to fasten the decryption process. Faster decryption is suitable for securing small devices in the Internet of Things (IoT) environment or securing fast-forwarding encryption services used in mobile applications. Taking this into account, the security analysis of such modulus is indeed paramount. This paper presents two cryptanalyses that use new enabling conditions to factor the modulus N=p2q of the factoring-based cryptosystem. The first cryptanalysis considers a single user with a public key pair (e,N) related via an arbitrary relation to equation er−(Ns+t)=αp2+βq2, where r,s,t are unknown parameters. The second cryptanalysis considers two distinct cases in the situation of k-users (i.e., multiple users) for k≥2, given the instances of (Ni,ei) where i=1,…,k. By using the lattice basis reduction algorithm for solving simultaneous Diophantine approximation, the k-instances of (Ni,ei) can be successfully factored in polynomial time.

Boneh et al. introduced mediated RSA (mRSA) in 2001 in an attempt to achieve faster key revocation for medium-sized organizations via the involvement of a security mediator (SEM) as a semi-trusted third party to provide partial ciphertext decryption for the receiver. In this paper, a pairing-free security mediated encryption scheme based on an ElGamal variant is proposed. The scheme features a similar setting as in the mediated RSA but with a different underlying primitive. We show that the proposed security mediated encryption scheme is secure indistinguishably against chosen-ciphertext attack (IND-CCA) in the random oracle via the hardness assumption of the computational Diffie-Hellman (CDH) problem.

Fermat’s Factoring Algorithm (FFA) is an integer factorisation methods factoring the modulus N using exhaustive search. The appearance of the Estimated Prime Factor (EPF) method reduces the cost of FFA’s loop count. However, the EPF does not work for balanced primes. This paper proposed the modified Fermat’s Factoring Algorithm 1-Estimated Prime Factor (mFFA1-EPF) that improves the EPF method. The algorithm works for factoring a modulus with unbalanced and balanced primes, respectively. The main results of mFFA1-EPF focused on three criteria: (i) the approach to select good candidates from a list of convergent continued fraction, (ii) the establishment of new potential initial values based on EPF, and (iii) the application of the above modification upon FFA. The resulting study shows the significant improvement that reduces the loop count of FFA1 via (improved) EPF compared to existing methods. The proposed algorithm can be executed without failure and caters for both the modulus N with unbalanced and balanced primes factor. The algorithm works for factoring a modulus with unbalanced and balanced primes.

This paper describes an attack on the Rivest, Shamir and Adleman (RSA) cryptosystem utilizing the modulus N=p2q where p and q are two large balanced primes. Let e1,e2

The CRT-RSA cryptosystem is the most widely adopted RSA variant in digital applications. It exploits the properties of the Chinese remainder theorem (CRT) to elegantly reduce the size of the private keys. This significantly increases the efficiency of the RSA decryption algorithm. Nevertheless, an attack on RSA may also be applied to this RSA variant. One of the attacks is called partially known private key attack, that relies on the assumption that the adversary has knowledge of partial bits regarding RSA private keys. In this paper, we mount this type of attack on CRT-RSA. By using partial most significant bits (MSBs) of one of the RSA primes, p or q and its corresponding private exponent, d, we obtain an RSA intermediate. The intermediate is derived from p−1 and RSA public key, e. The analytical and novel reason on the success of our attack is that once the adversary has obtained the parameters: approximation of private exponent d˜p, approximation of p, p˜ and the public exponent e where d˜p,p˜,e=Nα/2 where 0<α≤1/4 such that |dp−d˜p|,|p−p˜|

The present work introduces an analysis framework to comprehend the dynamics of a 3D plasma model, which has been proposed to describe the pellet injection in tokamaks. The analysis of the system reveals the existence of a complex transition from transient chaos to steady periodic behavior. Additionally, without adding any kind of forcing term or controllers, we demonstrate that the system can be changed to become a multi-stable model by injecting more power input. In this regard, we observe that increasing the power input can fluctuate the numerical solution of the system from coexisting symmetric chaotic attractors to the coexistence of infinitely many quasi-periodic attractors. Besides that, complexity analyses based on Sample entropy are conducted, and they show that boosting power input spreads the trajectory to occupy a larger range in the phase space, thus enhancing the time series to be more complex and random. Therefore, our analysis could be important to further understand the dynamics of such models, and it can demonstrate the possibility of applying this system for generating pseudorandom sequences.

Asymmetric key cryptosystem is a vital element in securing our communication in cyberspace. It encrypts our transmitting data and authenticates the originality and integrity of the data. The Rivest–Shamir–Adleman (RSA) cryptosystem is highly regarded as one of the most deployed public-key cryptosystem today. Previous attacks on the cryptosystem focus on the effort to weaken the hardness of integer factorization problem, embedded in the RSA modulus, N = p q . The adversary used several assumptions to enable the attacks. For examples, p and q which satisfy Pollard’s weak primes structures and partial knowledge of least significant bits (LSBs) of p and q can cause N to be factored in polynomial time, thus breaking the security of RSA. In this paper, we heavily utilized both assumptions. First, we assume that p and q satisfy specific structures where p = a m + r p and q = b m + r q for a , b are positive integers and m is a positive even number. Second, we assume that the bits of r p and r q are the known LSBs of p and q respectively. In our analysis, we have successfully factored N in polynomial time using both assumptions. We also counted the number of primes that are affected by our attack. Based on the result, it may poses a great danger to the users of RSA if no countermeasure being developed to resist our attack.

A commuting graph is a graph denoted by C ( G , X ) where G is any group and X, a subset of a group G, is a set of vertices for C ( G , X ) . Two distinct vertices, x , y ∈ X , will be connected by an edge if the commutativity property is satisfied or x y = y x . This study presents results for the connectivity of C ( G , X ) when G is a symmetric group of degree n, Sym ( n ) , and X is a conjugacy class of elements of order three in G.

This paper presents new short decryption exponent attacks on RSA, which successfully leads to the factorization of RSA modulus N = p q in polynomial time. The paper has two parts. In the first part, we report the usage of the small prime difference method of the form | b 2 p − a 2 q | < N γ where the ratio of q p is close to b 2 a 2 , which yields a bound d < 3 2 N 3 4 − γ from the convergents of the continued fraction expansion of e N − ⌈ a 2 + b 2 a b N ⌉ + 1 . The second part of the paper reports four cryptanalytic attacks on t instances of RSA moduli N s = p s q s for s = 1 , 2 , … , t where we use N − ⌈ a 2 + b 2 a b N ⌉ + 1 as an approximation of ϕ ( N ) satisfying generalized key equations of the shape e s d − k s ϕ ( N s ) = 1 , e s d s − k ϕ ( N s ) = 1 , e s d − k s ϕ ( N s ) = z s , and e s d s − k ϕ ( N s ) = z s for unknown positive integers d , k s , d s , k s , and z s , where we establish that t RSA moduli can be simultaneously factored in polynomial time using combinations of simultaneous Diophantine approximations and lattice basis reduction methods. In all the reported attacks, we have found an improved short secret exponent bound, which is considered to be better than some bounds as reported in the literature.