Partial key exposure attacks on Prime Power RSA with non-consecutive blocks

Abstract

Partial key exposure attacks pose a significant threat to RSA-type cryptosystems. These attacks factorize the RSA modulus by utilizing partial knowledge of the decryption exponent, which is typically revealed by side-channel attacks, cold boot attacks, etc. Such partial information is often located in non-consecutive blocks. However, the majority of the proposed attacks on Prime Power RSA have only considered a single unexposed block. Meanwhile, related attacks are incapable of being expanded to multiple unexposed blocks or achieving optimal results.

In this paper, we propose partial key exposure attacks on Prime Power RSA modulus $N=p^r{q}^l$ with n unknown blocks, where $n\ge 2$. We reduce this extended attack to solving multivariate linear modular equations and apply lattice-based approaches, including Herrmann-May's method (ASIACRYPT'08), Takayasu-Kunihiro's method (ACISP'13), and Lu-Zhang-Peng-Lin's method (ASIACRYPT'15), to solve them. Furthermore, we improve Lu et al.'s method by adding helpful polynomials and removing unhelpful polynomials to construct a better lattice basis. We also extend Lu et al.'s method by introducing a new parameter to make the lattice basis construction more flexible. Our improved and extended methods can be used for attacks when $l=1$ and $l\ge 1$, respectively. These new attacks require less partial information than previous methods. For example, in the case where $n=2$, we reduce the amount of partial information needed from 80.7% to 77.8% when $r=2,l=1$, and from 64.0% to 44.9% when $r=3,l=2$.