Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Not that the author claimed it to be safe, but this probably isn't secure:

https://rjlipton.wordpress.com/2012/03/01/do-gaps-between-pr...

The technique relies on starting a search for one of the prime factors of the modulus at a particular (large) place, although if I understand the code right, not a place related to the other factor, so maybe it's not devastating, or who knows. That article is still very worth reading. :)



It does say "stupid" right there in the title :-)

The article about prime gaps is interesting, thanks for sharing.

There's a paper[0] that appears to use a very similar technique to achieve an RSA backdoor, however I don't have access to the full article. From the excerpt[1] I was able to find (just now - I wrote the code quite a while ago) they appear to choose p, randomly generate n with data spliced in the top half of the modulus, and find an acceptable q. The paper seems to argue the scheme is secure against those who don't have the backdoor key, but there are some pages hidden in the middle of that.

0. http://link.springer.com/chapter/10.1007%2F11693383_9

1. https://books.google.com/books?id=skYDCAAAQBAJ&pg=PA128&lpg=...


This technique is quite old, actually, and has historically been used to compress RSA keys. It is perfectly safe, provided you don't have access to the original modulus (the intuition here is that if p is chosen uniformly at random, then next_prime(n/p) will also be (almost) uniformly distributed). Other techniques exist that permit to embed information about d or p inside the modulus (e.g. [7]), but those don't apply in this case.

The first appearance of this technique was in [1, §2.1]. Later, Vanstone and Zucherato reinvented and also tried to patent it [2, 3]. Lenstra also joined in [4]. Bernstein and Coppersmith suggested a method, based on lattice reduction, that reduces RSA keys to up to 1/3 of their size [5]. Joye [6] describes a method achieving this without explicitly using lattice reduction.

[1] http://link.springer.com/chapter/10.1007%2F3-540-46877-3_42

[2] http://link.springer.com/article/10.1007/BF00190758

[3] http://patents.justia.com/patent/6134325

[4] http://link.springer.com/chapter/10.1007%2F3-540-49649-1_1

[5] http://cr.yp.to/sigs/key.html

[6] http://joye.site88.net/papers/Joy08rsacompr.pdf

[7] https://eprint.iacr.org/2002/183




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: