When e -th Roots Become Easier Than Factoring
Identifieur interne : 001E45 ( Istex/Corpus ); précédent : 001E44; suivant : 001E46When e -th Roots Become Easier Than Factoring
Auteurs : Antoine Joux ; David Naccache ; Emmanuel ThoméSource :
- Lecture Notes in Computer Science [ 0302-9743 ]
Url:
DOI: 10.1007/978-3-540-76900-2_2
Links to Exploration step
ISTEX:8383FDD278EBA5154BA21EE18C7E15B9443671E3Le document en format XML
<record><TEI wicri:istexFullTextTei="biblStruct"><teiHeader><fileDesc><titleStmt><title xml:lang="en">When e -th Roots Become Easier Than Factoring</title><author><name sortKey="Joux, Antoine" sort="Joux, Antoine" uniqKey="Joux A" first="Antoine" last="Joux">Antoine Joux</name><affiliation><mods:affiliation>DGA and Université de Versailles, UVSQ PRISM 45 avenue des États-Unis, F-78035 Versailles CEDEX, France</mods:affiliation></affiliation><affiliation><mods:affiliation>E-mail: antoine.joux@m4x.org</mods:affiliation></affiliation></author><author><name sortKey="Naccache, David" sort="Naccache, David" uniqKey="Naccache D" first="David" last="Naccache">David Naccache</name><affiliation><mods:affiliation>École normale supérieure, Équipe de cryptographie, 45 rue d’Ulm, F-75230 Paris CEDEX 05, France</mods:affiliation></affiliation><affiliation><mods:affiliation>E-mail: david.naccache@ens.fr</mods:affiliation></affiliation></author><author><name sortKey="Thome, Emmanuel" sort="Thome, Emmanuel" uniqKey="Thome E" first="Emmanuel" last="Thomé">Emmanuel Thomé</name><affiliation><mods:affiliation>INRIA Lorraine, LORIA, CACAO – bâtiment A, 615 rue du Jardin botanique, F-54602 Villiers-lès-Nancy CEDEX, France</mods:affiliation></affiliation><affiliation><mods:affiliation>E-mail: emmanuel.thome@normalesup.org</mods:affiliation></affiliation></author></titleStmt><publicationStmt><idno type="wicri:source">ISTEX</idno><idno type="RBID">ISTEX:8383FDD278EBA5154BA21EE18C7E15B9443671E3</idno><date when="2007" year="2007">2007</date><idno type="doi">10.1007/978-3-540-76900-2_2</idno><idno type="url">https://api.istex.fr/ark:/67375/HCB-1NT6B82D-Z/fulltext.pdf</idno><idno type="wicri:Area/Istex/Corpus">001E45</idno><idno type="wicri:explorRef" wicri:stream="Istex" wicri:step="Corpus" wicri:corpus="ISTEX">001E45</idno></publicationStmt><sourceDesc><biblStruct><analytic><title level="a" type="main" xml:lang="en">When <hi rend="italic">e</hi>-th Roots Become Easier Than Factoring</title><author><name sortKey="Joux, Antoine" sort="Joux, Antoine" uniqKey="Joux A" first="Antoine" last="Joux">Antoine Joux</name><affiliation><mods:affiliation>DGA and Université de Versailles, UVSQ PRISM 45 avenue des États-Unis, F-78035 Versailles CEDEX, France</mods:affiliation></affiliation><affiliation><mods:affiliation>E-mail: antoine.joux@m4x.org</mods:affiliation></affiliation></author><author><name sortKey="Naccache, David" sort="Naccache, David" uniqKey="Naccache D" first="David" last="Naccache">David Naccache</name><affiliation><mods:affiliation>École normale supérieure, Équipe de cryptographie, 45 rue d’Ulm, F-75230 Paris CEDEX 05, France</mods:affiliation></affiliation><affiliation><mods:affiliation>E-mail: david.naccache@ens.fr</mods:affiliation></affiliation></author><author><name sortKey="Thome, Emmanuel" sort="Thome, Emmanuel" uniqKey="Thome E" first="Emmanuel" last="Thomé">Emmanuel Thomé</name><affiliation><mods:affiliation>INRIA Lorraine, LORIA, CACAO – bâtiment A, 615 rue du Jardin botanique, F-54602 Villiers-lès-Nancy CEDEX, France</mods:affiliation></affiliation><affiliation><mods:affiliation>E-mail: emmanuel.thome@normalesup.org</mods:affiliation></affiliation></author></analytic><monogr></monogr><series><title level="s" type="main" xml:lang="en">Lecture Notes in Computer Science</title><idno type="ISSN">0302-9743</idno><idno type="eISSN">1611-3349</idno><idno type="ISSN">0302-9743</idno></series></biblStruct></sourceDesc><seriesStmt><idno type="ISSN">0302-9743</idno></seriesStmt></fileDesc><profileDesc><textClass></textClass></profileDesc></teiHeader></TEI><istex><corpusName>springer-ebooks</corpusName><author><json:item><name>Antoine Joux</name><affiliations><json:string>DGA and Université de Versailles, UVSQ PRISM 45 avenue des États-Unis, F-78035 Versailles CEDEX, France</json:string><json:string>E-mail: antoine.joux@m4x.org</json:string></affiliations></json:item><json:item><name>David Naccache</name><affiliations><json:string>École normale supérieure, Équipe de cryptographie, 45 rue d’Ulm, F-75230 Paris CEDEX 05, France</json:string><json:string>E-mail: david.naccache@ens.fr</json:string></affiliations></json:item><json:item><name>Emmanuel Thomé</name><affiliations><json:string>INRIA Lorraine, LORIA, CACAO – bâtiment A, 615 rue du Jardin botanique, F-54602 Villiers-lès-Nancy CEDEX, France</json:string><json:string>E-mail: emmanuel.thome@normalesup.org</json:string></affiliations></json:item></author><subject><json:item><lang><json:string>eng</json:string></lang><value>rsa</value></json:item><json:item><lang><json:string>eng</json:string></lang><value>factoring</value></json:item><json:item><lang><json:string>eng</json:string></lang><value>nfs</value></json:item><json:item><lang><json:string>eng</json:string></lang><value>roots</value></json:item></subject><arkIstex>ark:/67375/HCB-1NT6B82D-Z</arkIstex><language><json:string>eng</json:string></language><originalGenre><json:string>OriginalPaper</json:string></originalGenre><qualityIndicators><score>7.012</score><pdfWordCount>6364</pdfWordCount><pdfCharCount>32158</pdfCharCount><pdfVersion>1.6</pdfVersion><pdfPageCount>16</pdfPageCount><pdfPageSize>430 x 660 pts</pdfPageSize><refBibsNative>false</refBibsNative><abstractWordCount>1</abstractWordCount><abstractCharCount>0</abstractCharCount><keywordCount>4</keywordCount></qualityIndicators><title>When e -th Roots Become Easier Than Factoring</title><chapterId><json:string>2</json:string><json:string>Chap2</json:string></chapterId><genre><json:string>conference</json:string></genre><serie><title>Lecture Notes in Computer Science</title><language><json:string>unknown</json:string></language><copyrightDate>2007</copyrightDate><issn><json:string>0302-9743</json:string></issn><eissn><json:string>1611-3349</json:string></eissn><editor><json:item><name>David Hutchison</name></json:item><json:item><name>Takeo Kanade</name></json:item><json:item><name>Josef Kittler</name></json:item><json:item><name>Jon M. Kleinberg</name></json:item><json:item><name>Friedemann Mattern</name></json:item><json:item><name>John C. Mitchell</name></json:item><json:item><name>Moni Naor</name></json:item><json:item><name>Oscar Nierstrasz</name></json:item><json:item><name>C. Pandu Rangan</name></json:item><json:item><name>Bernhard Steffen</name></json:item><json:item><name>Madhu Sudan</name></json:item><json:item><name>Demetri Terzopoulos</name></json:item><json:item><name>Doug Tygar</name></json:item><json:item><name>Moshe Y. Vardi</name></json:item><json:item><name>Gerhard Weikum</name></json:item></editor></serie><host><title>Advances in Cryptology – ASIACRYPT 2007</title><language><json:string>unknown</json:string></language><copyrightDate>2007</copyrightDate><doi><json:string>10.1007/978-3-540-76900-2</json:string></doi><issn><json:string>0302-9743</json:string></issn><eissn><json:string>1611-3349</json:string></eissn><eisbn><json:string>978-3-540-76900-2</json:string></eisbn><bookId><json:string>978-3-540-76900-2</json:string></bookId><isbn><json:string>978-3-540-76899-9</json:string></isbn><volume>4833</volume><pages><first>13</first><last>28</last></pages><genre><json:string>book-series</json:string></genre><editor><json:item><name>Kaoru Kurosawa</name></json:item></editor><subject><json:item><value>Computer Science</value></json:item><json:item><value>Computer Science</value></json:item><json:item><value>Data Encryption</value></json:item><json:item><value>Systems and Data Security</value></json:item><json:item><value>Algorithm Analysis and Problem Complexity</value></json:item><json:item><value>Management of Computing and Information Systems</value></json:item><json:item><value>Computer Communication Networks</value></json:item><json:item><value>Discrete Mathematics in Computer Science</value></json:item></subject></host><ark><json:string>ark:/67375/HCB-1NT6B82D-Z</json:string></ark><publicationDate>2007</publicationDate><copyrightDate>2007</copyrightDate><doi><json:string>10.1007/978-3-540-76900-2_2</json:string></doi><id>8383FDD278EBA5154BA21EE18C7E15B9443671E3</id><score>1</score><fulltext><json:item><extension>pdf</extension><original>true</original><mimetype>application/pdf</mimetype><uri>https://api.istex.fr/ark:/67375/HCB-1NT6B82D-Z/fulltext.pdf</uri></json:item><json:item><extension>zip</extension><original>false</original><mimetype>application/zip</mimetype><uri>https://api.istex.fr/ark:/67375/HCB-1NT6B82D-Z/bundle.zip</uri></json:item><istex:fulltextTEI uri="https://api.istex.fr/ark:/67375/HCB-1NT6B82D-Z/fulltext.tei"><teiHeader><fileDesc><titleStmt><title level="a" type="main" xml:lang="en">When <hi rend="italic">e</hi>-th Roots Become Easier Than Factoring</title></titleStmt><publicationStmt><authority>ISTEX</authority><availability><licence>Springer-Verlag Berlin Heidelberg</licence></availability><date when="2007">2007</date></publicationStmt><notesStmt><note type="conference" source="proceedings" scheme="https://content-type.data.istex.fr/ark:/67375/XTP-BFHXPBJJ-3">conference</note><note type="publication-type" subtype="book-series" scheme="https://publication-type.data.istex.fr/ark:/67375/JMC-0G6R5W5T-Z">book-series</note></notesStmt><sourceDesc><biblStruct><analytic><title level="a" type="main" xml:lang="en">When <hi rend="italic">e</hi>-th Roots Become Easier Than Factoring</title><author><persName><forename type="first">Antoine</forename><surname>Joux</surname></persName><email>antoine.joux@m4x.org</email><affiliation><orgName type="institution">DGA and Université de Versailles, UVSQ PRISM 45 avenue des États-Unis, F-78035 Versailles CEDEX</orgName><address><country key="FR">FRANCE</country></address></affiliation></author><author><persName><forename type="first">David</forename><surname>Naccache</surname></persName><email>david.naccache@ens.fr</email><affiliation><orgName type="institution">École normale supérieure, Équipe de cryptographie, 45 rue d’Ulm, F-75230 Paris CEDEX 05</orgName><address><country key="FR">FRANCE</country></address></affiliation></author><author><persName><forename type="first">Emmanuel</forename><surname>Thomé</surname></persName><email>emmanuel.thome@normalesup.org</email><affiliation><orgName type="institution">INRIA Lorraine, LORIA, CACAO – bâtiment A, 615 rue du Jardin botanique, F-54602 Villiers-lès-Nancy CEDEX</orgName><address><country key="FR">FRANCE</country></address></affiliation></author><idno type="istex">8383FDD278EBA5154BA21EE18C7E15B9443671E3</idno><idno type="ark">ark:/67375/HCB-1NT6B82D-Z</idno><idno type="DOI">10.1007/978-3-540-76900-2_2</idno></analytic><monogr><title level="m" type="main">Advances in Cryptology – ASIACRYPT 2007</title><title level="m" type="sub">13th International Conference on the Theory and Application of Cryptology and Information Security, Kuching, Malaysia, December 2-6, 2007. Proceedings</title><title level="m" type="part">Number Theory and Elliptic Curve</title><idno type="DOI">10.1007/978-3-540-76900-2</idno><idno type="book-id">978-3-540-76900-2</idno><idno type="ISBN">978-3-540-76899-9</idno><idno type="eISBN">978-3-540-76900-2</idno><idno type="chapter-id">Chap2</idno><idno type="part-id">Part1</idno><editor><persName><forename type="first">Kaoru</forename><surname>Kurosawa</surname></persName><email>kurosawa@mx.ibaraki.ac.jp</email></editor><imprint><biblScope unit="vol">4833</biblScope><biblScope unit="page" from="13">13</biblScope><biblScope unit="page" to="28">28</biblScope><biblScope unit="chapter-count">35</biblScope><biblScope unit="part-chapter-count">3</biblScope></imprint></monogr><series><title level="s" type="main" xml:lang="en">Lecture Notes in Computer Science</title><editor><persName><forename type="first">David</forename><surname>Hutchison</surname></persName></editor><editor><persName><forename type="first">Takeo</forename><surname>Kanade</surname></persName></editor><editor><persName><forename type="first">Josef</forename><surname>Kittler</surname></persName></editor><editor><persName><forename type="first">Jon</forename><forename type="first">M.</forename><surname>Kleinberg</surname></persName></editor><editor><persName><forename type="first">Friedemann</forename><surname>Mattern</surname></persName></editor><editor><persName><forename type="first">John</forename><forename type="first">C.</forename><surname>Mitchell</surname></persName></editor><editor><persName><forename type="first">Moni</forename><surname>Naor</surname></persName></editor><editor><persName><forename type="first">Oscar</forename><surname>Nierstrasz</surname></persName></editor><editor><persName><forename type="first">C.</forename><surname>Pandu Rangan</surname></persName></editor><editor><persName><forename type="first">Bernhard</forename><surname>Steffen</surname></persName></editor><editor><persName><forename type="first">Madhu</forename><surname>Sudan</surname></persName></editor><editor><persName><forename type="first">Demetri</forename><surname>Terzopoulos</surname></persName></editor><editor><persName><forename type="first">Doug</forename><surname>Tygar</surname></persName></editor><editor><persName><forename type="first">Moshe</forename><forename type="first">Y.</forename><surname>Vardi</surname></persName></editor><editor><persName><forename type="first">Gerhard</forename><surname>Weikum</surname></persName></editor><idno type="pISSN">0302-9743</idno><idno type="eISSN">1611-3349</idno><idno type="seriesID">558</idno></series></biblStruct></sourceDesc></fileDesc><profileDesc><abstract xml:lang="en"><head>Abstract</head><p>We show that computing <hi rend="italic">e</hi>-th roots modulo <hi rend="italic">n</hi> is easier than factoring <hi rend="italic">n</hi> with currently known methods, given subexponential access to an oracle outputting the roots of numbers of the form <hi rend="italic">x</hi><hi rend="subscript"><hi rend="italic">i</hi></hi> + <hi rend="italic">c</hi>.</p><p>Here <hi rend="italic">c</hi> is fixed and <hi rend="italic">x</hi><hi rend="subscript"><hi rend="italic">i</hi></hi> denotes small integers of the attacker’s choosing.</p><p>The attack comes in two flavors:
<list type="bulleted"><p>A first version is illustrated here by producing selective roots of the form <hi rend="italic">x</hi><hi rend="subscript"><hi rend="italic">i</hi></hi> + <hi rend="italic">c</hi> in <formula xml:id="IEq1" notation="TEX"><media mimeType="image" url=""></media>$L_n(\frac{1}{3}, \sqrt[3]{\frac{32}{9}})$
</formula>. This matches the <hi rend="italic">special</hi> number field sieve’s (<hi rend="smallCaps">snfs</hi>) complexity.</p><p>A second variant computes <hi rend="italic">arbitrary</hi><hi rend="italic">e</hi>-th roots in <formula xml:id="IEq2" notation="TEX"><media mimeType="image" url=""></media>$L_n(\frac{1}{3}, \gamma)$
</formula> after a subexponential number of oracle queries. The constant <hi rend="italic">γ</hi> depends on the type of oracle used.</p><p>This addresses in particular the One More <hi rend="smallCaps">rsa</hi> Inversion problem, where the <hi rend="italic">e</hi>-th root oracle is not restricted to numbers of a special form. The aforementioned constant <hi rend="italic">γ</hi> is then <formula xml:id="IEq3" notation="TEX"><media mimeType="image" url=""></media>$\sqrt[3]{\frac{32}{9}}$
</formula>.</p><p>Constraining the oracle to roots of the form <formula xml:id="IEq4" notation="TEX"><media mimeType="image" url=""></media>$\sqrt[e]{x_i + c} \bmod n$
</formula> increases <hi rend="italic">γ</hi>.</p></list></p><p>Both methods are faster than factoring <hi rend="italic">n</hi> using the <hi rend="smallCaps">gnfs</hi><formula xml:id="IEq5" notation="TEX"><media mimeType="image" url=""></media>$(L_n(\frac{1}{3}, \sqrt[3]{\frac{64}{9}}))$
</formula>.</p><p>This sheds additional light on <hi rend="smallCaps">rsa</hi>’s malleability in general and on <hi rend="smallCaps">rsa</hi>’s resistance to affine forgeries in particular – a problem known to be polynomial for <formula xml:id="IEq6" notation="TEX"><media mimeType="image" url=""></media>$x_i > \sqrt[3]{n}$
</formula>, but for which no algorithm faster than factoring was known before this work.</p></abstract><textClass ana="keyword"><keywords xml:lang="en"><term><hi rend="smallCaps">rsa</hi></term><term>factoring</term><term><hi rend="smallCaps">nfs</hi></term><term>roots</term></keywords></textClass><textClass ana="subject"><keywords scheme="book-subject-collection"><list><label>SUCO11645</label><item><term>Computer Science</term></item></list></keywords></textClass><textClass ana="subject"><keywords scheme="book-subject"><list><label>I</label><item><term type="Primary">Computer Science</term></item><label>I15033</label><item><term type="Secondary" subtype="priority-1">Data Encryption</term></item><label>I14050</label><item><term type="Secondary" subtype="priority-2">Systems and Data Security</term></item><label>I16021</label><item><term type="Secondary" subtype="priority-3">Algorithm Analysis and Problem Complexity</term></item><label>I24067</label><item><term type="Secondary" subtype="priority-4">Management of Computing and Information Systems</term></item><label>I13022</label><item><term type="Secondary" subtype="priority-5">Computer Communication Networks</term></item><label>I17028</label><item><term type="Secondary" subtype="priority-6">Discrete Mathematics in Computer Science</term></item></list></keywords></textClass><langUsage><language ident="EN"></language></langUsage></profileDesc></teiHeader></istex:fulltextTEI><json:item><extension>txt</extension><original>false</original><mimetype>text/plain</mimetype><uri>https://api.istex.fr/ark:/67375/HCB-1NT6B82D-Z/fulltext.txt</uri></json:item></fulltext><metadata><istex:metadataXml wicri:clean="corpus springer-ebooks not found" wicri:toSee="no header"><istex:xmlDeclaration>version="1.0" encoding="UTF-8"</istex:xmlDeclaration><istex:docType PUBLIC="-//Springer-Verlag//DTD A++ V2.4//EN" URI="http://devel.springer.de/A++/V2.4/DTD/A++V2.4.dtd" name="istex:docType"></istex:docType><istex:document><Publisher><PublisherInfo><PublisherName>Springer Berlin Heidelberg</PublisherName><PublisherLocation>Berlin, Heidelberg</PublisherLocation></PublisherInfo><Series><SeriesInfo SeriesType="Series" TocLevels="0"><SeriesID>558</SeriesID><SeriesPrintISSN>0302-9743</SeriesPrintISSN><SeriesElectronicISSN>1611-3349</SeriesElectronicISSN><SeriesTitle Language="En">Lecture Notes in Computer Science</SeriesTitle></SeriesInfo><SeriesHeader><EditorGroup><Editor><EditorName DisplayOrder="Western"><GivenName>David</GivenName><FamilyName>Hutchison</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>Takeo</GivenName><FamilyName>Kanade</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>Josef</GivenName><FamilyName>Kittler</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>Jon</GivenName><GivenName>M.</GivenName><FamilyName>Kleinberg</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>Friedemann</GivenName><FamilyName>Mattern</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>John</GivenName><GivenName>C.</GivenName><FamilyName>Mitchell</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>Moni</GivenName><FamilyName>Naor</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>Oscar</GivenName><FamilyName>Nierstrasz</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>C.</GivenName><FamilyName>Pandu Rangan</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>Bernhard</GivenName><FamilyName>Steffen</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>Madhu</GivenName><FamilyName>Sudan</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>Demetri</GivenName><FamilyName>Terzopoulos</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>Doug</GivenName><FamilyName>Tygar</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>Moshe</GivenName><GivenName>Y.</GivenName><FamilyName>Vardi</FamilyName></EditorName></Editor><Editor><EditorName DisplayOrder="Western"><GivenName>Gerhard</GivenName><FamilyName>Weikum</FamilyName></EditorName></Editor></EditorGroup></SeriesHeader><Book Language="En"><BookInfo BookProductType="Proceedings" ContainsESM="No" Language="En" MediaType="eBook" NumberingStyle="Unnumbered" OutputMedium="All" TocLevels="0"><BookID>978-3-540-76900-2</BookID><BookTitle>Advances in Cryptology – ASIACRYPT 2007</BookTitle><BookSubTitle>13th International Conference on the Theory and Application of Cryptology and Information Security, Kuching, Malaysia, December 2-6, 2007. Proceedings</BookSubTitle><BookVolumeNumber>4833</BookVolumeNumber><BookSequenceNumber>4833</BookSequenceNumber><BookDOI>10.1007/978-3-540-76900-2</BookDOI><BookTitleID>158204</BookTitleID><BookPrintISBN>978-3-540-76899-9</BookPrintISBN><BookElectronicISBN>978-3-540-76900-2</BookElectronicISBN><BookChapterCount>35</BookChapterCount><BookCopyright><CopyrightHolderName>Springer-Verlag Berlin Heidelberg</CopyrightHolderName><CopyrightYear>2007</CopyrightYear></BookCopyright><BookSubjectGroup><BookSubject Code="I" Type="Primary">Computer Science</BookSubject><BookSubject Code="I15033" Priority="1" Type="Secondary">Data Encryption</BookSubject><BookSubject Code="I14050" Priority="2" Type="Secondary">Systems and Data Security</BookSubject><BookSubject Code="I16021" Priority="3" Type="Secondary">Algorithm Analysis and Problem Complexity</BookSubject><BookSubject Code="I24067" Priority="4" Type="Secondary">Management of Computing and Information Systems</BookSubject><BookSubject Code="I13022" Priority="5" Type="Secondary">Computer Communication Networks</BookSubject><BookSubject Code="I17028" Priority="6" Type="Secondary">Discrete Mathematics in Computer Science</BookSubject><SubjectCollection Code="SUCO11645">Computer Science</SubjectCollection></BookSubjectGroup></BookInfo><BookHeader><EditorGroup><Editor><EditorName DisplayOrder="Western"><GivenName>Kaoru</GivenName><FamilyName>Kurosawa</FamilyName></EditorName><Contact><Email>kurosawa@mx.ibaraki.ac.jp</Email></Contact></Editor></EditorGroup></BookHeader><Part ID="Part1"><PartInfo TocLevels="0"><PartID>1</PartID><PartSequenceNumber>1</PartSequenceNumber><PartTitle>Number Theory and Elliptic Curve</PartTitle><PartChapterCount>3</PartChapterCount><PartContext><SeriesID>558</SeriesID><BookTitle>Advances in Cryptology – ASIACRYPT 2007</BookTitle></PartContext></PartInfo><Chapter ID="Chap2" Language="En"><ChapterInfo ChapterType="OriginalPaper" ContainsESM="No" NumberingStyle="Unnumbered" TocLevels="0"><ChapterID>2</ChapterID><ChapterDOI>10.1007/978-3-540-76900-2_2</ChapterDOI><ChapterSequenceNumber>2</ChapterSequenceNumber><ChapterTitle Language="En">When <Emphasis Type="Italic">e</Emphasis>-th Roots Become Easier Than Factoring</ChapterTitle><ChapterFirstPage>13</ChapterFirstPage><ChapterLastPage>28</ChapterLastPage><ChapterCopyright><CopyrightHolderName>Springer-Verlag Berlin Heidelberg</CopyrightHolderName><CopyrightYear>2007</CopyrightYear></ChapterCopyright><ChapterGrants Type="Regular"><MetadataGrant Grant="OpenAccess"></MetadataGrant><AbstractGrant Grant="OpenAccess"></AbstractGrant><BodyPDFGrant Grant="Restricted"></BodyPDFGrant><BodyHTMLGrant Grant="Restricted"></BodyHTMLGrant><BibliographyGrant Grant="Restricted"></BibliographyGrant><ESMGrant Grant="Restricted"></ESMGrant></ChapterGrants><ChapterContext><SeriesID>558</SeriesID><PartID>1</PartID><BookID>978-3-540-76900-2</BookID><BookTitle>Advances in Cryptology – ASIACRYPT 2007</BookTitle></ChapterContext></ChapterInfo><ChapterHeader><AuthorGroup><Author AffiliationIDS="Aff1"><AuthorName DisplayOrder="Western"><GivenName>Antoine</GivenName><FamilyName>Joux</FamilyName></AuthorName><Contact><Email>antoine.joux@m4x.org</Email></Contact></Author><Author AffiliationIDS="Aff2"><AuthorName DisplayOrder="Western"><GivenName>David</GivenName><FamilyName>Naccache</FamilyName></AuthorName><Contact><Email>david.naccache@ens.fr</Email></Contact></Author><Author AffiliationIDS="Aff3"><AuthorName DisplayOrder="Western"><GivenName>Emmanuel</GivenName><FamilyName>Thomé</FamilyName></AuthorName><Contact><Email>emmanuel.thome@normalesup.org</Email></Contact></Author><Affiliation ID="Aff1"><OrgName>DGA and Université de Versailles, UVSQ PRISM 45 avenue des États-Unis, F-78035 Versailles CEDEX</OrgName><OrgAddress><Country>France</Country></OrgAddress></Affiliation><Affiliation ID="Aff2"><OrgName>École normale supérieure, Équipe de cryptographie, 45 rue d’Ulm, F-75230 Paris CEDEX 05</OrgName><OrgAddress><Country>France</Country></OrgAddress></Affiliation><Affiliation ID="Aff3"><OrgName>INRIA Lorraine, LORIA, CACAO – bâtiment A, 615 rue du Jardin botanique, F-54602 Villiers-lès-Nancy CEDEX</OrgName><OrgAddress><Country>France</Country></OrgAddress></Affiliation></AuthorGroup><Abstract ID="Abs1" Language="En"><Heading>Abstract</Heading><Para>We show that computing <Emphasis Type="Italic">e</Emphasis>-th roots modulo <Emphasis Type="Italic">n</Emphasis> is easier than factoring <Emphasis Type="Italic">n</Emphasis> with currently known methods, given subexponential access to an oracle outputting the roots of numbers of the form <Emphasis Type="Italic">x</Emphasis><Subscript><Emphasis Type="Italic">i</Emphasis></Subscript> + <Emphasis Type="Italic">c</Emphasis>.</Para><Para>Here <Emphasis Type="Italic">c</Emphasis> is fixed and <Emphasis Type="Italic">x</Emphasis><Subscript><Emphasis Type="Italic">i</Emphasis></Subscript> denotes small integers of the attacker’s choosing.</Para><Para>The attack comes in two flavors:
<UnorderedList Mark="Bullet"><ItemContent><Para>A first version is illustrated here by producing selective roots of the form <Emphasis Type="Italic">x</Emphasis><Subscript><Emphasis Type="Italic">i</Emphasis></Subscript> + <Emphasis Type="Italic">c</Emphasis> in <InlineEquation ID="IEq1"><InlineMediaObject><ImageObject FileRef="978-3-540-76900-2_2_Chapter_TeX2GIFIEq1.gif" Format="GIF" Color="BlackWhite" Type="Linedraw" Rendition="HTML"></ImageObject></InlineMediaObject><EquationSource Format="TEX">$L_n(\frac{1}{3}, \sqrt[3]{\frac{32}{9}})$</EquationSource></InlineEquation>. This matches the <Emphasis Type="Italic">special</Emphasis> number field sieve’s (<Emphasis Type="SmallCaps">snfs</Emphasis>) complexity.</Para></ItemContent><ItemContent><Para>A second variant computes <Emphasis Type="Italic">arbitrary</Emphasis><Emphasis Type="Italic">e</Emphasis>-th roots in <InlineEquation ID="IEq2"><InlineMediaObject><ImageObject FileRef="978-3-540-76900-2_2_Chapter_TeX2GIFIEq2.gif" Format="GIF" Color="BlackWhite" Type="Linedraw" Rendition="HTML"></ImageObject></InlineMediaObject><EquationSource Format="TEX">$L_n(\frac{1}{3}, \gamma)$</EquationSource></InlineEquation> after a subexponential number of oracle queries. The constant <Emphasis Type="Italic">γ</Emphasis> depends on the type of oracle used.</Para><Para>This addresses in particular the One More <Emphasis Type="SmallCaps">rsa</Emphasis> Inversion problem, where the <Emphasis Type="Italic">e</Emphasis>-th root oracle is not restricted to numbers of a special form. The aforementioned constant <Emphasis Type="Italic">γ</Emphasis> is then <InlineEquation ID="IEq3"><InlineMediaObject><ImageObject FileRef="978-3-540-76900-2_2_Chapter_TeX2GIFIEq3.gif" Format="GIF" Color="BlackWhite" Type="Linedraw" Rendition="HTML"></ImageObject></InlineMediaObject><EquationSource Format="TEX">$\sqrt[3]{\frac{32}{9}}$</EquationSource></InlineEquation>.</Para><Para>Constraining the oracle to roots of the form <InlineEquation ID="IEq4"><InlineMediaObject><ImageObject FileRef="978-3-540-76900-2_2_Chapter_TeX2GIFIEq4.gif" Format="GIF" Color="BlackWhite" Type="Linedraw" Rendition="HTML"></ImageObject></InlineMediaObject><EquationSource Format="TEX">$\sqrt[e]{x_i + c} \bmod n$</EquationSource></InlineEquation> increases <Emphasis Type="Italic">γ</Emphasis>.</Para></ItemContent></UnorderedList></Para><Para>Both methods are faster than factoring <Emphasis Type="Italic">n</Emphasis> using the <Emphasis Type="SmallCaps">gnfs</Emphasis><InlineEquation ID="IEq5"><InlineMediaObject><ImageObject FileRef="978-3-540-76900-2_2_Chapter_TeX2GIFIEq5.gif" Format="GIF" Color="BlackWhite" Type="Linedraw" Rendition="HTML"></ImageObject></InlineMediaObject><EquationSource Format="TEX">$(L_n(\frac{1}{3}, \sqrt[3]{\frac{64}{9}}))$</EquationSource></InlineEquation>.</Para><Para>This sheds additional light on <Emphasis Type="SmallCaps">rsa</Emphasis>’s malleability in general and on <Emphasis Type="SmallCaps">rsa</Emphasis>’s resistance to affine forgeries in particular – a problem known to be polynomial for <InlineEquation ID="IEq6"><InlineMediaObject><ImageObject FileRef="978-3-540-76900-2_2_Chapter_TeX2GIFIEq6.gif" Format="GIF" Color="BlackWhite" Type="Linedraw" Rendition="HTML"></ImageObject></InlineMediaObject><EquationSource Format="TEX">$x_i > \sqrt[3]{n}$</EquationSource></InlineEquation>, but for which no algorithm faster than factoring was known before this work.</Para></Abstract><KeywordGroup Language="En"><Heading>Keywords</Heading><Keyword><Emphasis Type="SmallCaps">rsa</Emphasis></Keyword><Keyword>factoring</Keyword><Keyword><Emphasis Type="SmallCaps">nfs</Emphasis></Keyword><Keyword>roots</Keyword></KeywordGroup></ChapterHeader><NoBody></NoBody></Chapter></Part></Book></Series></Publisher></istex:document></istex:metadataXml><mods version="3.6"><titleInfo lang="en"><title>When e -th Roots Become Easier Than Factoring</title></titleInfo><titleInfo type="alternative" contentType="CDATA"><title>When e -th Roots Become Easier Than Factoring</title></titleInfo><name type="personal"><namePart type="given">Antoine</namePart><namePart type="family">Joux</namePart><affiliation>DGA and Université de Versailles, UVSQ PRISM 45 avenue des États-Unis, F-78035 Versailles CEDEX, France</affiliation><affiliation>E-mail: antoine.joux@m4x.org</affiliation><role><roleTerm type="text">author</roleTerm></role></name><name type="personal"><namePart type="given">David</namePart><namePart type="family">Naccache</namePart><affiliation>École normale supérieure, Équipe de cryptographie, 45 rue d’Ulm, F-75230 Paris CEDEX 05, France</affiliation><affiliation>E-mail: david.naccache@ens.fr</affiliation><role><roleTerm type="text">author</roleTerm></role></name><name type="personal"><namePart type="given">Emmanuel</namePart><namePart type="family">Thomé</namePart><affiliation>INRIA Lorraine, LORIA, CACAO – bâtiment A, 615 rue du Jardin botanique, F-54602 Villiers-lès-Nancy CEDEX, France</affiliation><affiliation>E-mail: emmanuel.thome@normalesup.org</affiliation><role><roleTerm type="text">author</roleTerm></role></name><typeOfResource>text</typeOfResource><genre displayLabel="OriginalPaper" authority="ISTEX" authorityURI="https://content-type.data.istex.fr" type="conference" valueURI="https://content-type.data.istex.fr/ark:/67375/XTP-BFHXPBJJ-3">conference</genre><originInfo><publisher>Springer Berlin Heidelberg</publisher><place><placeTerm type="text">Berlin, Heidelberg</placeTerm></place><dateIssued encoding="w3cdtf">2007</dateIssued><copyrightDate encoding="w3cdtf">2007</copyrightDate></originInfo><language><languageTerm type="code" authority="rfc3066">en</languageTerm><languageTerm type="code" authority="iso639-2b">eng</languageTerm></language><note type="content">A first version is illustrated here by producing selective roots of the form x i + c in $L_n(\frac{1}{3}, \sqrt[3]{\frac{32}{9}})$ . This matches the special number field sieve’s (snfs) complexity.</note><note type="content">A second variant computes arbitrary e-th roots in $L_n(\frac{1}{3}, \gamma)$ after a subexponential number of oracle queries. The constant γ depends on the type of oracle used.</note><note type="content">This addresses in particular the One More rsa Inversion problem, where the e-th root oracle is not restricted to numbers of a special form. The aforementioned constant γ is then $\sqrt[3]{\frac{32}{9}}$ .</note><note type="content">Constraining the oracle to roots of the form $\sqrt[e]{x_i + c} \bmod n$ increases γ.</note><subject lang="en"><genre>Keywords</genre><topic>rsa</topic><topic>factoring</topic><topic>nfs</topic><topic>roots</topic></subject><relatedItem type="host"><titleInfo><title>Advances in Cryptology – ASIACRYPT 2007</title><subTitle>13th International Conference on the Theory and Application of Cryptology and Information Security, Kuching, Malaysia, December 2-6, 2007. Proceedings</subTitle></titleInfo><name type="personal"><namePart type="given">Kaoru</namePart><namePart type="family">Kurosawa</namePart><role><roleTerm type="text">editor</roleTerm></role></name><genre type="book-series" authority="ISTEX" authorityURI="https://publication-type.data.istex.fr" valueURI="https://publication-type.data.istex.fr/ark:/67375/JMC-0G6R5W5T-Z">book-series</genre><originInfo><publisher>Springer</publisher><copyrightDate encoding="w3cdtf">2007</copyrightDate><issuance>monographic</issuance></originInfo><subject><genre>Book-Subject-Collection</genre><topic authority="SpringerSubjectCodes" authorityURI="SUCO11645">Computer Science</topic></subject><subject><genre>Book-Subject-Group</genre><topic authority="SpringerSubjectCodes" authorityURI="I">Computer Science</topic><topic authority="SpringerSubjectCodes" authorityURI="I15033">Data Encryption</topic><topic authority="SpringerSubjectCodes" authorityURI="I14050">Systems and Data Security</topic><topic authority="SpringerSubjectCodes" authorityURI="I16021">Algorithm Analysis and Problem Complexity</topic><topic authority="SpringerSubjectCodes" authorityURI="I24067">Management of Computing and Information Systems</topic><topic authority="SpringerSubjectCodes" authorityURI="I13022">Computer Communication Networks</topic><topic authority="SpringerSubjectCodes" authorityURI="I17028">Discrete Mathematics in Computer Science</topic></subject><identifier type="DOI">10.1007/978-3-540-76900-2</identifier><identifier type="ISBN">978-3-540-76899-9</identifier><identifier type="eISBN">978-3-540-76900-2</identifier><identifier type="ISSN">0302-9743</identifier><identifier type="eISSN">1611-3349</identifier><identifier type="BookTitleID">158204</identifier><identifier type="BookID">978-3-540-76900-2</identifier><identifier type="BookChapterCount">35</identifier><identifier type="BookVolumeNumber">4833</identifier><identifier type="BookSequenceNumber">4833</identifier><identifier type="PartChapterCount">3</identifier><part><date>2007</date><detail type="part"><title>Number Theory and Elliptic Curve</title></detail><detail type="volume"><number>4833</number><caption>vol.</caption></detail><extent unit="pages"><start>13</start><end>28</end></extent></part><recordInfo><recordOrigin>Springer-Verlag Berlin Heidelberg, 2007</recordOrigin></recordInfo></relatedItem><relatedItem type="series"><titleInfo><title>Lecture Notes in Computer Science</title></titleInfo><name type="personal"><namePart type="given">David</namePart><namePart type="family">Hutchison</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">Takeo</namePart><namePart type="family">Kanade</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">Josef</namePart><namePart type="family">Kittler</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">Jon</namePart><namePart type="given">M.</namePart><namePart type="family">Kleinberg</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">Friedemann</namePart><namePart type="family">Mattern</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">John</namePart><namePart type="given">C.</namePart><namePart type="family">Mitchell</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">Moni</namePart><namePart type="family">Naor</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">Oscar</namePart><namePart type="family">Nierstrasz</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">C.</namePart><namePart type="family">Pandu Rangan</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">Bernhard</namePart><namePart type="family">Steffen</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">Madhu</namePart><namePart type="family">Sudan</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">Demetri</namePart><namePart type="family">Terzopoulos</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">Doug</namePart><namePart type="family">Tygar</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">Moshe</namePart><namePart type="given">Y.</namePart><namePart type="family">Vardi</namePart><role><roleTerm type="text">editor</roleTerm></role></name><name type="personal"><namePart type="given">Gerhard</namePart><namePart type="family">Weikum</namePart><role><roleTerm type="text">editor</roleTerm></role></name><originInfo><publisher>Springer</publisher><copyrightDate encoding="w3cdtf">2007</copyrightDate><issuance>serial</issuance></originInfo><identifier type="ISSN">0302-9743</identifier><identifier type="eISSN">1611-3349</identifier><identifier type="SeriesID">558</identifier><recordInfo><recordOrigin>Springer-Verlag Berlin Heidelberg, 2007</recordOrigin></recordInfo></relatedItem><identifier type="istex">8383FDD278EBA5154BA21EE18C7E15B9443671E3</identifier><identifier type="ark">ark:/67375/HCB-1NT6B82D-Z</identifier><identifier type="DOI">10.1007/978-3-540-76900-2_2</identifier><identifier type="ChapterID">2</identifier><identifier type="ChapterID">Chap2</identifier><accessCondition type="use and reproduction" contentType="copyright">Springer-Verlag Berlin Heidelberg, 2007</accessCondition><recordInfo><recordContentSource authority="ISTEX" authorityURI="https://loaded-corpus.data.istex.fr" valueURI="https://loaded-corpus.data.istex.fr/ark:/67375/XBH-RLRX46XW-4">springer</recordContentSource><recordOrigin>Springer-Verlag Berlin Heidelberg, 2007</recordOrigin></recordInfo></mods><json:item><extension>json</extension><original>false</original><mimetype>application/json</mimetype><uri>https://api.istex.fr/ark:/67375/HCB-1NT6B82D-Z/record.json</uri></json:item></metadata></istex></record>Pour manipuler ce document sous Unix (Dilib)
EXPLOR_STEP=$WICRI_ROOT/Wicri/Lorraine/explor/InforLorV4/Data/Istex/Corpus
HfdSelect -h $EXPLOR_STEP/biblio.hfd -nk 001E45 | SxmlIndent | more
Ou
HfdSelect -h $EXPLOR_AREA/Data/Istex/Corpus/biblio.hfd -nk 001E45 | SxmlIndent | more
Pour mettre un lien sur cette page dans le réseau Wicri
{{Explor lien
|wiki= Wicri/Lorraine
|area= InforLorV4
|flux= Istex
|étape= Corpus
|type= RBID
|clé= ISTEX:8383FDD278EBA5154BA21EE18C7E15B9443671E3
|texte= When e -th Roots Become Easier Than Factoring
}}
| This area was generated with Dilib version V0.6.33. |  |