Abstract

Abstract: We consider the problem of solving systems of equations Pi(x) 0 (mod ni) i = 1:::k where Pi are polynomials of degree d and the ni are distinct relatively prime numbers and x < min(ni). We prove that if k> d(d+1) we can recover x in polynomial 2 time provided min(ni)> 2d2. As a consequence the RSA cryptosystem used with a small exponent is not a good choice to use as a public key cryptosystem in a large network. We also show that a protocol by Broder and Dolev [4] is insecure if RSA with a small exponent is used. Warning: Essentially this paper has been published in SIAM Journal on Computing and is hence subject to copyright restrictions. It is for personal use only. 1.

Citations

2506	A method for obtaining digital signatures and public-key cryptosystems - Rivest, Shamir, et al.
1404	How to share a secret - Shamir - 1979
1001	Probabilistic encryption - Goldwasser, Micali - 1984
261	Digitalized signatures and public-key functions as intractable as factorization - Rabin
118	An Introduction to the Geometry of Numbers - Cassels - 1971
102	An efficient probabilistic public-key encryption scheme which hides all partial information - Blum, Goldwasser - 1985
6	RSA/Rabin bits are 1/2+1/poly(logN)secure - Alexi, Chor, et al. - 1984
6	Factoring polynomials with integer coefficients. Mathematische Annalen 261 - Lenstra, Lenstra, et al. - 1982
2	Flipping Coins in Many Pockets - Broder, Dolev - 1984
1	Fair Coin Flip in a Byzantine Environment" , manuscript in preparation - Awerbuch, Chor, et al.
1	Personal Communication 1985. [7] Goldwasser - Chor - 1984
1	RSA/Rabin Bits are 1 2 + poly(logN) Secure - Alexi, Chor, et al. - 1984
1	Coin Flip in a Byzantine Environment" , manuscript in preparation - Awerbuch, Chor, et al. - 1985
1	Factoring Polynomials with Integer Coe cients" Matematische Annalen 261 - Lenstra, Lovasz - 1982