Low exponent attack against elliptic curve RSA

概要

論文の詳細を見る
Hastad showed that low exponent RSA is not secure if the same message is encrypted to several Receivers. This is true even if time-stamp is used for each receiver. For example, let e=3. Then if the number of receivers=7, the eavesdropper can find the plaintext from the seven ciphertexts of each receiver. On the other hand, elliptic curve RSA were proposed recently. Low exponent attack is not known against elliptic curve RSA, although it is much more complicated than usual RSA. This paper shows a low exponent attack against elliptic curve RSA. It is shown that the KMOV scheme and Demytko's scheme are not secure if e=5,n≥2^<1024> and the number of receivers=428. In Demytko's scheme, e can take the value of 2. In this case, this system is not secure if the number of receiver=11 for n≥2^<175>.(Even though, each receiver has a different times-stamp and a different elliptic curve.)
社団法人電子情報通信学会の論文
1995-03-27