Score:0

In RSA signing find n from e and many pairs of m and c

es flag

When signing using RSA with $e = 65537$ and many pairs of m and c, where $$c^e \bmod (n)=m$$ is there a way to find n (n is 2048 bits)?

I planned on computing $ c^e-m $ and then treating those as a basis for a lattice. But $c^e$ was too large.

pe flag
Duplicate of https://crypto.stackexchange.com/questions/26188
rozi avatar
es flag
The answer provided by @poncho worked well. Also, moving from Python to SageMath improved the speed and made this doable on my machine.
Score:2
my flag

is there a way to find n (n is 2048 bits)?

Yes, if you assume deterministic padding (which is sometimes used for signatures, which appears to be the case you're considering)

You're on the right track by considering $c^e - m$ (which will be a multiple of $n$); given that we have several, what we can do is take two, and compute:

$$\gcd( c^e-n, c'^e-m' )$$

This will be $n$ (multiplied by an integer with a high probability of being small; that's easy to scrap off); that's your answer.

The values we're taking the GCD of are about $2^{27}$ bits in length - using the standard binary or Euclidean algorithms would probably take rather longer than we would prefer to wait. However, Lehmer's GCD algorithm should bring it into a range that's not intolerable...

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.