Multi-round passive attacks on server-aided RSA protocols

At Crypto'88, Matsumoto, Kato, and Imai presented two server-aided RSA protocols, RSA-S1 and RSA-S2, which speed up a client's RSA signature generation by interacting with a computationally strong but untrusted server. These protocols are quite attractive due to their e ciency, but unfortunately they are susceptible to multi-round active attacks. Therefore, on Eurocrypt'92, P tzmann and Waidner suggested to renew the decomposition of the secret key after each signature generation. In this paper we show that in this case the non-binary version of RSA-S1 becomes totally insecure. Our experiments show that the secret key can be reconstructed very e ciently by lattice reduction using the data obtained by the server in the course of several executions of the protocol. On the other hand we show that if the decomposition of the secret key is modi ed slightly, our attacks become ine cient. This modi cation does not a ect the e ciency of the protocol signi cantly. Furthermore, we present a very simple attack on the serveraided RSA protocol presented by Hong, Shin, Lee-Kwang and Yoon at ICISC'98. Using the parameters suggested by the authors, we can factor the modulus in only 2 steps.