On the Security of Server-Aided RSA Protocols

In this paper we investigate the security of the server-aided RSA protocols RSA-S1 and RSA-S1M proposed by Matsumoto, Kato and Imai ([MKI89]) and Matsumoto, Imai, Laih and Yen ([MILY93]), respectively. In these protocols a smart card calculates an RSA signature with the aid of an untrusted powerful server. We focus on generic attacks, that is, passive attacks that do not exploit any special properties of the encoding of the group elements. Generic algorithms have been introduced by Nechaev ([Nec94]) and Shoup ([Sho97]). We prove lower bounds for the complexity of generic attacks on these two protocols and show that the bounds are sharp by describing attacks that almost match our lower bounds. To the best of our knowledge these are the first security proofs for efficient server-aided RSA protocols.