I am trying to calculate the value of m in RSA. The values of n, e and c are given, and they are fairly large:
n = 0xce202f8fd1b78c23dfa53314617510cd422e3f4c5aa412400ed44abaf3d4bbdf4230c8f9f73736c32cbcbec0c7780b6b56f7d4bea1678640581cd4aaf2df9ff4175846fc44ddf94e924a188d0b0989ecc462da8c5e88c295e26beeafab201ab6ab299dc0f0106dd1a3cc21d17c757130be6f3f0b5b250932396f34ac3295d057
e = 0x684b3ab9779f91c23597668e5eb8dd73a3333f9fb7a456583204d255576bef204a1201d276a00cb88d531c3aa993e7304162bf673baebffc39210a1c3faa64712a4e12c1da67eb98817d981bc8bbe9d4cf605903fc039b507e8b77248a88c995741b152c41609d3d86518cba8d9da419dd36e8f8bc07881be87990ea26873b6b
c = 0x9cddd342018418c628f5ec22699f60397f39275013835374a3c1f4a5e568e1d0b70944641010cad4b07b94143d0ba2123ebc8cb1589ddc8818631c460a896c362da5f230ada3a48c24a22c5d86934d4b3b626a728c0de389fadae3a4b4ad8da7aa4473188fcf22e107f6e80707061f41eedc1d1112b57187afdb741d3ea2ff2a
There is a also a condition given that assert c = pow(m, e, n) (Python code).
There is a time limit of how fast I can calculate this problem, and it should take no longer than about 10 seconds on an i7 CPU. I have tried using RsaCtfTool to brute-force it (which uses the gmpy2 library), as suggested in this SO answer, but it was too slow and took over a minute, which exceeded the time limit. Is there better algorithm I can use to calculate problems such as these faster, knowing that c equals pow(m, e, n)? Thanks!
As mentioned in the comment from Topaco, it is vulnerable to the Wiener attack. Here is code to do it in Python, using the owiener module:
import owiener
n = 0xce202f8fd1b78c23dfa53314617510cd422e3f4c5aa412400ed44abaf3d4bbdf4230c8f9f73736c32cbcbec0c7780b6b56f7d4bea1678640581cd4aaf2df9ff4175846fc44ddf94e924a188d0b0989ecc462da8c5e88c295e26beeafab201ab6ab299dc0f0106dd1a3cc21d17c757130be6f3f0b5b250932396f34ac3295d057
e = 0x684b3ab9779f91c23597668e5eb8dd73a3333f9fb7a456583204d255576bef204a1201d276a00cb88d531c3aa993e7304162bf673baebffc39210a1c3faa64712a4e12c1da67eb98817d981bc8bbe9d4cf605903fc039b507e8b77248a88c995741b152c41609d3d86518cba8d9da419dd36e8f8bc07881be87990ea26873b6b
c = 0x9cddd342018418c628f5ec22699f60397f39275013835374a3c1f4a5e568e1d0b70944641010cad4b07b94143d0ba2123ebc8cb1589ddc8818631c460a896c362da5f230ada3a48c24a22c5d86934d4b3b626a728c0de389fadae3a4b4ad8da7aa4473188fcf22e107f6e80707061f41eedc1d1112b57187afdb741d3ea2ff2a
d = owiener.attack(e, n)
m = pow(c, d, n)
Related
Here is one of problems in my assignment:
Consider the RSA public key (e,N) =
(9292162750094637473537,13029506445953503759481). Find the corresponding private exponent d ∈ Z∗N . Show how you did this.
I feel like it is an impossible task. I know
ed ≡ 1 mod ϕ(N)
where
ϕ(N) = (p-1)(q-1)
but I don't know p and q.
My question is that is there a way to find d if only e and N are given without knowing p and q?
OR
Is there a way to calculate p and q from N = pq? (Although I feel like it will be very difficult)
I have thousand calling in this line of code
idx=sub2ind(size(I),x,y);
A=bsxfun(#times,bsxfun(#times, a, d),I(idx));
B=bsxfun(#times,bsxfun(#times, b, d),I(idx));
C=bsxfun(#times,bsxfun(#times, b, c),I(idx));
D=bsxfun(#times,bsxfun(#times, a, c),I(idx));
where a, b, c and d =1xn matrix, and I=mxn matrix (can be up to 1920x1080). For example:
x=10; y=40;
a=rand(1,100);
b=rand(1,100);
c=rand(1,100);
d=rand(1,100);
I=rand(500,500);
Vectorized method would be using .*, however after several tests, .* is halves SLOWER than bsxfun (I'm using MATLAB 2017a).
Any other suggestion to improve this? I'm asking for CPU computation though, not GPU. A slight improvement percentage is very significant as for a week time's computation. Thanks!
Fact: Those line of codes were compiled into MEX and called 40855882 times, with total/self time of 19558.370 seconds. That's not even 10% of total computation.
I would use .*. I know you said it's slower but on my computer (and 2016b) it's about 70 times faster...
x=10; y=40;
a=rand(1,100);
b=rand(1,100);
c=rand(1,100);
d=rand(1,100);
I=rand(500,500);
idx=sub2ind(size(I),x,y);
n = 10000;
tic
for ii = 1:n % vectorized version
A1 = a.*d*I(idx);
B1 = b.*d*I(idx);
C1 = b.*c*I(idx);
D1 = a.*c*I(idx);
end
t1 = toc;
tic
for ii = 1:n % bsxfun version
A=bsxfun(#times,bsxfun(#times, a, d),I(idx));
B=bsxfun(#times,bsxfun(#times, b, d),I(idx));
C=bsxfun(#times,bsxfun(#times, b, c),I(idx));
D=bsxfun(#times,bsxfun(#times, a, c),I(idx));
end
t = toc;
t/t1
I am trying to solve linear inequalities for the conditions on the set of solutions. For example:
syms p C L D W
assume([p, C, W, D, L] >= 0)
eqn5 = p*C + L - D < 0;
eqn6 = p*C > 0;
solp2 = solve([eqn5, eqn6], [p, C, W, D, L], 'ReturnConditions', true);
Solp2p = solp2.p
Solp2C = solp2.C
Solp2W = solp2.W
Solp2D = solp2.D
Solp2L = solp2.L
Solp2cond = solp2.conditions
solp2par = solp2.parameters`
The conditions to solving this system of inequalities is clearly 0 < p*C < D- L. However it reports no solutions or conditions exist to satisfy this system of linear inequalities.
When using equalities these are the solutions I would receive using the solve function, however, when switching to inequalities it doesn't seem to work anymore. I also tried using vpasolve which didn't result in a solution either.
So far I have only found questions on Stack Overflow that give answers on how to find corner solutions or whether a solution exists for a system of linear inequalities.
I understand that the solution above implies an infinite number of solutions but this is easily captured using conditions as the solve function does for equalities. Does anyone know how to get these kind of solutions for a system of linear inequalities?
I switched to using mathematica and used the reduce function to find the solutions I am looking for. Have not yet figured out how to do it in matlab.
I understand that there is an error with dimensions in line dr=(r-v*v/2)*dT . But I have little knowledge of Matlab. Help to fix it, please. The code is small and simple. Maybe someone will find time to look
function [optionPrice] = upAndOutCallOption(S,r,v,x,b,T,dT)
t = 0;
dr=[];
pert=[];
while (t < T) & (S < b)
t = t + dT;
dr = (r - v.*v./2).*dT;
pert = v.*sqrt( dT ).*randn();
S = S.*exp(dr + pert);
end
if S<b
% Within barrier, so price as for a European option.
optionPrice = exp(-r.*T).* max(0, S - x);
else
% Hit the barrier, so the option is withdrawn.
optionPrice = 0;
end
end
Call from another function of this kind:
for k=1:amountOfOptions
[optionPrices(k)] = upAndOutCallOption(stockPrice(k)*o,riskFreeRate(k)*o,... volatility(k)*o, strike(k)*o, barrier(k)*o, timeToExpiry(k)*o, sampleRate(k)*o);
result(k) = mean(optionPrices(k));
end
Therefore, any difficulties.
It's good that you know the problem is within dr = (r - v.*v./2).*dT;. The command itself has many possible problems which also related to dimensions:
Here you are doing element-wise multiplication (because of the .*) with matrices, which requires (in the case of your command) that r has the same number of rows AND columns as v (since because of element-wise, v.*v/2 has the same size as v).
Moreover, it is unnecessary to do element-wise division with scalar number, that means there is no need to have ./2 in Matlab.
And, finally, since it's element-wise multiplication again, the matrix (r - v.*v./2) must also have the same number of rows and columns as matrix dT.
Check here for more information about Matlab's matrix operations.
I have a complicated expression H which is derived from several other complicated intermediate step. I want to get the [N D] = numden(H).
The problem is that the expression H, N and D is not being "evaluated" and they are also not simplified and divided by common factors.
I am using syms x.
For example, I get
H = (27+81*(x^2-987605098534947/1125899906842624*x-...
That is just so crazy.. but clearly,
H = (27+81*(x^2-0.8772*x-...
how can I get it to evaluate to simplest form?
Thanks in advance!
EDIT: I found out the closest bet is using VPA
My own workaround:
[num den] = numden(H)
num = vpa(num, 4);
den = vpa(den, 4);
H = num/den;
repeat from 1 until desired num and den are obtained.