RSA without Padding

Cryptanalysis of Raw RSA
Experiments using Meet-in-the-middle Attack
Dr. Dharma Ganesan, Ph.D.,

Disclaimer
● The opinions expressed here are my own
○ But not the views of my employer
● The source code fragments and exploits shown here can be reused
○ But without any warranty nor accept any responsibility for failures
● Do not apply the exploit discussed here on other systems
○ Without obtaining authorization from owners
2

Goal of this presentation
● Explain how to break Raw RSA (i.e., without padding)
● Present exploits using Meet-in-the-middle attack
● Discuss experimental results
3

Prerequisite
Some familiarity with the following topics will help to follow the rest of the slides
● Group Theory (Abstract Algebra/Discrete Math)
● Modular Arithmetic (Number Theory)
● Algorithms and Complexity Theory
● If not, it should still be possible to obtain a high-level overview
4

How can Bob send a message to Alice securely?
5
Public Key PuA
● Alice and Bob never met each other
● Bob will encrypt using Alice’s public key
○ Assume that public keys are known to the world
● Alice will decrypt using her private key
○ Private keys are secrets (never sent out)
● Bob can sign messages using his private key
○ Alice verifies message integrity using Bob’s public key
○ Not important for this presentation/attack
● Note: Alice and Bob need other evidence (e.g., passwords,
certificates) to prove their identity to each other
● Who are Alice, Bob, and Eve?
Private Key PrA
Public Key PuB
Private Key PrB

RSA Public Key Cryptography System
● Published in 1977 by Ron Rivest, Adi Shamir and Leonard Adleman
● Rooted in elegant mathematics - Group Theory and Number Theory
● Core idea: Anyone can encrypt a message using recipient's public key but
○ (as far as we know) no one can efficiently decrypt unless they got the matching private key
● Encryption and Decryption are inverse operations (math details later)
○ Work of Euclid, Euler, and Fermat provide the mathematical foundation of RSA
● Eavesdropper Eve cannot easily derive the secret (math details later)
○ Unless she solves “hard” number theory problems that are computationally intractable
6

7
Notations and Facts (needed for RSA Trapdoor)
GCD(x, y): The greatest common divisor that divides integers x and y
Co-prime: If gcd(x, y) = 1, then x and y are co-primes
Zn = { 0, 1, 2, …, n-1 }, n > 0; we may imagine Zn as a circular wall clock
Z*
n = { x ∈ Zn | gcd(x, n) = 1 }; (additional info: Z*
n is a multiplicative group)
φ(n): Euler’s Totient function denotes the number of elements in Z*
n
φ(p) = p-1, if p is a prime number
x ≡ y (mod n) denotes that n divides x-y; x is congruent to y mod n

RSA - Key Generation Algo. (Fits on one page)
1. Select an appropriate bitlength of the RSA modulus n (e.g., 2048 bits)
○ Value of the parameter n is not chosen until step 3; small n is dangerous (details later)
2. Pick two independent, large random primes, p and q, of half of n’s bitlength
○ In practice, p and q are not close to each other to avoid attacks (e.g., Fermat’s factorization)
3. Compute n = p.q (n is also called the RSA modulus)
4. Compute Euler’s Totient (phi) Function φ(n) = φ(p.q) = φ(p)φ(q) = (p-1)(q-1)
5. Select numbers e and d from Zn such that e.d ≡ 1(mod φ(n))
○ Many implementations set e to be 65537 (Note: gcd(e, φ(n)) = 1)
○ e must be relatively prime to φ(n) otherwise d cannot exist (i.e., we cannot decrypt)
○ d is the multiplicative inverse of e in Zn
6. Public key is the pair <n, e> and private key is 4-tuple <φ(n), d, p, q>
Note: If p, q, d, or φ(n) is leaked, RSA is broken immediately
8

Formal definition of the RSA trapdoor function
● RSA: Zn → Zn
● Let m and c ∈ Zn
● c = RSA(m) = me mod n
● m = RSA-1(c) = cd mod n
● e and d are also called encryption and decryption
exponents, respectively
● Note: Attackers know c, e, and n but not d
9

RSA Trapdoor ...
● RSACoreEngine.java implements the RSA and RSA-1 functions
○ See the method processBlock
● RSA(input) = inpute mod n
{
return input.modPow(
key.getExponent(), key.getModulus());
}
● The implementation for RSA-1 is a bit involved (Chinese-Remainder Theorem)
○ To speed-up the computation of inputd mod n, it computes inputd mod p and mod q
10

Raw RSA (in Java)
public static byte[] encrypt(PublicKey pubKey, String message) throws Exception
{
Cipher cipher = Cipher.getInstance("RSA/ECB/NOPADDING");
cipher.init(Cipher.ENCRYPT_MODE, pubKey);
return cipher.doFinal(message.getBytes());
}
11

Deterministic behavior of Raw RSA (simple demo)
12
public class RSA_Encrypt {
public static void main(String [] args) throws Exception {
if(args.length != 3) {
System.out.println("Usage: RSA_Encrypt <modulus n> <exponent e> <plaintext>");
System.exit(-1);
}
BigInteger n = new BigInteger(args[0]);
BigInteger e = new BigInteger(args[1]);
String plaintext = args[2];
PublicKey pubKey = RSAService.getPublicKey(n, e);
byte[] ciphertext = RSAService.encrypt(pubKey, plaintext);
System.out.println(javax.xml.bind.DatatypeConverter.printHexBinary(ciphertext));
}
}

No change in the ciphertext for the same plaintext
13
dharmalingam_ganesan11@instance-1:~/crypto/RSA$ java RSA_Encrypt $n $e "It's all Greek to Me"
29B20484723BC302E3E1D13D763AA4CF8E43627B006B431DBE1C3B9887D3A34199CA5FC74B751501D86114DADB444
04563FB5B916E8CDC5EF0EBA43C244671B63493355EE00630114B27E1E154D806ADF94374E8B52BD1D0BFC0823C52
8BE0DA95774B172235E15345DB757173954E3E09CC7213AD77C6F6452F0B63008CF773E5E2369A3CDE3A94B925849
B59410D04B1B5FCB8BD54EA545CEECEFE6BB77BD7E9ABB54D8DF2764471F6C23A66E65B1D5D7266E7E669B0C7AC1C
889420C6B81689CD9965E528F6D94297C6AB95A510A0BB380E22F99B20ABDFE3837459D8AFF6F552F7B20BD908DBE
A2906C8809A1A50F4209025C8BEB561DC58E56F13894C44
dharmalingam_ganesan11@instance-1:~/crypto/RSA$ dharmalingam_ganesan11@instance-
1:~/crypto/RSA$ java RSA_Encrypt $n $e "It's all Greek to Me"
29B20484723BC302E3E1D13D763AA4CF8E43627B006B431DBE1C3B9887D3A34199CA5FC74B751501D86114DADB444
04563FB5B916E8CDC5EF0EBA43C244671B63493355EE00630114B27E1E154D806ADF94374E8B52BD1D0BFC0823C52
8BE0DA95774B172235E15345DB757173954E3E09CC7213AD77C6F6452F0B63008CF773E5E2369A3CDE3A94B925849
B59410D04B1B5FCB8BD54EA545CEECEFE6BB77BD7E9ABB54D8DF2764471F6C23A66E65B1D5D7266E7E669B0C7AC1C
889420C6B81689CD9965E528F6D94297C6AB95A510A0BB380E22F99B20ABDFE3837459D8AFF6F552F7B20BD908DBE
A2906C8809A1A50F4209025C8BEB561DC58E56F13894C44

Problem statement: Break the RSA trapdoor function
● Recall that c = RSA(m) = me mod n
○ c is the ciphertext and m is the plaintext
● Breaking of the RSA function means finding m from c
○ Equivalently, reverse the plaintext from the ciphertext
● Formally, given <c, e, n> find m such that RSA(m) = c
14

Chosen plaintext attack of RSA trapdoor function
● RSA is a deterministic function (recall the previous demo)
● RSA(m) is always the same for a given public key pair (e, n)
○ That is, the ciphertext is the same when the plaintext m is encrypted again
● In order to find the secret x, the attacker can try all possible m as follows:
○ RSA(u) where u = 0, 1, …, 2n-1
○ If RSA(u) = RSA(m), then the attacker learns that m must u
● Chosen plaintext attack is easy for small values of public n
● Scalability problem: For very large n (e.g., 1024 bits), it is not feasible to
explore the space of 21024 possibilities, for example
○ It is difficult even if the message size is just 64 bits
15

Meet-in-the-middle attack - Core Idea
● Recall that the goal is to find the plaintext m such that RSA(m) = c
● What if m can be rewritten as a product of smaller numbers: m = m1 . m2
● For example, this 64-bit message m = 9223372036854775808 can be
rewritten as a product of two 32-bit numbers:
○ m1 = 2147483648
○ m2 = 4294967296
● Meet-in-the-middle attack leverages this observation to speed-up the Chosen
Plaintext attack
○ Instead of trying all possible n-bit messages, it tries only messages of size n/2
● It breaks RSA when the unknown plaintext is a product of smaller numbers
○ There are still some scalability issues (will revisit later)
16

Meet-in-the-middle attack - Algorithm
● Assume that the unknown message m can be rewritten as a product of two
unknown smaller numbers: m = m1 . m2
● The goal of this attack is to find m1 and m2 from ciphertext c
● c = RSA(m) = me mod n
c = (m1. m2)e mod n
c = (m1
e. m2
e) mod n
c/m2
e = m1
e mod n
● Step 1: Construct a hashtable of the right hand side for all possible m1
● Step 2: For each possible m2 if c/m2
e is present in the hashtable, them m is
recovered by multiplying matching m1 with the current m2
17

Step 1: Hashtable H construction
18
Key Value
0e mod n 0
1e mod n 1
2e mod n 2
3e mod n 3
... ...
(m1-1)e mod n m1 - 1

Step 2: Search the Hashtable H
19
● Step 2.1: For each m2, compute c/m2
e mod n
● Step 2.2: Search whether the hashtable H has the key c/m2
e mod n
● Step 2.3: If yes, extract m1 = H(c/m2
e mod n)
○ Terminate the search. Return the plaintext m = m1 . m2
● Step 2.4: Else, goto Step 2.1 and try the next possible m2

Implementation Details: Key-Value Store
(Hashtable)public interface IKeyValueStore {
public void put(byte[] key, byte[] data);
public byte[] get(byte[] key);
public void close();
}
20
● This interface provides an abstraction of hashtable implementations
● Allows plug-and-play of different key-value pair libraries

Key-Value Implementation using Java Hashmap
public class KeyValueStoreHash implements IKeyValueStore {
private HashMap<ByteBuffer, byte[]> hashMap = new HashMap<ByteBuffer, byte[]>();
public KeyValueStoreHash() {
}
public void put(byte[] key, byte[] data) {
hashMap.put(ByteBuffer.wrap(key), data);
}
public byte[] get(byte[] key) {
return hashMap.get(ByteBuffer.wrap(key));
}
public void close() {
hashMap.clear();
}
} 21

Step 1: Hashtable construction (basic version)
public void buildHashTable() {
BigInteger two = BigInteger.valueOf(2);
BigInteger minM1 = two.pow(minNumBitsM1 - 1);
BigInteger maxM1 = two.pow(maxNumBitsM1);
for(BigInteger m1 = minM1; m1.compareTo(maxM1) < 0; m1 = m1.add(BigInteger.ONE)) {
byte[] m1PowE = m1.modPow(e, n).toByteArray();
keyValueStore.put(m1PowE, m1.toByteArray());
}
}
22

Step 2: Search the hashtable for a match
public BigInteger breakRSA(BigInteger c) {
BigInteger m = BigInteger.ZERO;
BigInteger two = BigInteger.valueOf(2);
BigInteger minM2 = two.pow(minNumBitsM2 - 1);
BigInteger maxM2 = two.pow(maxNumBitsM2);
for(BigInteger m2 = minM2; m2.compareTo(maxM2) < 0; m2 = m2.add(BigInteger.ONE)) {
BigInteger m2powe = m2.modPow(e, n);
byte[] lhs = c.multiply(m2powe.modInverse(n)).mod(n).toByteArray();
if(keyValueStore.get(lhs) != null) {
BigInteger m1 = new BigInteger(keyValueStore.get(lhs));
m = m1.multiply(m2);
System.out.println("Match m = " + m + " m1 = " + m1 + " m2 = " + m2);
break;
}
}
return m;
}
23

Demo client to break Raw RSA (2048-bit modulus)
24

Demo client to break RSA ...
25

~/crypto/RSA$ time java ClientRawRSA
Match m = 549986500608 m1 = 892928 m2 = 615936
The plaintext is: 549986500608
real 1m51.176s
user 1m1.520s
sys 0m4.176s
In ~1.5 min Raw RSA is broken
26

11 out of 50 random messages decrypted!
27
$ time java ClientRawRSArandom
# of successful RSA breaking = 11 out of 50
real 462m0.941s
user 314m21.392s
sys 21m22.772s

Conclusion/Discussion
28
● The main goal was to experiment with meet-in-the-middle attack
● This attack works when RSA is used without any padding
○ Meet-in-the-middle is much better than brute-forcing all possible plaintexts
● The attack is not scalable when the message length is longer than 8 bytes
○ May be upto 10 bytes when using a large farm of computers
● Nevertheless, the attack reverses the plaintext in the order of 2m/2 bits
○ Storage requirement: Need to be able to store 2m/2 rows in the key-value table
● In part-2, I will talk about using advanced databases to store large key-value
● RSA without random padding should be avoided

References
● W. Diffie and M. E. Hellman, “New Directions in Cryptography,” IEEE
Transactions on Information Theory, vol. IT-22, no. 6, November, 1976.
● R. L. Rivest, A. Shamir, and L. Adleman, “A method for obtaining digital
signatures and public-key cryptosystems,” CACM 21, 2, February, 1978.
● A. Menezes, P. van Oorschot, and S. Vanstone, “Handbook of Applied
Cryptography,” CRC Press, 1996.
● C. Paar and J. Pelzl, “Understanding Cryptography: A Textbook for Students
and Practitioners,” Springer, 2011.
● D. Boneh, A. Joux, and P. Nguyen, “Why Textbook ElGamal and RSA
Encryption are Insecure,” AsiaCrypt, 2000
29

RSA without Padding

More Related Content

What's hot (20)

Similar to RSA without Padding (20)

More from Dharmalingam Ganesan (17)

Recently uploaded (20)

RSA without Padding