Chosen Ciphertext Attack Against RSA: Scenario 1

• Eve collects c. She needs m, for which m = cd

• she chooses random r < n, she gets Bob’s public key and then computes

x = r e mod n => x d = r ed mod n

=> x d = r mod n

y = xc mod n

t = r -1 mod n

Eve gets Bob to sign y with his private key. Bob sends Eve

u =y d mod n.

Now Eve computes

tu mod n = r -1 y d mod n = r -1 x d c d mod n

= c d mod n = m.

Previous slide

Next slide

Back to first slide

View graphic version