2

I understand in theory how the common modulus attack works (as described here: how to use common modulus attack?)

Though, I did not understand completely how it worked with a negative $s_i$. Since $e_bs_1+e_cs_2=1$ one of the $s_i$ will be negative, so when I calculate $C_j^{s_i}$ it will be a fraction and not out of $\mathbb{Z}$.

From what I learned from the comments the trick is to calculate $(C_j^{-s_i})^{-1}=C_j^{s_i}$ instead. That way $-s_i$ is positive and $C_j^{-s_i}$ can be computed easily as well es the inverse $(C_j^{-s_i})^{-1}$ (using the Extended Euclidean algorithm). This solves my problem.

(I edited this question to specify my problem, answer it and to explain how it is different from how to use common modulus attack? in the hope that it won't be marked as duplicate anymore.)

Community
  • 1
stefanbschneider
  • 569
  • 1
  • 7
  • 19
  • 1
    Duplicate of how to use common modulus attack?. P.S. (from the help center) "please provide an indication of what you are not understanding/need clarification on and your attempts at solving it, so we have a clear indication of where you are stuck. This goes for all questions, not just homework. If you have just written out your assignment, your question will be closed." – mikeazo Jun 16 '14 at 16:42
  • 2
    As for what $C_j^{s_i}$ might mean if $s_i < 0$, well, remember that we're doing this modulo $N$. We have $a^{b} a^{c} = a^{b+c}$ for any $a, b, c$, so we have $a^{-b} a^{b} = a^0 = 1$. So, by $a^{-b}$, we mean that value which, when multiplied by $a^b$ (modulo $N$), we get one. And, we can find such values using the Extended Euclidean method. Does that help? – poncho Jun 16 '14 at 21:01
  • Yes, I wasn't sure if the $s_i$ were modulo N as well. But still, I struggle calculating the result for a specific example. I will update the question adding that example and my problem with it. – stefanbschneider Jun 17 '14 at 08:19
  • 2
    For the one that is negative, say $s_2$, you should calculate $c^{-s_2}\bmod{n}$ (that way $s_2$ is positive), then find the modular inverse of that value (mod n). – mikeazo Jun 17 '14 at 12:02
  • Perfect, this solves my question! – stefanbschneider Jun 18 '14 at 12:36
  • 1
    @CGFoX Thanks for updating. I'm still hesitant to reopen the question. First, questions shouldn't have answers in the question. Second, if you remove the answer, you are right, it probably shouldn't be considered a duplicate, but the new question is off topic as it is more about math than crypto (yes, the application is crypto, but it is really the math). – mikeazo Jun 19 '14 at 13:47
  • I'm aware of the answer being in the question. But as soon as it is reopened I could move it to the answer section (not possible at the moment). You're right, the problem's solution is mathematical, but I can imagine some other people struggeling with the common modulus attack, which is crypto, might find the question + answer useful. So, I guess it is not really off-topic since it helps understand a crypto problem. But if you feel it's off-topic go ahead and delete it. – stefanbschneider Jun 20 '14 at 15:50
  • CGFox, rather than editing your question here, it would be better to propose an edit to the answer on the other thread that adds a clarification of how to deal with a negative exponent, i.e., what it means to raise to the $s_1$ power if $s_1$ is negative. – D.W. Jun 26 '14 at 00:10

0 Answers0