What is multi-prime RSA (RSA-MP)?

Question

I found some related question but no real explanation of what it is and when and why to use it. What are the benefits and downsides and is it recommended?

Possible duplicate of Are there any standards of multi-prime RSA key generation? — kelalaka, Feb 04 '19 at 08:45
It's history and some benefits are also discussed here: https://crypto.stackexchange.com/questions/14552/who-first-published-the-interest-of-more-than-two-prime-factors-in-rsa — VincBreaker, Feb 04 '19 at 08:47
@Erwin Is your question answered by any of these Q/A's? If yes, which one. If no, what's missing? — Maarten Bodewes, Feb 05 '19 at 01:11

score 4 · Accepted Answer · answered Feb 04 '19 at 08:47

Multi-prime RSA is simply using more than 2 prime numbers in generating RSA public key - The public modulus would have more than 2 factors.

We use it because it has more efficient key-generation and decryption/signing operation, which is the benefit of it.

The downside being it might be easier to factor a multi-prime RSA public key than a dual-prime one.

It's neither recommended or recommended against, it's simply an possible option without any endorsement.

note that the primes must be distinct. – kelalaka Feb 04 '19 at 08:51 — kelalaka, Feb 04 '19 at 08:51

score 2 · Answer 2 · edited Jun 07 '22 at 14:58

2

The security of Multi-prime RSA is analyzed in Jason Hinek's PhD Thesis which can be accessed at

On the Security of Some Variants of RSA, Jason Hinek, 2007

In this thesis, Hinek writes

...Considering all of the known attacks on multi-prime RSA (with or without CRT decryption), the evidence suggests that multi-prime RSA with a safe number of primes is no less secure than RSA...

edited Jun 07 '22 at 14:58

kelalaka

48,443
11
116
196

answered Jun 07 '22 at 11:28

Srinivasa Rao Subramanya Rao

21
2

1

With "safe number of primes" essentially defined as "no less secure than (biprime) RSA", that conclusion is certainly true! – fgrieu Jun 07 '22 at 11:38
1

@fgrieu By "safe", he's referring back to the rest of the paper, esp. Tables 5.1 and 7.2; it's not "only" trivially true. – JamesTheAwesomeDude Aug 31 '22 at 21:16
@JamesTheAwesomeDude: yes, table 5.1 is relevant. It's a (too) much shortened version of table 1 from cited work, correctly summarized. Indeed, if referring to this, the sentence is more than a tautology. Table 7.2 is about dual RSA, thus irrelevant to that citation. – fgrieu Sep 01 '22 at 05:33

What is multi-prime RSA (RSA-MP)?

2 Answers2