Bulk GCD Computation Using a GPU to Break Weak RSA Keys

• Published in: 2015 IEEE International Parallel and Distributed Processing Symposium Workshop pp. 385 - 394
• Main Authors: Fujita, Toru, Nakano, Koji, Ito, Yasuaki
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01-05-2015
• Subjects: Acceleration; Approximation algorithms; Approximation methods; CUDA; Encryption; Euclidean Algorithm; GPU; Graphics processing units; Instruction sets; Parallel Algorithm
• DOI: 10.1109/IPDPSW.2015.54

RSA is one the most well-known public-key cryptosystems widely used for secure data transfer. An RSA encryption key includes a modulus n which is the product of two large prime numbers p and q. If an RSA modulus n can be decomposed into p and q, the corresponding decryption key can be computed easily from them and the original message can be obtained using it. RSA cryptosystem relies on the hardness of factorization of RSA modulus. Suppose that we have a lot of encryption keys collected from the Web. If some of them are inappropriately generated so that they share the same prime number, then they can be decomposed by computing their GCD (Greatest Common Divisor). Actually, a previously published investigation showed that a certain ratio of RSA moduli in encryption keys in the Web are sharing prime numbers. We may find such weak RSA moduli n by computing the GCD of many pairs of RSA moduli. The main contribution of this paper is to present a new Euclidean algorithm for computing the GCD of all pairs of encryption moduli. The idea of our new Euclidean algorithm that we call Approximate Euclidean algorithm is to compute an approximation of quotient by just one 64-bit division and to use it for reducing the number of iterations of the Euclidean algorithm. We also present an implementation of Approximate Euclidean algorithm optimized for CUDA-enabled GPUs. The experimental results show that our implementation for 1024-bit GCD on GeForce GTX 780Ti runs more than 80 times faster than the Intel Xeon CPU implementation. Further, our GPU implementation is more than 9 times faster than the best known published GCD computation using the same generation GPU.