Factorization and Malleability of RSA Moduli, and Counting Points on Elliptic Curves Modulo N

Abstract

In this paper we address two different problems related with the factorization of an RSA (Rivest-Shamir-Adleman cryptosystem) modulus N. First we show that factoring is equivalent, in deterministic polynomial time, to counting points on a pair of twisted Elliptic curves modulo N. The second problem is related with malleability. This notion was introduced in 2006 by Pailler and Villar, and deals with the question of whether or not the factorization of a given number N becomes substantially easier when knowing the factorization of another one N′ relatively prime to N. Despite the efforts done up to now, a complete answer to this question was unknown. Here we settle the problem affirmatively. To construct a particular N′ that helps the factorization of N, we use the number of points of a single elliptic curve modulo N. Coppersmith's algorithm allows us to go from the factors of N′ to the factors of N in polynomial time.