Question: Collision - Resistant Hashing from RSA ( 2 5 pts ) Let N = pq be an RSA modulus and take e in N to

Collision-Resistant Hashing from RSA (25pts) Let N = pq be an RSA modulus and take e in N to be a prime that is also relatively prime to \phi (N). Let u $ Z N, and define the hash function HN,e,u : Z N \times {0,...,e 1}-> Z N where HN,e,u(x,y)= xeuy in Z N. In this problem, we will show that under the RSA assumption, HN,e,u defined above is collision resistant. Namely, suppose there is an efficient adversary A that takes as input (N,e,u) and outputs (x1,y1)=(x2,y2) such that HN,e,u(x1,y1)= HN,e,u(x2,y2). We will use A to construct an efficient adversary B that takes as input (N,e,u) where u $ Z N and outputs x such that xe = u in Z N.(a)(10pts) Show that using algorithm A defined above, algorithm B can efficiently compute a in ZN and b in Z such that ae = ub (mod N) and 0=|b|< e. Remember to argue why any inverses you compute will exist. (b)(15pts) Usetheabove relation to show how B can efficiently compute x in ZN suchthat xe = u. Note that B does not know the factorization of N, so B cannot compute b1(mod \phi (N)). Hint: What is gcd(b,e)?

Step by Step Solution

There are 3 Steps involved in it

1 Expert Approved Answer
Step: 1 Unlock blur-text-image
Question Has Been Solved by an Expert!

Get step-by-step solutions from verified subject matter experts

Step: 2 Unlock
Step: 3 Unlock

Students Have Also Explored These Related Databases Questions!