# Questions tagged [roca]

ROCA is an acronym for "Return of the Coppersmith Attack" — a vulnerability in the RSALib cryptographic software library thought to be used in millions of smart cards and other devices.

6 questions
Filter by
Sorted by
Tagged with
126 views

### RSALib prime generation - derive number of primes

I'm working on factorizing a ~450 bit key that I know has been generated with RSALib and thus is vulnerable to ROCA. Now reading the original paper, I can see that the primes are generated in the ...
• 421
289 views

### ROCA Implementation, Coppersmith Algorithm does not return roots

We are currently trying to reproduce the implementation of the ROCA-Paper. Therefore we calculated $M'$ from $M$ and $Order_M'$ from $Order_M$ to reduce the search space, but when we hand these values ...
• 31
380 views

### How ROCA get the polynomial used with coppersmith

I'm trying to understand the ROCA attack on RSA from Matus Nemec et al. but I'm stuck on how they goes from the constraint they have expressed has: $$f(x) = x ∗ M' + (65537^{a'} \mod M') \pmod p$$ To ...
• 41
223 views

### Biased RSA moduli and ROCA

Say I can generate many 1024-bit RSA public keys $(N,e)$ with fixed public exponent $e = 65537$. They turn out to be heavily biased when computing $N \bmod x$ for small primes $x$. These congruences ...
• 33
2k views

### How does the ROCA attack work?

I have been trying to understand the ROCA attack described here as the "First Attack" and I cannot follow the explaination. I have been trying to generate a 512-bits key and crack it. As far as I can ...
• 71