Questions tagged [roca]

ROCA is an acronym for "Return of the Coppersmith Attack" — a vulnerability in the RSALib cryptographic software library thought to be used in millions of smart cards and other devices.

Filter by
Sorted by
Tagged with
3 votes
0 answers

RSALib prime generation - derive number of primes

I'm working on factorizing a ~450 bit key that I know has been generated with RSALib and thus is vulnerable to ROCA. Now reading the original paper, I can see that the primes are generated in the ...
S. L.'s user avatar
  • 421
3 votes
1 answer

ROCA Implementation, Coppersmith Algorithm does not return roots

We are currently trying to reproduce the implementation of the ROCA-Paper. Therefore we calculated $M'$ from $M$ and $Order_M'$ from $Order_M$ to reduce the search space, but when we hand these values ...
R4ph4e1's user avatar
  • 31
4 votes
2 answers

How ROCA get the polynomial used with coppersmith

I'm trying to understand the ROCA attack on RSA from Matus Nemec et al. but I'm stuck on how they goes from the constraint they have expressed has: $$f(x) = x ∗ M' + (65537^{a'} \mod M') \pmod p$$ To ...
needle's user avatar
  • 41
3 votes
1 answer

Biased RSA moduli and ROCA

Say I can generate many 1024-bit RSA public keys $(N,e)$ with fixed public exponent $e = 65537$. They turn out to be heavily biased when computing $N \bmod x$ for small primes $x$. These congruences ...
RSAvgb's user avatar
  • 33
7 votes
1 answer

How does the ROCA attack work?

I have been trying to understand the ROCA attack described here as the "First Attack" and I cannot follow the explaination. I have been trying to generate a 512-bits key and crack it. As far as I can ...
John's user avatar
  • 71
40 votes
1 answer

What is “Fast Prime”?

In this note, the manufacturer of a RSA key generation gizmo vulnerable to the new ROCA attack (see second section) explains that it is common practice to employ acceleration algorithms in order to ...
fgrieu's user avatar
  • 138k