Method for decoding integer decomposition of RSA password

Abstract

The invention belongs to the technical field of RSA passwords, and particularly relates to an integer decomposition method for decoding an RSA password. Comprising the following steps: (1) constructing a probability calculation bit network according to a decomposed number in a public key; (2) sampling and updating; (3) using an updating algorithm associated with X and Y; (4) deriving an Euler function according to X and Y obtained through decomposition; and (5) carrying out reverse iteration by using an Euclidean division method to obtain a key. On the basis of ascertaining a local minimum state distribution rule, Gibbs updating is improved, a traditional X and Y independent updating mode is modified, instead, only X is updated, and updating of Y is associated with X based on local minimum distribution characteristics, so that the search range of X and Y is greatly reduced, and the integer decomposition efficiency is remarkably improved.

Description

Technical Field

[0001] The invention belongs to the technical field of RSA cipher, and in particular relates to a method for deciphering RSA cipher integer decomposition. Background Art

[0002] The integer factorization problem is the core of cracking the RSA cipher. The RSA cipher is widely used in scenarios such as electronic payment, digital signature, and identity authentication. Its public key contains N, and the private key is obtained by calculating p and q. Once N is decomposed, the private key can be easily deduced, thus threatening the entire encryption system. Usually, the integer N is obtained by multiplying two large prime numbers. That is, given an integer N, find the corresponding prime numbers p and q so that p×q=N. The security of RSA confidentiality depends on the difficulty of high-order integer factorization. Attackers cannot obtain p and q by decomposing N within an effective time, and thus cannot crack the ciphertext. Therefore, in order to improve the security of RSA, prime numbers with very large digits are usually used to generate N to increase the difficulty of decomposition. Conversely, in order to crack the RSA cipher, more advanced integer factorization methods also need to be developed.

[0003] The main methods currently are:

[0004] Shor's algorithm is a quantum algorithm, one of the algorithms specifically used to deal with integer decomposition problems. Its core idea is to use the periodicity of remainders. In theory, it can solve integer decomposition problems in polynomial time, which makes it a milestone in the field of quantum computing. However, the operating cost of this method is too high, and quantum computers need to operate at extremely low temperatures, which makes the use conditions too harsh. In addition, the number of quantum bits required to decompose high-order integers is huge, and currently quantum computers cannot provide a very large number of quantum bits for quantum computing.

[0005] The number field sieve method is based on algebraic number theory and uses algebraic structures and relationships in different number fields to reduce the computational complexity of factoring large integers. However, the number field sieve method involves a large amount of algebraic number theory and linear algebra calculations, which are difficult to implement and optimize. The high operating cost requires a large amount of hardware space, and the long running time often takes weeks or even months to run. In addition, the efficiency and success of the number field sieve method depends on some specific conditions and parameters. A slight deviation may lead to a sharp drop in performance, and it is highly dependent on parameters.

[0006] Annealing algorithm is one of the most classic and effective methods to solve combinatorial optimization problems. Integer decomposition is a typical combinatorial optimization problem. The simulation algorithm starts from a relatively high initial simulation temperature. With the continuous decrease of the temperature parameter, it combines the "certain probability" jump characteristics to randomly search for the global optimal solution of the objective function in the solution space, that is, the local optimal solution can be probabilistically jumped out and eventually tend to the global optimal. However, when the number of decomposed integers is large, there are a large number of local minimum solutions. During the annealing process, the state is still prone to fall into the local minimum. Therefore, it is usually only applicable to integer decomposition problems with a lower number of digits. Summary of the invention

[0007] The present invention mainly solves the problem that the annealing algorithm based on the coupled Ising model mentioned above is prone to fall into local minima when decomposing high-order integers, and the decomposition efficiency is low.

[0008] On the basis of finding out the distribution law of local minimum state, the present invention improves Gibbs update, modifies the traditional way of updating X and Y independently, and updates only X instead. Based on the characteristics of local minimum distribution, the update of Y is associated with X, thereby greatly reducing the search range of X and Y and achieving a very significant improvement in the efficiency of integer decomposition.

[0009] A method for deciphering RSA cipher integer decomposition comprises the following steps:

[0010] (1) Construct a probability calculation bit network based on the decomposed numbers in the public key;

[0011] Step (1) includes the following sub-steps:

[0012] The first step is to select a suitable probability computing network, including a classic bit or a probabilistic bit (p-bit) network, where each bit corresponds to a binary position;

[0013] The second step is to write X and Y in binary form, corresponding one to one with the bits in the network.

[0014] (2) Sampling and updating;

[0015] The specific method of step (2) is:

[0016] Use a random number generator to randomly generate the initial state; randomly select a bit, that is, x p , calculate the partial derivative of the system Hamiltonian H or the energy loss function E with respect to the bit, and obtain the input item I of the corresponding bit p :

[0017] or The difference between H and E lies in whether there is an interlayer coupling term.

[0018] Update the bits of X (or Y) as follows:

[0019] x p =sgn[f(I p )–r]

[0020] Here, f is a nonlinear function used to calculate the probability of bit value, sgn represents the sign function, the input is negative and the output is 0, the input is positive and the output is 1; r is a random number (0,1);

[0021] Update a bit selected by random sampling with a certain probability, and use the updated value to calculate the new partial derivative as the new input item for the next sampling; this step only updates the bit corresponding to X (or Y), and recalculates the current partial derivative as the new input item every time a bit is updated; on this basis, randomly select a bit again, and repeat the above sampling and updating process until each bit corresponding to X (or Y) is updated.

[0022] (3) Use the update algorithm that associates X with Y;

[0023] The specific method of step (3) is:

[0024] After X (or Y) is updated, N / X (or N / Y) is calculated to determine whether it is an integer; if it is an integer, the decomposition is successful and the correct X and Y are output; if the decomposition is not successful, Y (or X) is updated; the value of Y (or X) is associated with the current X (or Y) as the updated Y (or X), and X (or Y) is further updated according to the process of step (2) on this basis; thereafter, the process returns to the second step to perform a new round of sampling and updating.

[0025] (4) Derive the Euler function based on the decomposed X and Y;

[0026] (5) Use the Euclidean algorithm to iterate in reverse order to obtain the key.

[0027] The preferred technical solution of the present invention is:

[0028] A method for deciphering RSA cipher integer decomposition comprises the following steps:

[0029] (1) Construct a coupled p-bit network based on the quantum Ising model according to the factorized numbers in the public key;

[0030] The public key format is (N, E), where N is the number to be decomposed.

[0031] First, a simulated p-bit network is generated. Each p-bit corresponds to a binary bit, and the number of bits is determined by the size of the decomposed number N, which is the number of binary bits of the square root of N.

[0032] The second step is to add interlayer coupling and construct a coupled Ising model, which is used to approximately simulate the quantum Ising model so that the p-bit of each layer is associated with the corresponding p-bit of the adjacent layer.

[0033] The third step is to match the binary forms of X and Y with the p-bits in the network one by one.

[0034] (2) Sampling and updating;

[0035] Use a pseudo-random number generator to randomly generate the initial state. Randomly select a p-bit, that is, x p , calculate the partial derivative of the coupled system Hamiltonian H with respect to the p-bit, and obtain the input item I corresponding to the p-bit p :

[0036]

[0037] Based on the properties of p-bit, it is updated as follows:

[0038] x p =sgn[sigmoid(I p )–r]

[0039] Here, sigmoid is a nonlinear function for the standard p-bit value probability, sgn represents the sign function, the input is negative and the output is 0, and the input is positive and the output is 1; r is a pseudo-random number (0,1) used to simulate the random behavior of p-bit.

[0040] Use Gibbs sampling, that is, update a p-bit with a specific probability, and use the updated value to calculate the new partial derivative as the new input item for the next sampling. This step only updates the p-bit corresponding to X, and recalculates the current partial derivative as the new input item for each updated bit. On the basis of the above, randomly select a p-bit again, and repeat the above sampling and updating process until each p-bit corresponding to X is updated.

[0041] (3) Use the Gibbs update algorithm to associate X with Y;

[0042] After X is updated, N / X is calculated to determine whether it is an integer. If it is an integer, the decomposition is successful, and the correct X and Y are output. If the decomposition is still not successful, Y is updated. The present invention notes that the local minimum is located at the integer grid point closest to the hyperbola Y=F / X. Therefore, let the value of Y equal to N divided by the current X, and use this as the updated Y. On this basis, X is further updated according to the process (2). Thereafter, return to the second step to perform a new round of sampling and updating.

[0043] The traditional Gibbs sampling method for integer decomposition based on the quantum Ising model is to independently sample and update X and Y, traversing the entire two-dimensional plane, so the efficiency is not high. Based on the discovery that the local minimum state of the energy function is located near the Y=F / X hyperbola, the present invention first performs Gibbs sampling and updates X, and then updates Y and X by associating the hyperbolic function. The sampling range is reduced from the entire two-dimensional surface to the vicinity of a hyperbola, and N / X is used as the judgment method for the end of the program. Therefore, the decomposition efficiency is greatly improved.

[0044] (4) Calculate the Euler function

[0045] Calculate the Euler function, Z = (X-1) * (Y-1), which represents the number of numbers less than or equal to N that are coprime with N.

[0046] (5) Use the Euclidean algorithm to iterate in reverse order to obtain the key D

[0047] The E in the public key (N, E) is an arbitrarily selected number that is required to be less than Z and relatively prime to Z. The commonly used value is 65537. Use the Euclidean algorithm to calculate gcd(Z, E), record the quotient, and reversely iterate based on the recorded quotient to obtain the value of the key D. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a detailed flow chart of the technical solution of the present invention;

[0049] Figure 2 Decomposition effect diagram for traditional algorithms;

[0050] Figure 3 It is a decomposition effect diagram of the present invention. DETAILED DESCRIPTION

[0051] This embodiment uses Pycharm software to compile and simulate operation.

[0052] A common approach to integer decomposition problems is to transform them into optimization problems and construct a loss function E:

[0053] E=(XY-N) 2

[0054] Among them, X and Y are the factors to be determined, and N is the integer to be decomposed. On this basis, XY is written in binary form:

[0055]

[0056] Based on the above functional form, the present invention is as follows Figure 1 As shown, implement the program according to the following steps:

[0057] (1) Construct a coupled p-bit network based on the quantum Ising model;

[0058] First, generate a simulated p-bit network, where each p-bit corresponds to a binary bit.

[0059] The second step is to add interlayer coupling and construct a coupled Ising model, which is used to approximately simulate the quantum Ising model so that the p-bit of each layer is associated with the corresponding p-bit of the adjacent layer.

[0060] The third step is to match the binary forms of X and Y with the p-bits in the network one by one.

[0061] (2) Sampling and updating;

[0062] Use a pseudo-random number generator to randomly generate the initial state. Randomly select a p-bit, that is, x p , calculate the partial derivative of the Hamiltonian H of the coupled system with respect to the p-bit and obtain the following I p :

[0063]

[0064] The relationship between H and E is: H = E + J. J is the lateral coupling, which means the coupling between the p-bit and the p-bit of the adjacent layer. Based on the properties of the p-bit, it is updated as follows:

[0065] x p =sgn[sigmoid(I p )–r]

[0066] Here, sigmoid is a nonlinear function for the standard p-bit value probability, sgn represents the sign function, the input is negative and the output is 0, and the input is positive and the output is 1; r is a pseudo-random number (0,1) used to simulate the random behavior of p-bit.

[0067] Use Gibbs sampling, that is, update a p-bit with a specific probability, and use the updated value to calculate the new partial derivative as the new input item for the next sampling. This step only updates the p-bit corresponding to X, and recalculates the current partial derivative as the new input item for each updated bit. On the basis of the above, randomly select a p-bit again, and repeat the above sampling and updating process until each p-bit corresponding to X is updated.

[0068] (3) Use the Gibbs update algorithm to associate X with Y;

[0069] After updating X, calculate N / X and determine whether it is an integer. If it is an integer, the factorization is successful, and the correct X and Y are output. If the factorization is still not successful, update Y. The present invention notes that the local minimum is located at the integer lattice point closest to the hyperbola Y = F / X. Therefore, let the value of Y be equal to the quotient of N divided by the current X, and use this as the updated Y. On this basis, further update X according to the process in (2). Thereafter, return to the second step and perform a new round of sampling and updating.

[0070] The key generation method of RSA is as follows:

[0071] Select X and Y, calculate N = X * Y, and calculate Z = (X - 1) * (Y - 1);

[0072] Select an integer A, requiring 1 < A < Z and A is relatively prime to Z;

[0073] Calculate D such that D * A mod Z = 1, that is, the remainder of D * A divided by Z is 1;

[0074] Obtain the public key as (N, A) and the private key as (N, D);

[0075] If the RSA public key is known to be (100000099999829, 65537) currently, deduce its corresponding private key.

[0076] 1. Substitute 100000099999829 into the above method and obtain the factors by solving: 9999991 * 10000019;

[0077] Calculate Z = 9999990 * 10000018 = 100000079999820;

[0078] Record the process of dividing Z by 65537 by the Euclidean algorithm.

[0079] Derive D as 19291408081507 by reverse iteration of the process obtained in the third step.

[0080] Verification: 19291408081507 * 65537 mod 100000079999820 = 1, the private key derivation is successful, and the private key is (100000099999829, 19291408081507).

[0081] Traditional algorithms need to independently update X and Y, which is equivalent to sampling in a two-dimensional coordinate plane. The algorithm of the present invention confines the sampling range to the vicinity of the hyperbola Y = F / X, only updates X, and updates Y in association with X, significantly reducing the search range and greatly reducing the computational amount, thus improving the computational efficiency. For example, as Figure 2 and Figure 3, to decompose the integer 12337337, the traditional Gibbs update requires an average of 10,000 times to successfully decompose, while the update method of the present invention only requires less than 5 times.

Claims

1. A method for deciphering RSA cipher integer decomposition, characterized in that: The following steps are involved: (1) Construct a probability calculation bit network based on the decomposed numbers in the public key; (2) Sampling and updating; (3) Use the update algorithm that associates X with Y; (4) Derive the Euler function based on the decomposed X and Y; (5) Use the Euclidean algorithm to iterate in reverse order to obtain the key.

2. A method for deciphering RSA cipher integer decomposition according to claim 1, characterized in that: Step (1) includes the following sub-steps: The first step is to select a suitable probability computing network, including a classic bit or a probabilistic bit network, where each bit corresponds to a binary position; The second step is to write X and Y in binary form, corresponding one to one with the bits in the network.

3. A method for deciphering RSA cipher integer decomposition according to claim 1, characterized in that: The specific method of step (2) is: Use a random number generator to randomly generate the initial state; randomly select a bit, that is, x p , calculate the partial derivative of the system Hamiltonian H or the energy loss function E with respect to the bit, and obtain the input item I of the corresponding bit p : or Among them, the difference between H and E is whether there is an interlayer coupling term; Update the bits of X or Y as follows: x p =sgn[f(I p )–r] Here, f is a nonlinear function used to calculate the probability of bit value, sgn represents the sign function, the input is negative and the output is 0, the input is positive and the output is 1; r is a random number (0,1); Update the bit selected by random sampling with the set probability. The next sampling uses the updated value to calculate the new partial derivative as the new input item. This step only updates the bit corresponding to X or Y, and recalculates the current partial derivative as the new input item every time a bit is updated. On this basis, randomly select a bit again, and repeat the above sampling and updating process until every bit corresponding to X or Y is updated.

4. A method for deciphering RSA cipher integer decomposition according to claim 3, characterized in that: The specific method of step (3) is: After X or Y is updated, N / X or N / Y is calculated to determine whether it is an integer; if it is an integer, the decomposition is successful and the correct X and Y are output; if the decomposition is not successful, Y or X is updated; the value of Y or X is associated with the current X or Y, which is used as the updated Y or X, and X or Y is further updated according to the process of step (2) on this basis; thereafter, the process returns to the second step to perform a new round of sampling and updating.

Images