Santanu Sarkar

Revisiting Prime Power RSA

Recently Sarkar (DCC 2014) has proposed a new attack on small decryption exponent when RSA Modulus is of the form N = p r q for r ? 2 . This variant is known as Prime Power RSA. The work of Sarkar improves the result of May (PKC 2004) when r ? 5 . In this paper, we improve the work of Sarkar when 2 < r ? 8 .We also study partial key exposure attack on Prime Power RSA. Our result improves the works of May (PKC 2004) when r ? 8 and the decryption exponent d < N 1 r + 1 + 3 r - 2 3 r + 3 + 3 3 ( r + 1 ) .

Observing biases in the state: case studies with Trivium and Trivia-SC

One generic model of stream cipher considers updating the states and then combining the state bits to produce the key-stream. In case there are biases in the state bits, that may be reflected on the key-stream bits resulting certain weaknesses (distinguisher and/or key recovery) of the cipher. In this context, we study the state biases as well as key-stream biases with great details. We first experiment with cube testers and heuristically obtain several distinguishers for Trivium running more than 800 rounds (maximum 829) with cube sizes not exceeding 27. Further, we apply our techniques to analyze Trivia-SC (the stream cipher used in TriviA-ck AEAD scheme, selected in second round of CAESAR competition) and obtain distinguishers till 950 rounds with a cube size of 25 only. On Trivia-SC, our results refute certain claims made by the designers against both cube and slide attacks. Our detailed empirical analysis provides new results in reduced-round cryptanalysis of Trivium and Trivia-SC.

Cryptanalysis of Variants of RSA with Multiple Small Secret Exponents

In this paper, we analyze the security of two variants of the RSA public key cryptosystem where multiple encryption and decryption exponents are used with a common modulus. For the most well known variant, CRT-RSA, assume that n encryption and decryption exponents

Cryptanalysis of an RSA variant with moduli N=prql

e_l,d_{p_l},d_{q_l}

A Differential Fault Attack on Plantlet

el,dpl,dql, where

Differential Fault Analysis on Tiaoxin and AEGIS Family of Ciphers

l=1,\cdots ,n