Improved Security Proof for Modular Exponentiation Bits

Abstract

For exponentiation function modulo a composite $f_{g,N}(x)=g^x \mod N$, where $|N|=n$, an elegant algorithm is constructed by Goldreich and Rosen to reprove that the upper and lower half bits of this function are simultaneously hard separately under the factoring intractability assumption. Here we improve their algorithm to reduce the time by a factor $\mathcal {O}(\log n\epsilon ^{-1})$. If error probability $\frac{1}{2^{(1-1/2c)m}}$ is tolerated, the reduced factor could be $\mathcal {O}((n\epsilon ^{-1})^{1/2c})$ for a constant $c\ge 2$.

This work is partially supported by NSF No. 61272039.