Sampling from Signed Quadratic Residues: RSA Group Is Pseudofree

Abstract

Rivest (TCC 2004) explored the notion of a pseudo-free group from cryptographic perspective. He made the conjecture that the RSA group $\mathbb{Z}_{N}^{*}$ is a plausible pseudo-free group. Daniele Micciancio proved that (to appear in Journal of Cryptology), under strong RSA assumption, $\mathbb{Z}_{N}^{*}$ is pseudo-free. The proof uses the fact that N is the product of two safe primes, and elements are sampled uniformly at random from the subgroup QR _N of quadratic residues. He asked whether the proof can be carried over if elements are sampled uniformly at random from the whole of $\mathbb{Z}_{N}^{*}$. In this article, we show that one can sample uniformly at random from the subgroup $QR_{N}^{+}$ of signed quadratic residues to prove that $\mathbb{Z}_{N}^{*}$ is pseudo-free. Consequently, we believe one can show $\mathbb{Z}_{N}^{*}$ pseudo-free where elements are sampled from $QR_{N} \cup QR_{N}^{+}$, thus enlarging the set from which elements are sampled.