![](bg8.png)
Fiorini, C., Martinelli, E., and Massacci, F. (2003). How to
fake an rsa signature by encoding modular root find-
ing as a sat problem. Discrete Applied Mathematics,
130(2):101–127.
Golle, P. and Wagner, D. (2007). Cryptanalysis of a cog-
nitive authentication scheme (extended abstract). In
Proceedings of the 2007 IEEE Symposium on Secu-
rity and Privacy, SP ’07, pages 66–70, Washington,
DC, USA. IEEE Computer Society.
Halderman, J. A., Schoen, S. D., Heninger, N., Clarkson,
W., Paul, W., Calandrino, J. A., Feldman, A. J., Ap-
pelbaum, J., and Felten, E. W. (2009). Lest we re-
member: cold-boot attacks on encryption keys. Com-
munications of the ACM, 52(5):91–98.
Henecka, W., May, A., and Meurer, A. (2010). Correct-
ing errors in rsa private keys. In Proceedings of
the 30th annual conference on Advances in cryptol-
ogy, CRYPTO’10, pages 351–369, Berlin, Heidel-
berg. Springer-Verlag.
Heninger, N. and Shacham, H. (2009). Reconstructing rsa
private keys from random key bits. In In CRYPTO,
pages 1–17.
Homsirikamol, E., Morawiecki, P., Rogawski, M., and Sre-
brny, M. (2012). Security margin evaluation of sha-3
contest finalists through sat-based attacks. In Com-
puter Information Systems and Industrial Manage-
ment, volume 7564 of Lecture Notes in Computer Sci-
ence, pages 56–67. Springer Berlin Heidelberg.
Kamal, A. and Youssef, A. (2010). Applications of sat
solvers to aes key recovery from decayed key sched-
ule images. In Emerging Security Information Systems
and Technologies (SECURWARE), 2010 Fourth Inter-
national Conference on, pages 216 –220.
Maitra, S., Sarkar, S., and Sen Gupta, S. (2010). Fac-
toring rsa modulus using prime reconstruction from
random known bits. In Proceedings of the Third
international conference on Cryptology in Africa,
AFRICACRYPT’10, pages 82–99, Berlin, Heidel-
berg. Springer-Verlag.
Massacci, F. (1999). Using walk-sat and rel-sat for crypto-
graphic key search. In Proceedings of the Sixteenth In-
ternational Joint Conference on Artificial Intelligence,
IJCAI ’99, pages 290–295, San Francisco, CA, USA.
Morgan Kaufmann Publishers Inc.
Massacci, F. and Marraro, L. (2000). Logical cryptanalysis
as a sat problem. J. Autom. Reason., 24(1-2):165–203.
Meng, X. and Bi, J. (2011). Weak keys in rsa with primes
sharing least significant bits. In Information Security
and Cryptology, pages 278–287. Springer.
Mironov, I. and Zhang, L. (2006). Applications of sat
solvers to cryptanalysis of hash functions. In Proceed-
ings of the 9th international conference on Theory and
Applications of Satisfiability Testing, SAT’06, pages
102–115, Berlin, Heidelberg. Springer-Verlag.
Mohamed, M., Bulygin, S., and Buchmann, J. (2011). Us-
ing sat solving to improve differential fault analysis of
trivium. pages 62–71. Springer.
Morawiecki, P. and Srebrny, M. (2010). A sat-based
preimage analysis of reduced keccak hash func-
tions. http://eprint.iacr.org/2010/285. pawelm@wsh-
kielce.edu.pl 14742 received 13 May 2010.
Paterson, K., Polychroniadou, A., and Sibborn, D. (2012).
A coding-theoretic approach to recovering noisy rsa
keys. Advances in Cryptology–ASIACRYPT 2012,
pages 386–403.
Patsakis, C. (2013). Rsa private key reconstruction from
random bits using sat solvers. IACRCryptology ePrint
Archive, 2013:26.
Rivest, R. L. and Shamir, A. (1985). Efficient factoring
based on partial information. In EUROCRYPT, pages
31–34.
Santanu, S., Sourav Sen, G., and Subhamoy, M. (2011). Re-
construction and Error Correction of RSA Secret Pa-
rameters from the MSB Side. In WCC 2011 - Work-
shop on coding and cryptography, pages 7–16, Paris,
France.
Sarkar, S. (2011). Partial key exposure: Generalized frame-
work to attack rsa. In Progress in Cryptology - IN-
DOCRYPT 2011, volume 7107 of Lecture Notes in
Computer Science, pages 76–92. Springer Berlin /
Heidelberg.
Soos, M. (2009). Cryptominisat - a sat solver for cryp-
tographic problems. http://planete.inrialpes.fr/∼soos/
CryptoMiniSat2/index.php.
Soos, M. (2010). Grain of Salt — an Automated Way
to Test Stream Ciphers through SAT Solvers. In
Tools’10: Proceedings of the Workshop on Tools for
Cryptanalysis 2010, pages 1–2, RHUL.
Soos, M., Nohl, K., and Castelluccia, C. (2009). Extending
sat solvers to cryptographic problems. In Proceedings
of the 12th International Conference on Theory and
Applications of Satisfiability Testing, SAT ’09, pages
244–257, Berlin, Heidelberg. Springer-Verlag.
Steinfeld, R. and Zheng, Y. (2001). An advantage of low-
exponent rsa with modulus primes sharing least signif-
icant bits. Topics in Cryptology-CT-RSA 2001, pages
52–62.
Sun, H., Wu, M., Wang, H., and Guo, J. (2008a). On the
improvement of the bdf attack on lsbs-rsa. In Infor-
mation Security and Privacy, pages 84–97. Springer.
Sun, H.-M., Wu, M.-E., Steinfeld, R., Guo, J., and Wang,
H. (2008b). Cryptanalysis of short exponent rsa with
primes sharing least significant bits. In Franklin, M.,
Hui, L., and Wong, D., editors, Cryptology and Net-
work Security, volume 5339 of Lecture Notes in Com-
puter Science, pages 49–63. Springer Berlin Heidel-
berg.
Yuen, H. and Bebel, J. (July 18, 2011). Toughsat. http://
toughsat.appspot.com.
Zhao, Y. and Qi, W. (2007). Small private-exponent attack
on rsa with primes sharing bits. Information Security,
pages 221–229.
SECRYPT2013-InternationalConferenceonSecurityandCryptography
460