Fast Fully-Distributed and Threshold RSA Function Sharing

Distributed primality tests for the purpose of testing the factors of the jointly generated RSA modulus were always considered as a nightmare due to the large amount of time required for these tests to succeed. Enormous number of trials must be performed before a suitable RSA modulus is established. In the honest-but-curious scenario, in this paper we propose an efficient extention to the three-party protocol of [31] to allow n parties to share the generation of a RSA modulus N and to share the secret key d. The protocol enjoys the following properties: • The protocol is very fast compared to previous protocols since there is no need for any distributed primality tests after the RSA modulus is generated. A suitable RSA modulus is generated from the first trial. • The protocol can generate a RSA modulus which is a composite of safe primes. • The protocol is t-private where t is a small threshold. This small threshold is suitable since the protocol is extremely fast giving no chance for an eveasdropping adversary to exceed a small threshold. • The protocol is able to tolerate crashes of at most n− (2t+ 1) players.