Improved security proof for modular exponentiation bits

Abstract

For exponentiation function modulo a composite fg,N(x) = gx mod N, where |N| = n, an elegant algorithm is constructed by Goldreich and Rosen to reprove that the upper and lower half bits of this function are simultaneously hard separately under the factoring intractability assumption. Here we improve their algorithm to reduce the time by a factor O(log nε−1). If error probability 1/2(1-1/2c)m is tolerated, the reduced factor could be O((nε−1)1/2c) for a constant c ≥ 2.