The RSA Group is Pseudo-Free

We prove, under the strong RSA assumption, that the group of invertible integers modulo the product of two safe primes is pseudo-free. More specifically, no polynomial time algorithm can output (with non negligible probability) an unsatisfiable system of equations over the free abelian group generated by the symbols g1, . . . , gn, together with a solution modulo the product of two randomly chosen safe primes when g1, ..., gn are instantiated to randomly chosen quadratic residues. Ours is the first provably secure construction of pseudo-free abelian groups under a standard cryptographic assumption, and resolves a conjecture of Rivest (TCC 2004).

• Type: Conference
• Year: 2005
• Where: EUROCRYPT
• Authors: Daniele Micciancio
• Keywords: Abelian Groups, Cryptography, EUROCRYPT 2005, Safe Primes, Strong Rsa Assumption