We build on an approach of Kiltz et al. (CRYPTO ’10) and bring new techniques to bear on the study of how “lossiness” of the RSA trapdoor permutation under the $\Phi$-Hiding Assumption ($\Phi$A) can be used to understand the security of classical RSA-based cryptographic systems. In particular, we show that, under $\Phi$A, several questions or conjectures about the security of such systems can be reduced to bounds on the regularity (the distribution of the primitive $e$-th roots of unity mod $N$) of the ``lossy'' RSA map (where $e$ divides \Phi(N)). Specifically, this is the case for: (i) showing that large consecutive runs of the RSA input bits are simultaneously hardcore, (ii) showing the widely-deployed PKCS #1 v1.5 encryption is semantically secure, (iii) improving the security bounds of Kiltz et al. for RSA-OAEP. We prove several results on the regularity of the lossy RSA map using both classical techniques and recent estimates on Gauss sums over finite subgroups, thereby obtaining new results in the above applications. Our results deepen the connection between “combinatorial” properties of exponentiation in $\Z_N$ and the security of RSA-based constructions.
Join work with Mark Lewko and Adam Smith.