Small primitive roots and malleability of RSA

Abstract

In their paper [9], P. Paillier and J. Villar make a conjectur e about the malleability of an RSA modulus. In this paper we present an ex plicit algo- rithm refuting the conjecture. Concretely we can factorize an RSA modulus n using very little information on the factorization of a conc rete n ′ coprime to n . However, we believe the conjecture might be true, when impo sing some extra conditions on the auxiliary n ′ allowed to be used. In particular, the paper shows how subtle the notion of malleability is