Efficient generation of shared RSA keys

Authors: D. Boneh and M. Franklin

We describe efficient techniques for a number of parties to jointly generate an RSA key. At the end of the protocol an RSA modulus N=pq is publicly known. None of the parties know the factorization of N. In addition a public encryption exponent is publicly known and each party holds a share of the private exponent that enables threshold decryption. Our protocols are efficient in computation and communication.

Journal of the ACM (JACM), Vol. 48, Issue 4, pp. 702--722, July 2001
Extended abstract in proceedings of Crypto '97

Full paper: PostScript         [first posted 12/2000 ]