WO2004073253A2

WO2004073253A2 - Encryption method and device using an rsa-type cryptosystem

Info

Publication number: WO2004073253A2
Application number: PCT/ES2004/070007
Authority: WO
Inventors: Araceli Queiruga Dios; Luis ENCINAS HERNÁNDEZ; Jaime MUÑOZ MASQUÉ
Original assignee: Consejo Superior De Investigaciones Científicas
Priority date: 2003-02-14
Filing date: 2004-02-10
Publication date: 2004-08-26
Also published as: ES2217959B1; ES2217959A1; WO2004073253A3

Abstract

The invention relates to an encryption method and device using an RSA-type cryptosystem. More specifically, the invention relates to a method of selecting the private key of the RSA cryptosystem, once the encryption exponent e has been fixed, which, in addition to being secure against factoring attacks, is novel in that it is invincible to attacks based on the length of the W-B-D-type decryption exponents. The inventive private key selection method not only guarantees that e has the desired value and that the size of the decryption exponent d resists W-B-D-type attacks, but also that the size thereof is much greater than that recommended in order to prevent such attacks. In fact, the number of d bits is the maximum possible (the same as the number of bits of modulus n) or, at most, one bit less than the maximum.

Description

TITLE

ENCRYPTION PROCEDURE AND DEVICE BY AN RSA TYPE CRYPTOSYSTEM

OBJECT OF THE INVENTION

A procedure and device is presented to choose the keys of the RSA cryptosystem, with encryption exponent given in advance, which is invulnerable to attacks based on the length of the decryption exponents.

SECTORS OF THE TECHNIQUE IN WHICH IT HAS APPLICATION

• Cryptography

• Communications technologies

• Informatic security

• Electronic banking • Electronic commerce

STATE OF THE TECHNIQUE

There are currently different methods and algorithms that allow you to safely carry out the exchange of information in computer networks. Among them are the so-called public or asymmetric cryptosystems, characterized by the fact that two different key types are used. The first one (public key) is that which allows a sender to encrypt the message that he wishes to send to a recipient, and that is publicly known; the second (private key), known only to the recipient of the message, is what enables the recipient to retrieve the original message. ^'

On the other hand, it is well known that the most commonly used public key cryptosystem is called RSA ([RSA78]), whose name is derived from the initials of its three authors. Due to its great robustness, it is the cryptosystem that has received the most attention and on which more research has been carried out in order to try to break it, discovering its possible weaknesses.

The RSA cryptosystem protocol consists of several phases (see Fig. 1). The first one consists in determining the keys that each user will use (part A of Fig. 1); two other phases are those related to the encryption and decryption of the messages that they wish to send or receive (parts B and D of Fig. 1, respectively), while the intermediate phase corresponds to that of the transmission of the encrypted message (part C of Fig. 1). Here we will stop exclusively in the first phase, the establishment of the keys. To choose a user's keys, two large prime numbers, p and q, must be selected and multiplied to obtain the RSA module: n = p ^• q. This number determines that the group that said user will use will be Z „. The encryption exponent is then chosen, e, with 1 <e <phi (ή) = (p - \) (q - 1), so that it is a prime number with phi (ή), that is, it must be verify: mcd (e, phi (ή)) = 1. Once e is chosen, its inverse module phi () is determined, that is, d is calculated with e ^• d = 1 (mod phi (n)). This done, the user's public key is the pair of numbers (n, e), while his private key is the number d. Obviously, should the values of prime numbers also be kept secret? and q.

When carrying out the practical implementations of this cryptosystem, it is essential that the encryption exponent, e, be small, so that the encryption process is fast and remains efficient when used in local and Intranets networks ([ MOV97]). In fact, the most recommended values are e = 3 (= 2 + l) and e = 65537 = 2 ¹⁶ + 1. The reasons for such choices are based on the fact that in both cases, the binary expression of the chosen exponent is very Simple and only requires a few mathematical operations.

On the other hand, the most studied attack to try to break this cryptosystem is to analyze the different ways of factoring the RSA module, which would allow to recover the private key and decipher, from it, any message encrypted with the public key. Indeed, if the factorization of n is achieved, it is easy to calculate the value of phi () = (p - l) (q - 1), and from that value it is immediate to calculate the decryption exponent d, since the key Encryption is publicly known; To avoid this type of attack it is recommended that the lengths of the prime numbers p and q, be large enough that such eventuality requires unfeasible computation times with the best available technology and the best known factorization algorithm. Hence, it is currently recommended that the size of the RSA module, n, be between 512 and 2048 bits, depending on the applications, which ensures the security of the cryptosystem against attacks based on module factorization. There are other attacks on the RSA cryptosystem that do not resort to the search for the prime factors of the RSA module. These attacks attempt to exploit the weakness of the fact that the length of the decryption exponent, d, is small.

From what has been said above about the importance of choosing an encryption exponent, e, verifying the conditions of being cousin conphi (n) and also small, it is clear that your choice directly determines the value of the decryption exponent, d, put which is its inverse module phi (ή). If this value of d is relatively small compared to that of n, there is an algorithm developed by Wiener ([Wie90]) ₅ based on the expression of a rational number by means of continuous fractions, which allows to calculate d efficiently , in a reasonable time. In fact, the algorithm developed by Wiener allows to calculate the value of da from the public key (n, é) in a polynomial time, provided that the number of bits of d is less than a quarter of the number of bits of n, that is, if d <n ⁰ ^'25 .

Interest in the attack on the decryption exponent has been increasing in the last five years, becoming the most effective cryptanalysis of the RSA, given the stagnation of the factorization attack. Thus, in [VT97] it is proved that it is possible to find the decryption exponent d, if d <n ° ' ⁵ in less time than with an exhaustive search, but this algorithm is only a slight improvement to that of Wiener since it requires time exponential if you have to d> n ^{0 5} . On the other hand, in [Bon99], [BDF98], [BV98] and [DNOO] other alternatives have been presented to attack the RSA cryptosystem based on the weakness of using small decryption exponents. However, until the appearance of the proposal by Boneh and Durfee ([BD00]) the Wiener algorithm has not really been improved, so that it is possible to recover a user's private key from his public key if the exponent of decryption verifies the following upper ^bound : d <n ⁰²⁹² . In addition, the experiments carried out by these two authors allow us to assume that the RSA can be broken efficiently by this type of algorithm if the number of bits of d is less than half of the number of bits of n; that is, if d <n ^0'5 .

Against these attacks based on the size of the decryption exponent there is only one protection, select d so that its size is as close as possible to that of module n. However, given the close relationship between the values of d and e, the value of one determines the value of the other. To date, no alternative that is efficient to protect against attacks of the Wiener-Boneh-Durfee (WBD) type has been proposed. In fact, the only two possibilities that exist are: either to repeat the choice of the encryption exponent e, if its corresponding decryption exponent does not verify the dimension d> n ⁰⁵ , until a d is found that does; or choose first the decryption exponent d, so that its number of bits is greater than half the number of bits of n, as many times as necessary so that its corresponding value of e verifies the condition of being prime with phi (ή). Either of these two alternatives, which ensures a correct choice of the eyd exponents (although it may require a high number of iterations) does not guarantee that the value of e is as desired or the most convenient for certain real work environments.

Our invention makes it possible to guarantee a correct choice of the RSA cryptosystem keys, that is, the decryption exponent d and the prime numbers? and q, so that it is invulnerable against WBD-type attacks, once the encryption exponent e has been chosen beforehand. In fact, the number of bits of d differs from that of n in, at most, one bit, which guarantees its security against the aforementioned attacks, even if the level d> n ⁰ ' ⁵ recommended in the literature is exceeded in the future. The algorithm that we propose for the choice of the keys affects the choice of the prime factors of the module n, but not its size, so it does not jeopardize the cryptosystem against attacks by factorization.

REFERENCES

[Bon99] D. Boneh, "Twenty years of attacks on the RSA cryptosystem", Notices Amer.

Math Soc. 46, 2 (1999), 203-213. [BDOO] D. Boneh and G. Durfee, "Cryptanalysis of RSA with prívate key d less than n ^0292, IEEE Trans. Inform. Theory 36, 4 (2000), 1339-1349.

[BDF98] D. Boneh, G. Durfee and Y. Frankel, "An attack on RSA given a small fraction of the prívate key bits", Proc. of Asiacrypt'98, LNCS 1514 (1998), 25-34. [BV98] D. Boneh and R. Venkatesan, "Breaking RSA may not be equivalent to factoring", Proc. ofE rocrypt'98, LNCS 1233 (1998), 59-71 /

[DNOO] G. Durfee and P. Q. Nguyen, "Cryptanalysis of the RSA schemes with short secret exponent from Asiacrypt'99", Proc. of Asiacrypt'00, LNCS 1976 (2000), 14-29. [LIP] htip: //www.und.edu/org/cιypto/crypto/numbers/programs/freelip/ [MOV97] A. Menezes, P. van Oorschot and S.Vanstone, Handbook of Applied Cryptology, CRC Press, Boca Mouse, FL., 1997. [Rie94] H. Riesel, "Prime numbers and computer methods for factorization",

Birkhauser, Boston, 1994. [RSA78] R. L. Rivest, A. Shamir and L. Adleman, "A method for obtaining digital signatures and public-key cryptosystem", Commun. ACM21 (1978), 120-126.

[VT97] ER Verheul and HCA van Tilborg, "Cryptanalysis of less short 'RSA secret exponents", Appl. Algebra Engrg. Comm. Comput 8 (1997), 425-435. [Wie90] MJ Wiener, "Cryptanalysis of short RSA secret exponents", IEEE Trans. Inform. Theory 36, 3 (1990), 553-558. [Wil] JP Williams, http://www.mindspring.com/~pate/ EXPLANATION OF THE INVENTION Brief description of the invention

As we have already mentioned in the statement of the State of the Art, the general scheme of the devices that allow the choice of a user's keys for the RSA cryptosystem (see Fig. 2), follows the following steps:

1. Choice and verification of initial parameters.

2. Choice and verification of the public key.

3. Determination of the private key. 4. Publication of the public key.

More precisely, the protocol followed for the choice of RSA keys is as follows (see Fig. 3):

1. Random choice of two large odd numbers p and q.

2. Verification of the primality of such numbers.

3. Calculation of the RSA module, n -p ^• q, and the value phi (ή) = (p - ϊ) (q - 1).

4. Choice of encryption exponent 1 <e <phi (rí).

5. Checking the coprimacy between e and phi (n): mcd (e, phi (n)) = 1. 6. Calculation of the decryption exponent d, verifying e ^• d- 1 (mod phi (ri)).

7. Publication of the public key (n, é).

In this invention a procedure is presented that allows the private key of the RSA cryptosystem to be chosen, once the exponent, and, of encryption, which in addition to being secure against attacks by factorization, is presented in advance, presents the novelty that it is invulnerable to attacks based on the length of the decryption exponents of the WBD type.

With the method of choosing the private key that we present, it is not only guaranteed that the value of e will be the desired one and that the size of the decryption exponent d will resist attacks of the WBD type, but also that its size is much larger than the recommended to avoid these attacks. In fact, the number of bits of d is the maximum possible (the same as the number of bits of the module n) or at most one bit less than the maximum. Detailed description of the invention

As already mentioned, both the choice of the public key, (n, e), and the private one, (p, q, d), of the RSA cryptosystem must verify certain conditions: the numbers p and q must be large cousins with In order to avoid attacks on the factorization of the module n = p ^• q, e must be a cousin with phi (ri) and d must verify the condition e - d = 1 (mod phi (n)).

This last condition can be rewritten in the form e ^• d = 1 + k ^• phi (ή), where k is an integer. On the other hand, the greatest value that k can take is e - 1, in which case it is necessary to d> 2 ^• phi (ή) / 3, from which it can be ensured that the bit length of d is greater than or equal to than the bit length of n minus one unit. Thus, if k = e - 1 is considered, it is guaranteed that the choice of the key d makes the cryptosystem invulnerable in relation to attacks of the WBD type.

On the other hand, for the equality k = e - 1 to be verified, it is enough to choose the cousins p and q in an appropriate way. This choice is the one proposed as a new protocol for choosing keys. In general, the prime numbers p and q must verify the following conditions, which can be simplified for particular cases of the encryption exponent, since they only depend on their remains by being divided by the number e:

mcd ((/? mod é) ^• ((? mod e) - 1) mod e, é) = 1,

ca ((q mod é) ^• ((q mod é) - 1) mod e, é) = 1,

q = ((p mod e) I ((p mod é) - 1)) (mod e).

Note that the conditions of the cousins pyq are symmetric. Note also that the verification of these properties requires very little computing time, since they only require additions, multiplications and modular divisions. For simplicity when presenting the protocols and figures for the choice of the private key that we propose, we will describe three protocols according to the possible values chosen for the encryption exponent e: (1) e = 3, (2) e is a cousin and greater than 3, and (3) e is not a cousin. or

Case (1): e = 3

In this situation, the protocol presented in Fig. 4 is very similar to the one that is followed in the usual way and that was shown in Fig. 3. However, the one that concerns us in this case is more efficient than the standard mentioned since, as noted above, it determines a decryption exponent d of a size similar to that of n, therefore, it is not necessary to check whether it meets the requirements to be safe against WBD attacks. Note that in this case you have p (mod é) = 2 and q (mod é) = 2 for being /? and q cousins, so there are no restrictions when selecting both cousins, except those of the RSA cryptosystem.

Case (2): e is a prime number greater than 3

If e> 3 is a prime number, any prime number s other than e verifies the condition

mcd ^ s mod é) ^• ((s mod é) - 1) (mod e), é) = 1,

Therefore, the first two conditions for the choice of cousins p and q of the RSA private key do not need to be evaluated. Thus, in this case, the only condition to be checked, assuming that cousin p is chosen arbitrarily, is the second condition of cousin q, that is:

q = ((p mod e) I ((p mod é) - 1)) (mod é).

Note that, under the Dirichlet Theorem (see, for example, [Rie94]) there are infinite cousins of the form

q = ((p mod é) I ((p mod é) - 1)) (mod é) + k ^• e,

since ((p mod é) I (p mod e - 1)) (mod é) ye are cousins, yes. In Fig. 5 you can see the protocol proposed for the selection of the keys in this case. Case (3): e is not a cousin

In the case where the encryption exponent is chosen so that it is not a prime number, it should be verified that the three conditions of the prime numbers p and q, presented above, are verified, that is,

mcd ((/? mod é) ^• ((p mod é) - 1) (mod e), e) = l,

cd ((q mod é) ^• ((q mod é) - 1) (mod é), e) = 1,

q = ((p mod e) / ((p mod e) - 1)) (mod e).

The protocol corresponding to this more general case is the one detailed in Fig. 6.

The algorithm for the execution of the described encryption procedure is implemented as a computer program, which in turn is stored in data storage devices or in general in the hardware or software of devices to be used to generate encryption keys by the method object of the present invention.

DESCRIPTION OF THE FIGURES

Figure 1. General scheme of the RSA cryptosystem

In this figure the RSA cryptosystem protocol is outlined, characterized by a first phase in which the keys (part A) of each user are generated, consisting of the public key, n and e, and the private key, p, q and d; a second phase in which the encryption of the message to be sent (part B) is carried out by the recipient's public key; another phase in which the encrypted message is transmitted (part C), and finally, a fourth phase (part D) in which the received message is decrypted, using both the public and private keys of the recipient.

Figure 2. General scheme of the device for choosing RSA keys

This figure presents the generic process that is proposed in the literature to use (see for example, [MOV97]) for the choice of RSA cryptosystem keys.

Figure 3. Protocol for the choice of RSA keys

Figure 3 develops more precisely the process presented in Fig. 2.

In this case, the choices of the numbers to be carried out are indicated, as well as the properties that should verify them. Once this protocol is concluded, the selected keys guarantee the security of the cryptosystem against attacks based on the factorization of whole numbers, not against those of the W-B-D type.

Figure 4. Proposed protocol for the choice of RSA keys if 6 = 3

This figure presents the protocol proposed in this invention for the simplest case, that is, the one in which the encryption exponent is e = 3. In this case, since it has been proven that for any values of the cousins pyq, the bit length of d guarantees the invulnerability of the cryptosystem, no more calculations are needed than those necessary to ensure the security of the cryptosystem against attacks by factorization. Figure 5. Proposed protocol for the choice of RSA keys if e> 3 is a cousin

Figure 5 presents the protocol proposed for the case where the encryption exponent is a prime number greater than 3. In this case, as the prime numbers verify some of the properties that are required to ensure that the size of the exponent of decryption is the same as that of the RSA module, and since one of them can be chosen arbitrarily, it is only necessary to check the remaining property for the other cousin.

Figure 6. Proposed protocol for the choice of RSA keys if e is not a cousin This last figure shows the protocol to be followed in the case where the encryption exponent is a composite number. It can be observed that in this situation the number of operations to be carried out is greater than in the two previous cases, given that the three conditions indicated above must be verified.

DETAILED EXHIBITION OF AN EMBODIMENT OF THE INVENTION Description

The following describes a possible implementation of how to select the keys of the RSA cryptosystem so that its invulnerability to attacks against the length of the decryption exponent is guaranteed. In addition, the recommended lengths of the prime numbers to be used will be taken into account in order to avoid attacks by module factorization. For the generation of probable prime numbers and for the verification of their primality, we will make use of already published algorithms, such as the Maurer and Miller-Rabin algorithms, respectively ([LIP], [MOV97, Section 4.2. 3] and [Wil]).

On the other hand, given that 3 different cases have been presented, depending on the three types of possible values that can be assigned to the encryption exponent e, three practical determinations of the keys will be presented, with real values, that is, they can be used in any real practical implementation. Case (1): e = 3.

Since in the case where e = 3 there are no conditions on the prime numbers to consider, it will be enough to generate two prime numbers of adequate size. In this case we have generated two prime numbers of 256 bits each and we have verified their primality.

p = 62829 48472 00557 61013 33297 33663 58267 27705 82457 48782 00223 43981 8431944253 36099 07.

q = 67065 73203 18715 00610 08904 41826 05542 82723 07003 07589 14104 48393 48205 73092 24783 83.

The values of n yphi (n) are determined below:

n = 42137 05385 93582 46537 63075 08503 22022 56011 20970 30565 27299 67417 46746 43033 53103 77287 89217 79492 11878 92507 98771 92539 93307 28683 09293 0048627779 55060 33000 16214 0381.

phi (n) = 42137 05385 93582 46537 63075 08503 22022 56011 20970 30565 27299 67417 46746 43033 53103 75988 94001 04299 39262 69085 97017 02901 83202 99788 4872929342 99855 79735 07826 70605 2092.

Subsequently, the cryptosystem decryption exponent is determined:

d = 28091 36923 95721 64358 42050 05668 81348 37340 80646 87043 51533 11611 64497 62022 35402 50659 29334 02866 26175 12723 98011 35267 88801 99858 99152 86228 66570 53156 7188447070 1395,

which, as you can see, has a size similar to that of n. In fact, the number of bits of n is [log ₂ (n)] + 1 = 511, while that of ¿/ is [log ₂ (¿t)] + 1 = 510.

Thus, the public key is formed by the numbers (n, e), while the private one consists of d. Case (2): e is a prime number greater than 3, for example e = 65537 = 2 ¹⁶ + 1.

For this case, as one of the prime numbers can be chosen arbitrarily, we select the first prime number as one of the employees in the previous case, that is,

To choose the other prime number, we just have to make sure that it meets the condition outlined above, that is,

q = (p mod 65537) / ((? mod 65537) - 1) (mod 65537).

Therefore, a prime number with the condition is searched

q = ((p mod 65537) / ((p mod 65537) - 1)) (mod 65537) + k ^• 65537,

for certain k, so that the size of q is approximately 256 bits, and its primality is analyzed. Done this, you get the prime number

q = 10923 11765 92649 32989 67586 26626 91602 34811 37968 07262 88543 93982 09000 1968448217789,

corresponding to the value

k = 166671005069883165077374043100715662116267098086010733469615

7742984397336.

Later the values of n yphi (n) are determined

n = 686293854068157357816099439675414869890960980147278833137895 836626083540928757986668300148 104595972683409247692904305241 5005604858988746776424166704035623. phi (ή) = 6862938540681573578160994396754148698909609801472788331 378958366260835409287407806021 688775955049635234 9202638284 856201184194002360366502102755722207928.

Finally, the cryptosystem decryption exponent is calculated:

d = 68628 33822 14791 04325 55028 89643 52944 00594 17104 76421 05315 85595 03103 78413 86366 57088 05338 01357 43319 06143 01389 94055 89249 37571 14425 03290 33506 23171 91909 89838 7457.

In this case the equality of length in bits between n and d is verified, since the number of bits of n is [log ₂ (π)] + 1 = 512, and that of is [log ₂ (<f)] + 1 = 512.

Thus, the public key is formed by the numbers (n, e), while the private one is the number d, whose length is the same as that of n.

Case (3): e is not a cousin, for example, e = 15.

In this case, we have to generate a prime number p of approximately 256 bits so as to verify the following condition:

mcd ((/? mod e) ^• ((p mod e) - 1) (mod e), e) = 1.

Such number may be as follows:

p = 80542 15650 60482 74761 06106 65103 93174 00647 29016 00204 23661 47659 9103.

A prime number is generated below, verifying the following conditions:

mcd ((<7 mod é) ^• ((q mod é) - 1) (mod e), e) = 1,

q = (p mod e) / ((p mod e) - 1) (mod e) + k ^• e, for some k, so that its size is around 256 bits:

q = 955421565060482747610610665107493174006412901100204236644765 58089,

corresponding to

k = 636952771005069883165077374043100715662116267098086010733469 6157742984397205

The computation of the values of n yphi () provides the following values:

n = 769530499628692511125805701417448426891699714970767103432966 4778486091 805594651791575795828892402485 70241 24094 1380551536 0534160152560877739040218786034167.

phi (n) = 7695304996286925111258057014174484268916997149707671034 329664778486091 8055944757057444943079274529624901994791 99106 880480404734349340836854307929254116976.

Finally, the value of for the previous data is easily determined and is:

d = 718228466320113010384085321322951865098919733972715963204102 0459920352351888177325361 528020732289431 65751 95139 1916642178 1711085392718114397354067303842511.

In this case, as in the previous ones, the public key is formed by the numbers (n, e), while the private one is the number d, whose length in bits is the same as that of n: [log ₂ (w )] + 1 = 512 = [log ₂ (¿)] + 1. Operation and implementation

The proposed scheme for the generation of the keys has been implemented as a

Maple 8.0 software notebook on a computer with two processors

Intel Pentiumτ _M -1000 Mhz, under Microsoft's Windows XP operating system. The computing time required to generate the keys depends on the initial choice of the encryption exponent, and, according to the three possible cases contemplated above; namely, (1) e = 3, (2) e is a prime number greater than 3, and (3) e is not a prime number.

To make an estimate of the required times in each of the above cases, the Notebook implemented for the examples included above has been executed.

(1) If e = 3, the time for the calculation of the value of d is negligible since the computation of the inverse module n is carried out in polynomial time (thousandths of a second for the standard values considered above). (2) If e is a prime number greater than 3, for example e = 2 ¹⁶ + 1 = 65537, the determination of the prime number q, the value of n and the computation of d requires less than

12.3 seconds

(3) If e is a non-prime number, for example, e-15, the calculation of the primes p and q, of n and the decryption exponent d, requires less than 19.8 seconds. In summary, it can be affirmed that the time necessary for the calculation of the decryption exponent with the protocol proposed in this invention, does not imply an increase in relation to the time required by the standard procedures to generate the prime numbers and the RSA module.

In addition, the execution that has been implemented can be considered somewhat slow since the libraries of the Maple 8 environment have been used, which does not carry out the compilation of the orders that are executed. For an optimization of the invention proposed here, it would be advisable to develop an implementation, in software or hardware, by means of an appropriate programming language. Applications of the invention

The applications of this invention are all those in which it is used in RSA cryptosystem since it refers to the process of key generation. Among other applications the following can be mentioned:

• Digital signature with the RSA cryptosystem.

• All public key encryption that uses the RSA cryptosystem as a key generator.

• Cryptosystems that implement RSA based on the group defined by an elliptical curve.

• Generation of pseudorandom numbers.

These applications are very useful in environments related to the following activities:

• Certification Authorities

• Military

• Banking

• Internet • Diplomatic Mail

Claims

1. Encryption procedure using an RSA type cryptosystem that includes the following steps: a) Random choice of two large odd numbers p and q as the first and second component of the private key. b) Verification of the primality of such numbers. c) Calculation of the RSA module, n = pq, and ydλox phi (ή) = (p - ϊ) (q - 1). d) Choice of encryption exponent 1 <e <phi (rí). e) Verification of coprimacy between e

mcd (e, phi (nj) = 1. f) Calculation of the decryption exponent d, checking e ^• d = 1 (mod phi (n)). g) Publication of the public key (n, e). characterized in that the prime numbers pyq are chosen so that the following conditions are verified: mcd ((p mod e) ^• ((p mod e) - 1) mod e, é) = 1, mcd ((g mod e) ^• ((q mod e) - 1) mod e,) = 1, q = ((p mod e) / ((p mod é) - 1)) (mod e).

2. Encryption procedure by means of an RSA type cryptosystem according to claim 1, characterized in that when e = 3 the following conditions are verified: p (mod e) = 2 and q (mod é) = 2 so there are no time restrictions to select? and q.

3. Encryption method by means of an RSA type cryptosystem according to claim 1, characterized in that when e is a prime number greater than 3 and one of the prime numbers, / ?, is chosen arbitrarily, the other prime number, q, must check the condition: q = ((p mod é) I ((p mod) - 1)) (mod é)

4. Encryption method by means of an RSA type cryptosystem according to claim 1, characterized in that when e is not a cousin, the numbers p and q are chosen so that the following conditions are verified: mcd ((? Mod e) ^• ((p mod e ) - 1) (mod e), é) = 1, mcd ((¿mod é) - ((q mod é) - 1) (mod e), e) = 1, q = ((p mod e) / ((p mod e) - 1)) (mod e)

5. Encryption procedure by means of an RSA type cryptosystem according to claims 1-4, characterized in that the algorithm for its execution is implemented as a computer program.

6. Device for generating encryption keys by means of an RSA cryptosystem consisting of an electronic system that implements in hardware or software an algorithm for the execution of the procedure according to claims 1-5.

7. Data storage device that can be used to generate encryption keys by means of an RSA cryptosystem, characterized in that it implements an algorithm for the execution of the method according to claims 1-5.