Efficient generation of shared RSA keysAuthors: D. Boneh and M. Franklin
We describe efficient techniques for a number of parties to jointly generate an RSA key. At the end of the protocol an RSA modulus N=pq is publicly known. None of the parties know the factorization of N. In addition a public encryption exponent is publicly known and each party holds a share of the private exponent that enables threshold decryption. Our protocols are efficient in computation and communication.
Journal of the ACM (JACM), Vol. 48, Issue 4, pp. 702--722, July 2001
Extended abstract in proceedings of Crypto '97
Full paper: PostScript [first posted 12/2000 ]