摘 要: 1982年，Quisquate和Couvreur提出了一种RSA的变型算法，称为RSA–CRT算法，这是一种基于中国剩余定理的能够加速RSA解密的算法。1990年，Wiener提出了另外一种RSA的变型算法，称为重新平衡–RSA，进一步通过把解密成本转移到加密成本上来加速RSA解密。但是，因为公开指数e通常和RSA系数是同一量级，所以这种方法实质上最大化了加密时间。在本文中，我们介绍两种重新平衡–RSA变型算法，它们的公开指数e比模量更加的小，因此能够在保持较低解密成本的同时有效地减少加密成本。对于一个1024位的RSA模量，我们的第一种变型算法（方案Ａ）的加密时间比原始的重新平衡–RSA算法的加密时间快至少2.6倍，而第二种变型算法（方案Ｂ）提供的加密时间至少比原来快３倍。在两种变型算法中，降低加密成本是以轻微地增加解密成本和增加核心生产成本为代价的。因此，这里提出的变型算法式是最适合应用在需要降低加密和解密成本的地方。关键字：RSA CRT 加密 数字签名 格基减化 密码分析学

-Abstract:　In 1982, Quisquater and Couvreur proposed an RSA variant, called RSA-CRT, based on the Chinese Remainder Theorem to speed up RSA decryption. In 1990, Wiener suggested another RSA variant, called Rebalanced-RSA, which further speeds up RSA decryption by shifting decryption costs to encryption costs. However, this approach essentially maximizes the encryption time since the public exponent e is generally about the same order of magnitude as the RSA modulus. In this paper, we introduce two variants of Rebalanced-RSA in which the public exponent e is much smaller than the modulus, thus reducing the encryption costs, while still maintaining low decryption costs. For a 1024-bit RSA modulus, our fi rst variant (Scheme A) offers encryption times that are at least 2.6 times faster than that in the original Rebalanced-RSA, while the second variant (Scheme B) offers encryption times at least 3 times faster. In both variants, the decrease in encryption costs is obtained at the expe