Efficient generation of shared RSA keys [chapter]

Dan Boneh, Matthew Franklin
1997 Lecture Notes in Computer Science  
We describe efficient techniques for three (or more) parties to jointly generate an RSA key. At the end of the protocol an RSA modulus N = pq is publicly known. None of the parties know the factorization of N. In addition a public encryption exponent is publicly known and each party holds a share of the private exponent that enables threshold decryption. Our protocols are efficient in computation and communication.
doi:10.1007/bfb0052253 fatcat:yh76lhcge5flvgsg3ksy2pfxce