Paper 2026/2167

New Applications of RSA

Abstract

We present new constructions of the following primitives featuring succinct communication: - Batch threshold encryption: Assuming RSA and DCR, we construct a threshold encryption scheme in which a batch of ciphertexts can be decrypted via short hints from a quorum of decryptors. Previously, this was known only from bilinear maps. - Aggregate signatures: Assuming RSA, we construct a signature scheme where signatures on different messages from an arbitrary number of signers can be aggregated into one signature. Our construction achieves bounded-query security. In contrast to prior (fully secure) schemes in the standard model, ours makes black-box use of cryptography. - Broadcast encryption: Assuming RSA, we construct a secret-key encryption scheme where a sender can encrypt a message to multiple recipients via a short ciphertext. Our construction achieves bounded-query security. Previously, (fully secure) broadcast encryption was known from bilinear maps or obfustopia or nonstandard lattice assumptions. Our constructions are simple and achieve optimal succinctness in the key parameter (decryption batch size or number of signers or recipient set size). In this metric, they outperform or match known constructions. Our results are obtained by applying the lens of projective pseudorandom generators (PPRGs) to these problems. Towards this, we identify new enhanced properties for PPRGs and instantiate them from the RSA assumption.