Experimental Performance of Shared {RSA} Modulus Generation

Many distributed protocols require the participants to have secret shares of an RSA modulus in order to perform distributed cryptographic computations. Until recently, a trusted party was required to generate and distribute these secret shares before the start of the protocol. Recently, Boneh and Franklin introduced a protocol whereby participants could themselves generate the secret shares without revealing any information about their shares to each other. We experimentally evaluate the performance of their protocol and we recommend good choices for certain parameters of the protocol. Received November 10, 1998; revised November 22, 2000.