dissertacao.pdf

avoided. It should be noted that, on their work, Boneh and Durfee claim their
conviction that the small inverse problem can solved even for δ < 0.5.
Blomer and May[3], based on the Boneh-Durfee attack, presented a new
heuristic attack for solving the small inverse problem for δ < 0.290. Though
they do not improve the previous existing bound, their attack is simpler to
analyse.
Their main result, again dependant on Conjecture 1, is presented now. This
is the general result, where the encryption exponent e is not assumed to be of
the same magnitude of N, that is, α = 1.
Theorem 30. For every ɛ > 0, there exists an N0 such that for every N > N0
the following holds: Let N = pq be an RSA modulus and p, q balanced primes,
e = N α the encryption exponent and d = N δ its corresponding decryption
exponent defined modulo φ(N) such that
δ < 2
5
− 3
5
1
α + 4α2 − 2α + 4 − ɛ.
5
Then N can be factored in time polynomial in log(N), provided that Conjecture
1 holds.
We can see that setting α = 1 yields the bound δ < 0.29.
50