Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 5: Reconstruction of Primes given few of its Bits 86
from g i,j and h i,j respectively. Thus, one can calculate
det(L) =
[ m
∏
m−j
∏
j=0 i=0
X i+j Y j T m−j ][ m
∏
m−j
∏
j=0 i=1
X j Y i+j T m−j ]
= X s 1
Y s 2
T s 3
where s 1 = 1 2 m3 +m 2 + 1 2 m, s 2 = 1 2 m3 +m 2 + 1 2 m, and s 3 = 2 3 m3 + 3 2 m2 + 5 6 m.
To utilize resultant techniques and Assumption 1, we need two polynomials
f 1 (x,y), f 2 (x,y) which share the root (p 1 ,q 1 ) over integers. From Theorem 2.23,
we know that one can find such f 1 (x,y),f 2 (x,y) using LLL lattice reduction algorithm
[77] over L when det(L) < T mω , neglecting the small constants. Given
det(L) and ω as above, the condition becomes X s 1
Y s 2
T s 3
< T m((m+1)2) , i.e.,
X s 1
Y s 2
< T s 0
, where s 0 = m((m+1) 2 )−s 3 = 1 3 m3 + 1 2 m2 + 1 m. Putting the values
of the bounds X = Y = 2 τl N
6
, and neglecting o(m 3 ) terms, we get τ + τ < τ+η
2 2 3
and thus get the required bound for τ. Now, one can find the root (p 1 ,q 1 ) from
f 1 ,f 2 under Assumption 1.
This lattice based technique complements Algorithm 7 by overcoming one of
its limitations. As we discussed before, the search tree grows two-folds each time
we do not have any information about the bits of the primes. Hence in a case
where an initial chunk of LSBs is unknown for both the primes, one can not use
Algorithm7forreconstructionasitwouldrequirehugestoragespaceforthesearch
tree. This lattice based technique provides a feasible solution in such a case. We
present a few experimental results in Table 5.2 to illustrate the operation of this
technique.
# of Unknown # of Known Time in Seconds
bits (τl N ) bits (ηl N ) LLL Algorithm Resultant Root Extraction
40 90 36.66 25.67 < 1
50 110 47.31 35.20 < 1
60 135 69.23 47.14 < 1
70 155 73.15 58.04 < 1
Table 5.2: Experimental runs of the Lattice Based Technique with dimension 64.
The limitation of this technique is that it asks for double or more the number
of missing bits for both the primes. If one misses 60 LSBs for the primes say,
this method requires the next 120 or more bits of both the primes to be known to
reconstruct all 60 + 120 = 180 LSBs. In the practical scenario, the requirement