Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 6: Implicit Factorization 96
second and we could successfully collect the root.
6.1 Implicit Factoring of Two Large Integers
Here we present the exact conditions on p 1 ,q 1 ,p 2 ,q 2 under which N 1 ,N 2 can be
factored efficiently. Throughout this chapter, we will consider p 1 ,p 2 are primes of
same bitsize and q 1 ,q 2 are primes of same bitsize. Also N 1 = p 1 q 1 and N 2 = p 2 q 2
are of same bitsize. We use N to represent an integer of same bitsize as of N 1 ,N 2 .
6.1.1 The General Result
We first consider the case where some amount of LSBs as well as MSBs of p 1 ,p 2
are same. Based on this, we present the following generalized theorem.
Theorem 6.1. Let N 1 = p 1 q 1 and N 2 = p 2 q 2 , where p 1 ,q 1 ,p 2 ,q 2 are primes. Let
q 1 ,q 2 ≈ N α . Consider that γ 1 log 2 N many MSBs and γ 2 log 2 N many LSBs of
p 1 ,p 2 are same. Let β = 1 − α − γ 1 − γ 2 . Under Assumption 1, one can factor
N 1 ,N 2 in polynomial time if 1− 3 β −2α ≥ 0 and
2
−4α 2 −2αβ − 1 4 β2 +4α+ 5 β −1 < 0.
3
Proof. It is given that γ 1 log 2 N many MSBs and γ 2 log 2 N many LSBs of p 1 ,p 2 are
same. Thus, we can write p 1 = N 1−α−γ 1
P 0 +N γ 2
P 1 +P 2 and p 2 = N 1−α−γ 1
P 0 +
N γ 2
P ′ 1 + P 2 . Thus, p 1 − p 2 = N γ 2
(P 1 − P ′ 1). Since N 1 = p 1 q 1 and N 2 = p 2 q 2 ,
putting p 1 = N 1
q 1
and p 2 = N 2
q 2
, we get N γ 2
(P 1 −P ′ 1)·q 1 q 2 −N 1 q 2 +N 2 q 1 = 0. Thus
we need to solve f ′ (x,y,z) = N γ 2
xyz −N 1 x+N 2 y = 0 whose root corresponding
to x,y,z are q 2 ,q 1 ,P 1 −P ′ 1 respectively. Since there is no constant term in f ′ , we
define a new polynomial as follows.
f(x,y,z) = f ′ (x−1,y,z) = N γ 2
xyz −N γ 2
yz −N 1 x+N 1 +N 2 y
The root (x 0 ,y 0 ,z 0 ) of f is (q 2 +1,q 1 ,P 1 −P ′ 1).
Let X,Y,Z be upper bounds of q 2 +1,q 1 ,P 1 −P ′ 1 respectively. As given in the
statement of this theorem, we can take X = N α ,Y = N α ,Z = N β . Following the