Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

97 6.1 Implicit Factoring of Two Large Integers
extended strategy of Section 2.6.2, we get
S = ⋃
{x i y j z k+k 1
: x i y j z k is a monomial of f m },
0≤k 1 ≤t
M = {monomials of x i y j z k f : x i y j z k ∈ S}.
It follows from the above definitions that
⎧
k = 0,...,m,
⎪⎨
x i y j z k+k 1
j = k,...,m,
∈ S ⇔
i = 0,...,m+k −j,
⎪⎩
k 1 = 0,...,t
⎧
k = 0,...,m+1,
⎪⎨
x i y j z k j = k,...,m+1,
∈ M ⇔
i = 0,...,m+k −j +1,
⎪⎩
k 1 = 0,...,t
We exploit t many extra shifts of z where t is a non-negative integer. Our aim is
to find two more polynomials f 0 ,f 1 that share the root (q 2 + 1,q 1 ,P 1 − P 1) ′ over
the integers. From Section 2.6.2, we know that these polynomials can be found by
lattice reduction if
X s 1
Y s 2
Z s 3
< W s , (6.1)
where s = |S|, s j = ∑ x i 1y i 2z i 3∈M\S i j for j = 1,2,3, and
W = ‖f(xX,yY,zZ)‖ ∞ ≥ N 1 X.
One can quite easily check the following.
s 1 = 1 2 m3 + 5 2 m2 +4m+2+2t+ 3 2 m2 t+ 7 2 mt,
s 2 = 5 6 m3 +4m 2 + 37 6 m+3+2t+ 3 2 m2 t+ 7 2 mt,
s 3 = 1 2 m3 + 5 2 m2 +4m+2+ 3 2 t2 + 7 2 t+ 3 2 m2 t+mt 2 + 9 2 mt,
s = 1 3 m3 + 3 2 m2 + 13
6 m+1+t+m2 t+2mt
Let t = τm, where τ is a nonnegative real number. Neglecting the lower order