Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

103 6.1 Implicit Factoring of Two Large Integers
Theoretically, our method starts performing better, i.e., β in our case is greater
thanthatof[86], whenα ≥ 0.266. Thusforq 1 ,q 2 ≥ N 0.266 , ourmethodwillrequire
less number of LSBs of p 1 ,p 2 to be equal than that of [86]. This is also presented
in Figure 6.1. The numerical values of the theoretical results are generated using
the formulae β = 1−3α for [86] and Corollary 6.5 for our case. The experimental
results are generated by one run in each case with lattice dimension 46 (parameters
m = 2,t = 1) for 1000 bits N 1 ,N 2 . The values of α are considered in [0.1,0.5], in
a step of 0.01. Referring to Figure 6.1, we like to reiterate that our experimental
results outperforms the theoretical results presented by us as well as in [86].
The next example considers the primes p 1 ,p 2 of 650 bits and q 1 ,q 2 of 350 bits.
This is to demonstrate how our method works experimentally for larger q 1 ,q 2 .
Example 6.8. Here we consider 650-bit primes p 1 and p 2
3137055889901096909077531458327171120014878453383152732512530257276363
1682927852412187472737127637110371576377119667914195267603776880298856
76273831127205611509045644179511599106554189421550654601 and
2451436010930813903814310506086633020716328387757587411726661941127209
3212167405450016340904470370114412306604810975035552386405247674158894
80913091786359014934176726120292021849927924906510931081.
Note that p 1 ,p 2 share 531 many LSBs. Further, q 1 ,q 2 are 350-bit primes
1851420588886517478939713595303492404190382112791551597798571143339516
233613445774636517955322189132943773 and
2258350305148478218870025161325667637658623408855938899014758338949666
508115561055599847183651567682695481 respectively.
Given N 1 ,N 2 , with only the implicit information, we can factorize both of them
efficiently. We use lattice of dimension 105 (parameters m = 3,t = 2) and the
lattice reduction takes 15016.42 seconds.
Though our result does not generalize for the case where N 1 ,N 2 ,...,N k , we
like to compare the result of Example 6.8 with [86, Table 1, Section 6.2] when
α = 0.35 and N is of 1000 bits. This is presented in Table 6.2. One may note that
the idea of [86] requires 10 many N i ’s as the input where N i = p i q i , 1 ≤ i ≤ 10. In
such a case, 391 many LSBs need to be same for p 1 ,...,p 10 . On the other hand, we
require higher number of LSBs, i.e., 531 to be same, but only N 1 ,N 2 are needed.
The analysis of our results related to LSBs, presented in this section, will apply
similarly for our analysis related to MSBs or LSBs and MSBs taken together as