Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

105 6.1 Implicit Factoring of Two Large Integers
f(x,y,z,v,t) = f ′ (x,y + 1,z,v,t) = N 1 N 3 + N 1 N 3 y − N 1 N 2 z − N 3 N γ 2
xyv −
N 3 N γ 2
xv+N 2 N γ 2
xzt. The root (x 0 ,y 0 ,z 0 ,v 0 ,t 0 ) of f is (q 1 ,q 2 −1,q 3 ,P 1 −P ′ 1,P 1 −
P ′′
1). The idea of modifying the polynomial with a constant term was introduced
in [28, Appendix A] and later used in [65] which we follow here.
Let X,Y,Z,V,T be the upper bounds of q 1 ,q 2 −1,q 3 ,P 1 −P ′ 1,P 1 −P ′′
1 respectively.
As given in the statement of this theorem, one can take X = N α ,Y =
N α ,Z = N α ,V = N β ,T = N β . Following the basic strategy of Section 2.6.2 ,
S = {x i 1
y i 2
z i 3
v i 4
t i 5
: x i 1
y i 2
z i 3
v i 4
t i 5
is a monomial of f m },
M = {monomials of x i 1
y i 2
z i 3
v i 4
t i 5
f : x i 1
y i 2
z i 3
v i 4
t i 5
∈ S}.
It follows that,
x i 1
y i 2
z i 3
v i 4
t i 5
∈ S ⇔
x i 1
y i 2
z i 3
v i 4
t i 5
∈ M ⇔
⎧
⎪⎨
⎪⎩
⎧
⎪⎨
⎪⎩
i 3 = 0,...,m,
i 5 = 0,...,i 3 ,
i 4 = 0,...,m−i 3 ,
i 2 = 0,...,m−i 3 ,
i 1 = i 4 +i 5 ,
i 3 = 0,...,m+1,
i 5 = 0,...,i 3 ,
i 4 = 0,...,m+1−i 3 ,
i 2 = 0,...,m+1−i 3 ,
i 1 = i 4 +i 5 .
From [65], we know that these polynomials can be found by lattice reduction if
X s 1
Y s 2
Z s 3
V s 4
T s 5
< W s , (6.5)
where s = |S|, s j = ∑ x i 1y i 2z i 3v i 4t i 5∈M\S i j,
for j = 1,2,3,4,5, and W = ‖f(xX,yY,zZ,vV,tT)‖ ∞ ≥ N 1 N 3 Y ≈ N 2+α .
Thus, we have the following.
s =
m∑
i 3
∑
m−i
∑ 3
m−i
∑ 3
i 3 =0 i 5 =0 i 4 =0 i 2 =0
1,