Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 6: Implicit Factorization 106
s 1 =
s j =
m+1
∑
i 3
∑
i 3 =0 i 5 =0
m+1
∑∑i 3
i 3 =0 i 5 =0
m+1−i
∑ 3
i 4 =0
m+1−i
∑ 3
i 4 =0
m+1−i
∑ 3
i 2 =0
m+1−i
∑ 3
i 2 =0
(i 4 +i 5 )−
i j −
m∑
m∑
i 3
∑
m−i
∑ 3
i 3 =0 i 5 =0 i 4 =0 i 2 =0
∑i 3 m−i
∑ 3 m−i
∑ 3
i 3 =0 i 5 =0 i 4 =0 i 2 =0
m−i
∑ 3
(i 4 +i 5 ),
i j , for j = 2,3,4,5.
Simplifying, one can check that
s = s 5 = 1
12 m4 + 2 3 m3 + 23
12 m2 + 7 3 m+1,
s 1 = 5
24 m4 + 7 4 m3 + 127
24 m2 + 27
4 m+3,
s 2 = s 4 = 1 8 m4 + 13
12 m3 + 27 8 m2 + 53
12 m+2,
s 3 = 1 6 m4 + 4 3 m3 + 23
6 m2 + 14
3 m+2.
Neglecting the lower order terms and putting the values of X,Y,Z,V,T as well as
the lower bound of W, from (6.5), we get the condition as
5
12 α+ 5
24 β − 1 6
< 0 i.e., 10α+5β −4 < 0. (6.6)
That is, when this condition holds, according to [65], we get four polynomials
f 0 ,f 1 ,f 2 ,f 3 such that f 0 (x 0 ,y 0 ,z 0 ,v 0 ,t 0 ) = f 1 (x 0 ,y 0 ,z 0 ,v 0 ,t 0 )
= f 2 (x 0 ,y 0 ,z 0 ,v 0 ,t 0 ) = f 3 (x 0 ,y 0 ,z 0 ,v 0 ,t 0 ) = 0. Under Assumption 1, we can
extract x 0 ,y 0 ,z 0 ,v 0 ,t 0 in polynomial time.
In Theorem 6.9, we consider the Assumption 1. Let us now clarify how it
actually works. In the proof of Theorem 6.9, we consider that we will be able to
get at least four polynomials f 0 ,f 1 ,f 2 ,f 3 along with f, that share the integer root.
In experiments we found more than 4 polynomials (other than f) after the LLL
algorithm that share the same root. We calculate f 4 = R(f,f 0 ),f 5 = R(f,f 1 ) and
then f 6 = R(f 4 ,f 5 ). We always find a factor
t 0
−
gcd(t 0 ,v 0 ) v + v 0
gcd(t 0 ,v 0 ) t
of f 6 , though we do not have a theoretical proof for that. In all the cases, we
find gcd(t 0 ,v 0 ) ≤ 2. After getting t 0 ,v 0 , we define a new polynomial f 7 (y,z) =
f 4 (y,z,v 0 ,t 0 ). We always find a factor q 3 y−q 2 z +q 3 of f 7 . From this we can find
(y 0 ,z 0 ) = (q 2 − 1,q 3 ). Finally, putting the values of y 0 ,z 0 ,v 0 ,t 0 in f, we obtain