Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 6: Implicit Factorization 108
at the middle leaving the γ 1 log 2 N many MSBs and γ 2 log 2 N many LSBs. Then
under Assumption 1, we can factor both N 1 ,N 2 if there exist τ 1 ,τ 2 ≥ 0 for which
h(τ 1 ,τ 2 ,α,γ 1 ,γ 2 ) < 0 where γ = max{γ 1 ,γ 2 } and
(
h(τ 1 ,τ 2 ,α,γ 1 ,γ 2 ) =
3τ 1 τ 2 + 7 3 τ 1 + 7 3 τ 2 + 17 )
α
24
(
+ τ1τ 2 2 + 3 2 τ 1τ 2 + 3 4 τ2 1 + 2 3 τ 1 + 2 3 τ 2 + 1 )
6
(
+ τ 1 τ2 2 + 3 2 τ 1τ 2 + 3 4 τ2 2 + 2 3 τ 1 + 2 3 τ 2 + 1 6
−
(
τ 1 τ 2 + τ 1
2 + τ 2
2 + 1 8
)
(1+γ) < 0.
γ 1
)
γ 2
Proof. We can write p 1 = N 1−α−γ 1
p 10 + N γ 2
p 11 + p 12 , and p 2 = N 1−α−γ 1
p 20 +
N γ 2
p 11 + p 22 . So p 1 − p 2 = N 1−α−γ 1
(p 10 − p 20 ) + (p 12 − p 22 ). Since p 1 = N 1
q 1
and
p 2 = N 2
q 2
we have N 1 q 2 −N 2 q 1 −N 1−α−γ 1
(p 10 −p 20 )q 1 q 2 −(p 12 −p 22 )q 1 q 2 = 0. Thus
we need to solve f ′ (x,y,z,v) = N 1 x−N 2 y −N 1−α−γ 1
xyz −xyv = 0 whose root
corresponding to x,y,z,v are q 2 ,q 1 ,p 10 −p 20 ,p 12 −p 22 respectively. Since there is
no constant term in f ′ , we define a new polynomial
f(x,y,z,v) = f ′ (x−1,y,z,v)
= N 1 x−N 2 y −N 1 −N 1−α−γ 1
xyz
+N 1−α−γ 1
yz −xyv +yv.
The root (x 0 ,y 0 ,z 0 ,v 0 ) of f is (q 2 +1,q 1 ,p 10 −p 20 ,p 12 −p 22 ). Let X = N α ,Y =
N α ,Z = N γ 1
,V = N γ 2
. Then we can take X,Y,Z,V as the upper bound of
x 0 ,y 0 ,z 0 ,v 0 respectively.
Following the extended strategy of Section 2.6.2, we have the following definitions
of S,M, where m,t 1 ,t 2 are non-negative integers.
S =
⋃
0≤j 1 ≤t 1 ,0≤j 2 ≤t 2
{x i 1
y i 2
z i 3+j 1
v i 4+j 2
: x i 1
y i 2
z i 3
v i 4
is a monomial of f m },
M = {monomials of x i 1
y i 2
z i 3
v i 4
f : x i 1
y i 2
z i 3
v i 4
∈ S}.