Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

109 6.2 Two Primes with Shared Contiguous Portion of Bits at the Middle
It follows from the above definitions that
⎧
i 4 = 0,...,m,
i 3 = 0,...,m−i 4 ,
⎪⎨
x i 1
y i 2
z i 3+j 1
v i 4+j 2
i 2 = i 3 +i 4 ,...,m,
∈ S ⇔
i 1 = 0,...,m−i 2 +i 3 +i 4 ,
j 1 = 0,...,t 1 ,
⎪⎩
j 2 = 0,...,t 2
⎧
i 4 = 0,...,m+1,
i 3 = 0,...,m+1−i 4 ,
⎪⎨
x i 1
y i 2
z i 3+j 1
v i 4+j 2
i 2 = i 3 +i 4 ,...,m+1,
∈ M ⇔
i 1 = 0,...,m+1−i 2 +i 3 +i 4 ,
j 1 = 0,...,t 1 ,
⎪⎩
j 2 = 0,...,t 2
From Section 2.6.2, we know that these polynomials can be found by lattice
reduction if
X s 1
Y s 2
Z s 3
V s 4
< W s , (6.7)
where s = |S|, s j = ∑ x i 1y i 2z i 3v i 4∈M\S i j for j = 1,...,4, and
W = ‖f(xX,yY,zZ)‖ ∞ ≥ max{N 1 X,N 2 Y} = N 1+γ .
One can easily check the following.
s 1 = 3 2 t 1t 2 m 2 +t 1 m 3 +t 2 m 3 + 1 4 m4 +o(m 4 ),
s 2 = 3 2 t 1t 2 m 2 + 4 3 t 1m 3 + 4 3 t 2m 3 + 11
24 m4 +o(m 4 ),
s 3 = t 2 1t 2 m+ 3 2 t 1t 2 m 2 + 3 4 t2 1m 2 + 2 3 t 1m 3 + 2 3 t 2m 3 + 1 6 m4 +o(m 4 ),
s 4 = t 1 t 2 2m+ 3 2 t 1t 2 m 2 + 3 4 t2 2m 2 + 2 3 t 1m 3 + 2 3 t 2m 3 + 1 6 m4 +o(m 4 ),
s = t 1 t 2 m 2 + 1 2 t 1m 3 + 1 2 t 2m 3 + 1 8 m4 +o(m 4 ).
For a given integer m, let t 1 = τ 1 m and t 2 = τ 2 m. Then substituting the values of
X,Y,Z,V and lower bound of W in (6.7) and neglecting the lower order terms of
s j we get the required condition.