Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

113 6.3 Exposing a Few MSBs of One Prime
InourexperimentsforExamples6.15,6.16,weusefourpolynomialsf 0 ,f 1 ,f 2 ,f 3
that are available after lattice reduction. Let J be the ideal generated by
{f,f 0 ,f 1 ,f 2 ,f 3 } and let the corresponding Gröbner Basis be G. We studied the
first three elements of G and found that one of them is of the form y − q 1
P 1 −P ′ 1z.
Note that y 0 = q 1 ,z 0 = P 1 −P ′ 1 is the root of this polynomial.
Example 6.16. In this experiment, we consider 640-bit primes p 1 and p 2
2670046755820111597125983499598458226482802916962725172846821109006065
0996111051814093451331628000557452579503698243975066836110558623837620
26236414416814754812160919136728523814508982308428241
and
4213654354378478098923678873165024061763485330880715693603141201754570
6833482787889436013438027059065208431251021416732001179886518042599444
22004067683253229586251375139983258948708099714177489.
Note that, p 1 ,p 2 share 531 many LSBs. Further, q 1 ,q 2 are 360-bit primes
2286199623814759322661521537688479233374714361474052906990385379626075
664185395324016017013427591508941472939 and
1280130913887850481545063885171390143545984280360797978692995205434971
745123201014643124723774455018327835627 respectively.
Given N 1 ,N 2 , with the implicit information and 30 MSBs of q 2 , we can factorize
both of them efficiently. We use lattice of dimension 105 and the lattice reduction
takes 11107.04 seconds.
In a similar direction, we can extend Theorem 6.10 below, where we consider
a few MSBs of q 2 are known.
Theorem 6.17. Let N 1 = p 1 q 1 and N 2 = p 2 q 2 , where p 1 ,q 1 ,p 2 ,q 2 are primes. Let
q 1 ,q 2 ≈ N α . Suppose q 20 is known such that |q 2 − q 20 | ≤ N δ . Consider that a
contiguous portion of bits of p 1 ,p 2 are same at the middle leaving the γ 1 log 2 N
many MSBs and γ 2 log 2 N many LSBs. Then under Assumption 1, we can factor
both N 1 ,N 2 if there exist τ 1 ,τ 2 ≥ 0 for which h(τ 1 ,τ 2 ,α,γ 1 ,γ 2 ) < 0 where γ =