Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 7
Approximate Integer Common
Divisor Problem
Given any two large integers a,b (without loss of generality, take a > b), one can
calculate gcd(a,b) efficiently in O(log 2 a) time using the well known Euclidean Algorithm
[126, Page 169]. Howgrave-Graham [61] has shown that it is also possible
to calculate the GCD efficiently when some approximations of a,b are available.
This problem is referred to as the approximate common divisor problem in the literature.
As an one important application of this problem, Howgrave-Graham [61]
had shown that Okamoto’s cryptosystem [98] is not secure. Using the idea of [61],
Coron and May [29] proved deterministic polynomial time equivalence of computing
the RSA secret key and factoring the RSA modulus. In this chapter, we first
present two applications of approximate common divisor problem.
Application1: Forthefirstapplication, considerN = pq, wherep,q arelargeprimes
and p > q. In a recent paper [50] presented at Crypto 2009, it has been asked how
one can use q −1 mod p towards factorization of N as q −1 mod p is stored as a part
of the secret key in PKCS #1 [99]. Using lattice based technique, we show that
factoring N is deterministic polynomial time equivalent to finding q −1 mod p.
Application 2: Next, we consider the problem of finding smooth integers in a small
interval [12,13]. Finding smooth numbers is important for application in the
well known factorization algorithms such as quadratic sieve [100] and number field
sieve [76]. We study the results of [12,13] and show that slightly improved outcome
could be achieved using a different strategy following the idea of [61].
115