Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 7: Approximate Integer Common Divisor Problem 116
Later in this chapter (Section 7.3 onwards), we focus on a couple of general
extensions of the approximate common divisor problem, and relate it to implicit
factorization, another well known problem along similar lines.
7.1 Finding q −1 mod p ≡ Factorization of N
In this section, we prove the computational equivalence of finding q −1 mod p and
factoring N = pq. In this direction, we present the following result.
Theorem 7.1. Assume N = pq, where p,q are primes and p ≈ N γ . Suppose an
approximation p 0 of p is known such that |p − p 0 | < N β . Given q −1 mod p, one
can factor N deterministically in poly(logN) time when β −2γ 2 < 0.
Proof. Let q 1 = q −1 mod p. So we can write qq 1 = 1 + k 1 p for some positive
integer k 1 . Multiplying both sides by p, we get q 1 N = p+k 1 p 2 . That is, we have
q 1 N −p = k 1 p 2 . Let x 0 = p−p 0 . Thus, we have q 1 N −p 0 −x 0 = k 1 p 2 . Also we
have N 2 = p 2 q 2 . Our goal is to recover x 0 from q 1 N −p 0 and N 2 .
Note that p 2 is the GCD of q 1 N−p 0 −x 0 and N 2 . In this case q 1 N−p 0 and N 2
is known, i.e., one term N 2 is exactly known and the other term q 1 N −p 0 −x 0 is
approximately known. This is exactly the Partially Approximate Common Divisor
Problem (PACDP) [61] and we follow a similar technique to solve this as explained
below. This will provide the error term −x 0 , which added to the approximation
q 1 N −p 0 , gives the exact term q 1 N −p 0 −x 0 .
Take X = N β as an upper bound of x 0 . Then we consider the shift polynomials
g i (x) = (q 1 N −p 0 +x) i N 2(m−i) for 0 ≤ i ≤ m, (7.1)
g ′ i(x) = x i (q 1 N −p 0 +x) m for 1 ≤ i ≤ t,
for fixed non-negative integers m,t. Clearly, g i (−x 0 ) ≡ g ′ i(−x 0 ) ≡ 0 (mod p 2m ).
WeconstructthelatticeLspannedbythecoefficientvectorsofthepolynomials
g i (xX),g ′ i(xX). One can check that the dimension of the lattice L is ω = m+t+1
and the determinant of L is
det(L) = X (m+t)(m+t+1)
2 N 2m(m+1) 2 = X (m+t)(m+t+1)
2 N m(m+1) . (7.2)
Using Lattice reduction on L by LLL algorithm [77], one can find a nonzero vector