Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

117 7.1 Finding q −1 mod p ≡ Factorization of N
b whose norm ||b|| satisfies ||b|| ≤ 2 ω−1
4 (det(L)) 1 ω. The vector b is the coefficient
vector of the polynomial h(xX) with ||h(xX)|| = ||b||, where h(x) is the integer
linear combination of the polynomials g ij (x). Hence h(−x 0 ) ≡ 0 (mod p 2m ). To
apply Lemma 2.20 and Lemma 2.22 for finding the integer root of h(x), we need
2 ω−1
4 (det(L)) 1 ω <
p 2m
√ ω
. (7.3)
Note that ω is the dimension of the lattice which we may consider as small
constant with respect to the size of p and the elements of L. Thus, neglecting 2 ω−1
4
and √ ω, we can rewrite (7.3) as det(L) < p 2mω . Substituting the expression of
det(L) from Equation (7.2) and using X = N β ,p ≈ N γ we get
(m+t)(m+t+1)
β +m(m+1) < 2m(m+t+1)γ. (7.4)
2
Let t = τm. Then neglecting the terms of o(m 2 ) we can rewrite (7.4) as
τ 2 β
2 +(β −2γ)τ + β 2
−2γ +1 < 0. (7.5)
Now, the optimal value of τ to minimize the left hand side of (7.5) is 2γ−β
β . Putting
this optimal value in (7.5), we get β −2γ 2 < 0.
Our strategy uses LLL algorithm [77] to find h(x) and then calculates the
integer root of h(x). Both these steps are deterministic polynomial time in logN.
Thus the result.
Corollary 7.2. Factoring N is deterministic polynomial time equivalent to finding
q −1 mod p, where N = pq and p > q.
Proof. When no approximation of p is given, then β in the Theorem 7.1 is equal
to γ. Putting β = γ in the condition β−2γ 2 < 0, we get γ > 1 . This requirement
2
forces the condition that p > q. Also, it is trivial to note that if the factorization
of N is known then one can efficiently compute q −1 mod p. Thus the proof.
Corollary 7.3. Factoring N is deterministic polynomial time equivalent to finding
q −1 mod p, where N = pq and p,q are of same bit size.
Proof. The proof of the case p > q is already taken care in Corollary 7.2. Now
consider q > p. When p,q are of same bit size and p < q, then p < q < 2p, i.e.,