Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

119 7.2 Finding Smooth Integers in a Short Interval
Let us denote the n-th prime by p n , e.g., p 1 = 2,p 2 = 3 and so on. Suppose
we want to find a strongly B smooth integer N in the interval [U,V]. Now let us
present our main result of this section.
Theorem 7.5. Let S = ∏ n
i=1 pa i
i where a i = ⌊ logB
logp i
⌋ and p 1 ,...,p n are all distinct
primes not exceeding B. Let I = [U,V]. One can find all strongly B smooth
integers N ∈ I for which gcd(N,S) > d in poly(logS) time when |I| < 2d logd
logS and
V < 2d.
Proof. WewilltrytofindN suchthatgcd(N,S) > d. Letustaketakea 0 = ⌊ U+V
2
⌋.
We consider a 0 as an approximation of N. Thus we will try to find the GCD of
S,N, by knowing S exactly and some approximation of N, which is a 0 (but N is
notknown). HerewefollowtheideaofsolvingthePartiallyApproximateCommon
Divisor Problem (PACDP) as explained in [61].
Let x 0 = N − a 0 . We want to calculate x 0 from a 0 ,S. Assume X = d β is
an upper bound of x 0 . Let S = d δ . Using the same approach as in the proof of
Theorem 7.10, we get the condition as
(m+t)(m+t+1)
2
β + m(m+1) δ < m(m+t+1). (7.6)
2
Let t = τm. Then neglecting the terms of o(m 2 ) we can rewrite (7.6) as
β
2 τ2 +(β −1)τ + β 2 + δ −1 < 0. (7.7)
2
Now, the optimal value of τ to minimize the left hand side of (7.7) is 1−β . Putting β
this optimal value in (7.7), we get β < 1 logS
. Now δ = . So x δ logd 0 should be less than
d logd
logS .
Thus, we get x 0 and hence N in poly(logS) time. As, V < 2d, we have N < 2d
(since U ≤ N ≤ V). When gcd(N,S) > d, then gcd(N,S) = N as N < 2d. Hence
N divides S, i.e., N is strongly B smooth.
Our strategy exploits the solution of Partially Approximate Common Divisor
Problem (PACDP) presented in [61]. That, all such strongly B smooth numbers
will be available, follows from [61, Algorithm 12, Page 53] as in that case all the
common divisors are reported.
Asymptotically, our result is 8 times better than that of [12, Theorem 3.1],