Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 7: Approximate Integer Common Divisor Problem 122
or (iii) some amount of MSBs and LSBs together. Because of this fact, the work
of [86] (the LSB case) as well as that of [40] (the work for MSB case) are considered
in the same framework. Further, the proposed technique takes care of the
new case where the primes share some portion of MSBs and LSBs together. This
work is of the same quality (in general) and slightly improved (in certain cases) in
comparison to that of [40,86]. We generalize the ideas of [61] for the lattice based
technique that we exploit here, and our strategy is different from that of [40,86]
and our ideas in Chapter 6.
Let us first describe the central idea of the link between EPACDP and implicit
factorization on a small scale, and later we shall proceed to generalize the same.
Consider the case with k = 2, where the primes p 1 ,p 2 share certain amount of
MSBs. One can write p 1 −p 2 = x 0 , where the bitsize of x 0 is smaller than that of p 1
or p 2 . In terms of x 0 , one may write N 2 = p 2 q 2 = (p 1 −x 0 )q 2 . Therefore, we have
gcd(N 1 ,N 2 + x 0 q 2 ) = gcd(p 1 q 1 ,p 1 q 2 ) = p 1 . Since N 2 is a known approximation
of the unknown quantity N 2 + x 0 q 2 , we can use the technique of [61] to solve
the approximate common divisor problem efficiently with a = N 1 (known) and
b = N 2 + x 0 q 2 (unknown), and get gcd(a,b) = p 1 under certain conditions. It is
very interesting that solving an approximate common divisor problem in this case
gives the factorization of N 1 . Additionally, when p 1 > |x 0 q 2 |, then either ⌊ N 2
p 1
⌋ or
⌈ N 2
p 1
⌉ will provide q 2 , thereby factorizing N 2 as well. In Section 7.4.1, we explain
this idea in detail.
Next we generalize the PACDP given in [61]. Let a 1 ,a 2 ,...,a k are integers
with gcd(a 1 ,a 2 ,...,a k ) = g. Suppose ã 2 ,...,ã k are given as approximations to
a 2 ,...,a k , respectively. The goal of the generalized version of PACDP is to find g
from the knowledge of a 1 ,ã 2 ,...,ã k . An immediate application of this generalization
towards the implicit factorization problem is as follows.
We can write p 1 = p 1 + y 1 ,...,p k = p 1 + y k where y 1 = 0. Hence p 1 =
gcd(N 1 ,N 2 − y 2 q 2 ,...,N k − y k q k ) can be derived by solving the general PACDP
with a 1 = N 1 ,a 2 = N 2 − y 2 q 2 ,...,a k = N k − y k q k , where N 2 ,...,N k act as the
approximations of a 2 ,...,a k respectively. As a consequence, we factor N 1 , and
also obtain y 2 q 2 ,...,y k q k under certain conditions.
In the case of implicit factorization problem, we will always get N 1 exactly,
and the other terms N 2 −y 2 q 2 ,...,N k −y k q k can be approximated by N 2 ,...,N k
respectively. Thus implicit factorization relates directly to EPACDP (and not to
EGACDP) for any k ≥ 2.