Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

123 7.4 The General Solution for EPACDP
7.4 The General Solution for EPACDP
Towards solving the Extended Partially Approximate Common Divisor Problem
(EPACDP), consider the polynomials
h 2 (x 2 ,...,x k ) = ã 2 +x 2 ,
.
h k (x 2 ,...,x k ) = ã k +x k , (7.8)
where x 2 ,...,x k are the variables. Clearly, g (as in Problem Statement 1) divides
h i (˜x 2 ,...,˜x k ) for 2 ≤ i ≤ k. Now let us define the shift polynomials
H j2 ,...,j } {{ } k
(x 2 ,...,x k ) = h j 2
2 ···h j k
(k−1) many
1 (7.9)
k
a m−j 2−···−j k
for non-negative integers j 2 ,...,j k , such that j 2 +···+j k ≤ m, where the integer
m ≥ 0 is fixed. Further, we define another set of shift polynomials
with the following:
H
0,...,i ′ n ,...,0,j } {{ } 2 ,...,j
(x 2 ,...,x k ) = x in
} {{ }
k
(k−1) many (k−1) many
n h j 2
1. 1 ≤ i n ≤ t, for 2 ≤ n ≤ k and a positive integer t, and
2 ···h j k
k
(7.10)
2. j 2 +···+j k = m when 0 ≤ j 2 ,...,j n−1 < i n , with 0 ≤ j n ,...,j k ≤ m.
Note that g m divides H j2 ,...,j k
(˜x 2 ,...,˜x k ), and H ′ 0,...,i n,...,0,j 2 ,...,j k
(˜x 2 ,...,˜x k ). Let
X 2 ,...,X k be the upper bounds of ˜x 2 ,...,˜x k respectively. Now define a lattice L
using the coefficient vectors of
H j2 ,...,j k
(x 2 X 2 ,...,x k X k ), and
H ′ 0,...,i n,...,0,j 2 ,...,j k
(x 2 X 2 ,...,x k X k ).
LetthedimensionofLbeω. UnderAssumption1ofChapter2, onegets ˜x 2 ,...,˜x k
using lattice reduction over L if
2 ω(ω−1)
4(ω+2−k) det(L)
1
ω+2−k <
g m
√ ω
.