Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 7: Approximate Integer Common Divisor Problem 124
The result follows from Theorem 2.23 and putting i = k − 1 in Lemma 2.20.
Neglecting the small constants and considering k ≪ ω (in fact, we will show that
ω is exponential in k in our construction), we get the condition as det(L) 1 ω < g m ,
i.e., det(L) < g mω . This is written formally in Theorem 7.8 later.
Before proceeding to the next discussion, we denote that ( n
r)
is considered in
its usual meaning when n ≥ r ≥ 0, and in all other cases we will consider the value
of ( n
r)
as 0.
Lemma 7.6. Let ω be the dimension of the lattice L described as before. Then
ω =
m∑
( ) k +r−2
+
r
r=0
k∑
t∑ ∑n−2
n=2 i n=1 r=0
(−1) r ( n−2
r
)( ) k +m−rin −2
.
m−ri n
Proof. Let j 2 +···+j k = r where j 2 ,...,j k are non-negative integers. The number
of such solutions is ( )
k+r−2
r . Hence the number of shift polynomials in Equation
(7.9) is
m∑
( ) k +r −2
ω 1 = .
r
r=0
For fixed n,i n , the number of shift polynomials in Equation (7.10) is the number
of solutions of
j 2 +···+j k = m
for 0 ≤ j 2 ,...,j n−1 < i n , and 0 ≤ j n ,...,j k ≤ m. The number of all such solutions
is the coefficient of x m in
=
(
1+x+···+x
i n−1 ) n−2
(1+x+···+x m ) k−n+1
( 1−x
i n
) n−2 ( 1−x
m+1
1−x
1−x
) k−n+1
= ( 1−x in) n−2(
1−x
m+1 ) k−n+1
(1−x) −k+1 .
We denote the coefficient by c(n,i n ), for fixed n,i n , which can be written as
∑n−2
( )( )
n−2 k
c(n,i n ) = (−1) r +m−rin −2
.
r m−ri n
r=0