Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 7: Approximate Integer Common Divisor Problem 126
Runtime. The running time of our algorithm is dominated by the runtime of the
LLL algorithm, which is polynomial in the dimension of the lattice and in the
bitsize of the entries. Since the lattice dimension in our case is exponential in k,
the running time of our strategy is poly{loga,exp(k)}. Thus, for small fixed k our
algorithm is polynomial in loga.
Now, we can present the main result of this section, as follows.
Theorem 7.8. Under Assumption 1, the EPACDP (Problem Statement 1) can
be solved in poly{loga,exp(k)} time when det(L) < g mω , where det(L) is as in
Lemma 7.7 and ω is as in Lemma 7.6.
One may also consider the same upper bound on the errors ˜x 2 ,...,˜x k . In that
case we get the following result.
Corollary 7.9. Considering the same upper bound X on the errors ˜x 2 ,...,˜x k , we
have det(L) = P 1 P 2 where
and the exponents are
n=2i n=1
P 1 = X η 1
a η 2
1 and P 2 = X η 3
m∑
( ) k +r −2
η 1 = r · ,
r
r=0
m∑
( ) k +r −2
η 2 = (m−r)· , and
r
r=0
k∑ t∑
n−2
∑
( )( )
n−2 k
η 3 = (i n +m) (−1) r +m−rin −2
.
r m−ri n
r=0
Proof. Let X 2 = X 3 = ··· = X k = X. Then from Equation (7.11), we have
X j 2
2 X j 3
3 ···X j k
k am−j 2−···−j k
1 = X j 2+···+j k
a m−j 2−···−j k
1
for non-negative integers j 2 ,...,j k such that j 2 +···+j k ≤ m. Let j 2 +···+j k = r
where 0 ≤ r ≤ m. The total number of such representations is ( )
k+r−2
r . Hence
P 1 =
m∏
(X r a m−r
r=0
1 ) (k+r−2
where η 1 ,η 2 are as mentioned in the statement.
r ) = X
η 1
a η 2
1