Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

127 7.4 The General Solution for EPACDP
For calculating P 2 , we have the following constraints:
1. 1 ≤ i n ≤ t, for 2 ≤ n ≤ k and a positive integer t, and
2. j 2 +j 3 +···+j k = m, when 0 ≤ j 2 ,...,j n−1 < i n , and 0 ≤ j n ,...,j k ≤ m.
Thus we have the expression for P 2 as
P 2 =
=
k∏
t∏
n=2i n=1
k∏
n=2i n=1
X in
n X j 2
2 X j 3
3 ···X j k
k
t∏
X inc(n,in) X mc(n,in) = X η 3
where η 3 is as mentioned in the statement.
As the results in this section are quite involved, we present below a few cases
for better understanding and comparison with existing results.
7.4.1 Analysis for k = 2
We write the proof of this special case in detail as this is in line with the proof
of [29, Theorem 3] where the strategy to solve the Partially Approximate Common
Divisor Problem (PACDP) [61] has been exploited.
As described in [24], after applying the LLL algorithm, if the output polynomials
are of more than one variable, then to collect the roots from these polynomials
one needs Assumption 1. However, in this case, Assumption 1 is not required since
there is only one variable in the polynomial that we will consider.
Theorem 7.10. Let N 1 = p 1 q 1 and N 2 = p 2 q 2 , where p 1 ,p 2 ,q 1 ,q 2 are primes. Let
q 1 ,q 2 ≈ N α and |p 1 −p 2 | < N β . Then one can factor N 1 and N 2 deterministically
in poly(logN) time when
β < 1−3α+α 2 .
Proof. Let x 0 = p 1 −p 2 . We have N 1 = p 1 q 1 and N 2 = p 2 q 2 = (p 1 −x 0 )q 2 . Our
goal is to recover x 0 q 2 from N 1 and N 2 . Since |x 0 | < N β and q 2 = N α , we can take