Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 7: Approximate Integer Common Divisor Problem 128
X = N α+β as an upper bound of x 0 q 2 . Now we consider the shift polynomials
g i (x) = (N 2 +x) i N m−i
1 for 0 ≤ i ≤ m,
g ′ i(x) = x i (N 2 +x) m for 1 ≤ i ≤ t, (7.13)
where m,t are fixed non-negative integers. Clearly,
g i (x 0 q 2 ) ≡ g ′ i(x 0 q 2 ) ≡ 0 mod (p m 1 ).
WeconstructthelatticeLspannedbythecoefficientvectorsofthepolynomials
g i (xX),g ′ i(xX) in Equation (7.13). One can check that the dimension of the lattice
L is ω = m+t+1 and the determinant of L is
2 N m(m+1)
2
det(L) = X (m+t)(m+t+1)
2 N m(m+1)
2
1
≈ X (m+t)(m+t+1)
2 N m(m+1)
2 . (7.14)
Here, P 1 = X m(m+1)
1 and P 2 = X mt+t(t+1) 2 (the general expressions of P 1 ,P 2
are presented in Lemma 7.7). Using Lattice reduction on L by the LLL algorithm
[77], one can find a nonzero vector b whose norm ||b|| satisfies
||b|| ≤ 2 ω−1
4 (det(L))
1
ω .
Thevectorbisthecoefficientvectorofthepolynomialh(xX)with||h(xX)|| = ||b||,
where h(x) is the integer linear combination of the polynomials g i (x),g ′ i(x). Hence
h(x 0 q 2 ) ≡ 0 mod (p m 1 ). To apply Theorem 2.23 and Lemma 2.20 for finding the
integer root of h(x), we need
2 ω−1
4 (det(L))
1
ω <
p m 1
√ ω
. (7.15)
Neglectingsmallconstantterms, wecanrewrite(7.15)asdet(L) < p mω
1 . Substitutingtheexpression
ofdet(L) from Equation (7.14) and usingX = N α+β ,p 1 ≈ N 1−α
we get
(
(m+t)(m+t+1)
(α+β) < m (1−α)(m+t+1)− m+1 )
. (7.16)
2
2