Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

129 7.4 The General Solution for EPACDP
Now let t = τm. Neglecting the o(m 2 ) terms of (7.16), we have
(
ψ(α,β,τ) = −(α+β) τ2 3α
2 −(2α+β −1)τ − 2 + β 2 − 1 )
> 0. (7.17)
2
The optimal value of τ, to maximize β for a fixed α is
τ =
1−β −2α
.
α+β
Putting the optimal value of τ in (7.17), we get
α 2 −3α−β +1 > 0. (7.18)
Once x 0 q 2 , integer root of h(x), is known, we get p 1 from gcd(N 1 ,N 2 +x 0 q 2 ).
As long as |x 0 q 2 | < p 1 , we get q 2 by calculating the floor or ceiling of N 2
p 1
. As
|x 0 q 2 | ≤ N α+β and p 1 ≈ N 1−α , to satisfy |x 0 q 2 | ≤ p 1 we need 2α+β ≤ 1, which is
true from (7.18).
Our strategy uses the LLL [77] algorithm to find h(x) and then calculates the
integer root of h(x). Both these steps are deterministic polynomial time in logN.
Thus the result.
Therelationpresentedin(7.16)providestheboundwhenthelatticeparameters
m,t are specified. The asymptotic relation, independent of the lattice parameters,
hasbeenpresentedin(7.18). Thisisthetheoreticalboundandmaynotbereached
in practice as we work with low lattice dimensions. Now let us compare our results
with that of Chapter 6.
1. In Corollary 6.4 of Chapter 6, it has been explained that factorization of
N 1 ,N 2 will be successful when
Ψ(α,β) = 4α 2 +2αβ + 1 4 β2 −4α− 5 β +1 > 0,
3
providedthat1− 3β−2α ≥ 0. Inourcase,theupperboundofβ 2 isα2 −3α+1.
Putting this upper bound of β in Ψ we get α ≤ 0.33 ⇒ Ψ(α,β) < 0. Hence
our upper bound on β will be greater than that of Chapter 6 when α ≤ 0.33.
2. The result presented in Chapter 6 is a poly(logN) time heuristic (based
on Assumption 1), whereas our algorithm in this chapter is deterministic