Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

131 7.4 The General Solution for EPACDP
Upper bound of β →
0.8
0.6
0.4
0.2
case(i)
case(ii)
case(iii)
0
0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5
α →
Figure 7.1: Comparison of theoretical results. Case (i): our result that works for
both MSBs and LSBs. Case (ii): result of [86] for LSBs and that of [40] for MSBs.
Case (iii): result of Chapter 6 for both MSBs and LSBs.
7.4.2 Analysis for k = 3
We now explain the case for k = 3 in detail.
Theorem 7.11. Let N 1 = p 1 q 1 ,N 2 = p 2 q 2 and N 3 = p 3 q 3 , where p 1 ,p 2 ,p 3 , and
q 1 ,q 2 ,q 3 are primes. Let N,N 1 ,N 2 ,N 3 be of same bitsize and q 1 ,q 2 ,q 3 ≈ N α ,
|p 1 −p 2 | < N β , |p 1 −p 3 | < N β . Then, under Assumption 1, one can factor N 1 ,N 2
and N 3 in poly(logN) time when
provided that 2α+β ≤ 1.
β < (1−α) 3 2 −α,
Proof. Let x 0 = p 2 − p 1 and y 0 = p 3 − p 1 . We have N 1 = p 1 q 1 ,N 2 = p 2 q 2 =
(x 0 + p 1 )q 2 ,N 3 = (y 0 + p 1 )q 3 . Our goal is to recover x 0 q 2 ,y 0 q 3 from N 1 ,N 2 and
N 3 . Let X = N α+β . Clearly X is an upper bound of x 0 q 2 ,y 0 q 3 . Also we have
p 1 ≈ N 1−α . When k = 3 then
P 1 = X m3
3 +o(m3) N m3
6 +o(m3 )
1 .
Let t = τm. To have a manageable formula for P 2 , we need to assume t ≤ m+1.