Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 7: Approximate Integer Common Divisor Problem 132
Then
P 2 = X m3 τ 2 +m 3 τ+ m3 τ 3 +o(m 3) 3 , and
ω = m2
2 +m2 τ + m2 τ 2
+o(m 2 ).
2
Neglecting the o(m 3 ) terms, the required condition det(L) < p mω
1 implies
( 1
3 +τ2 +τ +
)(α+β)+ τ3 1 ( ) 1
3 6 < (1−α) τ2
+τ +
2 2
which simplifies to the following
(
− τ3 3α
3 (α+β)−τ2 2 +β − 1 )
−τ(2α+β −1)− 5α 2 6 − β β + 1 3
> 0. (7.19)
To maximize β for a fixed α, the optimal value of τ is 1−2α−β . Putting this optimal
α+β
valueofτ in(7.19), wegettherequiredconditionas−α 3 +2α 2 −2αβ−β 2 −3α+1 >
0, i.e.,
β < √ 1−3α+3α 2 −α 3 −α.
As τ ≥ 0, we also need the constraint 2α+β ≤ 1. Then under Assumption 1 (as
the polynomials are of two variables), we can collect the roots successfully.
In Theorem 6.9 of Chapter 6, it has been explained that factorization of
N 1 ,N 2 ,N 3 will be successful when β < 0.8 − 2α. In our case, the upper bound
of β is √ 1−3α+3α 2 −α 3 −α. Now, 0.8−2α < √ 1−3α+3α 2 −α 3 −α when
α < 0.55. Hence, our upper bound on β will be greater than that of Theorem 6.9.
7.5 Sublattice and Generalized Bound
In this section, we study a sublattice L ′ of the lattice L explained in the previous
section. This helps in two ways as follows.
• The dimension of the sublattice L ′ is less than that of L and this helps in
actual experiments.
• The theoretical analysis helps us to get a generalized bound for β.