Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

133 7.5 Sublattice and Generalized Bound
Let us define the following notation:
C(α,k) = k2 (1−2α)+k(5α−2)−2α+1− √ k 2 (1−α 2 )+2k(α 2 −1)+1
.
k 2 −3k +2
We will use this notation in the following theorem as well as in later part of this
chapter. Now we present the main result describing the bound on β.
Theorem 7.12. Consider EPACDP with g ≈ a 1−α and ˜x 2 ≈ ··· ≈ ˜x k ≈ a α+β .
Then, under Assumption 1, one can solve EPACDP in poly{loga,exp(k)} time
when
β <
with the constraint 2α+β ≤ 1.
{
C(α,k), for k > 2
1−3α+α 2 , for k = 2
Proof. We start by explaining the shift polynomials. First we consider the following
ones which are same as given in Equation (7.9) in the previous section.
H j2 ,...,j k
(x 2 ,...,x k ) = h j 2
2 ···h j k
k
a m−j 2−···−j k
1 , (7.20)
for non-negative integers j 2 ,...,j k such that j 2 +···+j k ≤ m, where the integer
m ≥ 0 fixed. Further, we define another set of shift polynomials
with the following:
H ′ i 2 ,0,...,0,j 2 ,...,j k
(x 2 ,...,x k ) = x i 2
2 h j 2
2 ···h j k
k
, (7.21)
1. 1 ≤ i 2 ≤ t, for a positive integer t, and
2. j 2 +···+j k = m, for non-negative integers j 2 ,...,j k .
Note that this set of shift polynomials is a sub-collection of the polynomials presented
in Equation (7.10).
Next, we define L ′ using the coefficient vectors of
H j2 ,...,j k
(x 2 X 2 ,...,x k X k ), and
H ′ 0,...,i n,...,0,j 2 ,...,j k
(x 2 X 2 ,...,x k X k ).