Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 7: Approximate Integer Common Divisor Problem 134
Let X 2 = X 3 = ··· = X k = X be the common upper bound on each co-ordinate
of the root (˜x 2 ,...,˜x k ). The shift polynomials from Equation (7.20) contribute
P ′ 1 =
m∏
(X r a m−r
r=0
1 ) (k+r−2
r ) = X
η 4
a η 5
with η 4 = ∑ m
r=0 r( )
k+r−2
r , η5 = ∑ m
r=0 (m − r)( )
k+r−2
r , to the determinant of L ′ .
(Note that this P 1 ′ is same as P 1 in Corollary 7.9). The shift polynomials from
Equation (7.21) contribute
P ′ 2 =
t∏
i 2 =1
(X i 2
X m ) (k+m−2 m ) = X
η 6
with η 6 = ∑ t
i 2 =1 (i 2+m) ( )
k+m−2
m , to the determinant of L ′ . The dimension of L ′ is
ω ′ =
m∑
( ) ( )
k +r −2 m+k −2
+t .
r m
r=0
Now, we have ( )
k+r−2
r =
r k−2
(k−2)! +o(rk−2 ). Using Lemma 4.1 and neglecting lower
order terms, we obtain
P ′ 1 ≈ X ∑ m
r=0 r rk−2
∑ m rk−2
r=0 (m−r)
(k−2)! a
(k−2)!
1 ≈ X 1
1
m k 1 m k
(k−2)! k a
(k−2)! k−1 − 1 m k
(k−2)! k
1 ,
P 2 ′ ≈ X ∑ t
i 2 =1 (i 2+m) mk−2
(k−2)!
≈ X 1
(k−2)! (t2 m k−2 +tm k−1) 2
, and
m∑
ω ′ ≈
r=0
r k−2 mk−2
+t
(k −2)! (k −2)!
Following Theorem 2.23, the required condition is
≈
det(L ′ ) = P ′ 1P ′ 2 < g mω′ ,
m k−1 mk−2
+t
(k −1)(k −2)! (k −2)!
where g is the common divisor. Let X = a α+β . Then putting the values of g,X
in det(L ′ ) = P ′ 1P ′ 2 < g mω′ , we get,
( m
k
k + mk−2 t 2
2
+m k−1 t
)(α+β)+ mk
k −1 − mk
k
< (1−α)
(m k−1 t+ mk
k −1
)
. (7.22)