Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

135 7.5 Sublattice and Generalized Bound
Now putting t = τm, (τ ≥ 0 is a real number) in (7.22), we get the condition as
( )
(
1
k + τ2
2 +τ 1
(α+β)+
(k −1)k < (1−α) τ + 1 )
. (7.23)
k −1
To maximize β for a fixed α, the optimal value of τ is
τ = 1−2α−β .
α+β
Putting this optimal value in (7.23), we get the condition as
4α 2 k 2 +4αβk 2 +β 2 k 2 −8α 2 k −10αβk −3β 2 k −4αk 2
−2βk 2 +2α 2 +4αβ +2β 2 +6αk +4βk +k 2 −2α−2β −k > 0.
From which we get the required condition as β < C(α,k) when k > 2, and
β < 1−3α+α 2 whenk = 2. Sinceτ ≥ 0, wealsoneedtheconstraint1−2α−β ≥ 0.
Then, under Assumption 1 (as the polynomials are of more than one variable), we
can collect the roots successfully.
7.5.1 Implicit Factorization problem with shared MSBs
and LSBs together
So far we continued our discussion for the MSB case for better understanding.
Now we show that the same technique works as well when MSBs and LSBs are
shared together. This also takes care of the case when only LSBs are shared. As
before, consider N 1 = p 1 q 1 ,N 2 = p 2 q 2 ,...,N k = p k q k , where p 1 ,p 2 ,...,p k and
q 1 ,q 2 ,...,q k are primes. It is also considered that p 1 ,p 2 ,...,p k are of same bitsize
and so are q 1 ,q 2 ,...,q k . We also assume that some amount of LSBs as well as
some amount of MSBs of p 1 ,p 2 ,...,p k are same.
Theorem 7.13. Let q 1 ,q 2 ,...,q k ≈ N α . Consider that γ 1 log 2 N many MSBs and
γ 2 log 2 N many LSBs of p 1 ,p 2 ,...,p k are same. Define β = 1−α−γ 1 −γ 2 . Then,
under Assumption 1, one can factor N 1 ,N 2 ,...,N k in poly{logN,exp(k)} if
{
C(α,k), for k > 2,
β <
1−3α+α 2 , for k = 2,
with the constraint 2α+β ≤ 1.