Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 7: Approximate Integer Common Divisor Problem 136
Proof. It is given that γ 1 log 2 N many MSBs and γ 2 log 2 N many LSBs of
p 1 ,p 2 ,...,p k are same. We consider γ 1 log 2 N and γ 2 log 2 N as integers, so it is
clear that N γ 1
,N γ 2
are integers too. Thus, we can write the following equations.
p 2 = p 1 +N γ2˜x 2 ,
p 3 = p 1 +N γ2˜x 3 ,
.
p k = p 1 +N γ2˜x k .
Using the above relations, we have 1
N i q 1 −N 1 q i = N γ2˜x i q i q 1 for 1 < i ≤ k. (7.24)
Suppose, µN γ 2
≡ 1 mod N 1 . Now, multiplying Equation (7.24) by µ, we get
µN i q 1 − ˜x i q i q 1 ≡ 0 (mod N 1 ). Let b i ≡ µN i (mod N 1 ) for 1 < i ≤ k. (Note that,
for any i, b i is of O(N 1 ), i.e., O(N).) Thus we have,
b i q 1 − ˜x i q i q 1 ≡ 0 (mod N 1 ) ⇒ b i − ˜x i q i ≡ 0 (mod p 1 ) for 1 < i ≤ k.
Our first aim is to find ˜x i q i from the knowledge of N 1 and b 2 ,...,b k . Then,
using ˜x i q i , we want to find the factorization of N i for 1 ≤ i ≤ k. Here we have
˜x i ≈ N 1−α−γ 1−γ 2
for 1 ≤ i ≤ k. Then, following the similar technique as in the
proof of Theorem 7.12, the desired result is achieved.
We extend the results related to MSBs (as in Theorem 7.12 and earlier) in
the case of LSBs as well as in the case of MSBs and LSBs taken together (as in
Theorem 7.5.1). As this method works for the case where MSBs and LSBs are
considered together, it also works for the case where only the LSBs are shared. In
such a case, we can consider that just a single bit from the MSB side (the first
MSB, which is surely 1 for all the primes) is shared.
1 One may note that similar equations as in Equation (7.24) have been used in [40] to construct
the lattice only for the case of most significant bits. However, here we use these for the case
when the equal bits are spread out between most and least significant bits.