Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

141 7.6 Improved Results for Larger k
by the LLL algorithm”, the complexity becomes poly{loga,k}. This happens in
practice as observed in [86] too.
In Table 7.5, we present a comparison of our experimental results with those
in [86, Table 1, Section 6.2]. One may note that both our results and the results
of [86] are of similar quality. We have implemented the method of [86] for
comparison, and the data is presented in Table 7.5.
α k Theoretical bound Results of [86] Our results
(same for both) Experiments Time in seconds Experiments Time in seconds
0.25 3 375 377 < 1 376 < 1
0.35 10 389 391 < 1 390 < 1
0.40 100 405 408 50.36 407 28.21
0.44 50 449 452 7.09 451 4.04
0.48 100 485 492 68.88 488 36.36
Table 7.5: For 1000 bit N, theoretical and experimental data of the number of
shared LSBs in [86] and shared LSBs in our case.
As we have already discussed, in the approach of [40], the number of shared
MSBs should be greater than or equal to k
k−1 αlog 2N +6 for k ≥ 3. In our case,
putting the upper bound of β, number of shared bits should be greater than
( ( ))
2k −1
1−α− 1−
k −1 α log 2 N = k
k −1 αlog 2N.
We have implemented the method of [40] for comparison with our strategy. Note
that the data presented in Table 7.6 match with those in [40, Tables 4, 5].
Advantages of our approach over [40] are as follows.
1. Our theoretical result in this section is slightly better than that of [40] in
terms of number of shared MSBs.
2. In this section, the matrix corresponding to the lattice is a square one, but it
is rectangular in the method of [40]. Hence, the calculation of determinant
for the lattices is easier in our method.
3. In the presence of k many RSA moduli, we have to reduce a k ×k matrix,
whereas the size of the matrix in [40] is k × 1 k(k + 1). Hence in practical
2
circumstances, the matrix reduction step in case of [40] takes more time than
ours. Further, fromtheexperimentalresultspresentedinTable7.6, itisclear
that our strategy requires much less time than the method of [40].