Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 7: Approximate Integer Common Divisor Problem 144
In case of EGACDP, we have
ã 1 = gq 1 − ˜x 1 ,
ã 2 = gq 2 − ˜x 2 ,
.
ã k = gq k − ˜x k ,
where ã 1 ,...,ã k are known. The goal is to find g from the knowledge of the
approximates ã 1 ,...,ã k .
7.7.1 Method I
Towards solving the EGACDP in a manner similar to Section 7.4, consider the
polynomials
h 1 (x 1 ,x 2 ,...,x k ) = ã 1 +x 1 ,
.
h k (x 1 ,x 2 ,...,x k ) = ã k +x k , (7.29)
where x 1 ,x 2 ,...,x k are the variables. Clearly, g (of Problem Statement 2) divides
h i (˜x 1 ,˜x 2 ,...,˜x k ) for 1 ≤ i ≤ k. Now let us define the shift polynomials
h s1 ,...,s k
(x 1 ,x 2 ,...,x k ) = h s 1
1 ···h s k
k
, (7.30)
for u ≤ s 1 +···+s k ≤ m, where u,m are fixed non-negative integers.
Let X 1 ,...,X k be the upper bounds of ˜x 1 ,...,˜x k respectively. Now we define
a lattice L using the coefficient vectors of h s1 ,...,s k
(x 1 X 1 ,...,x k X k ). Let the
dimension of L be ω. One gets ˜x 1 ,...,˜x k (under Assumption 1 and following Theorem
2.23 and Lemma 2.20) using lattice reduction over L, if det(L) 1 ω < g m , i.e.,
when det(L) < g mω (neglecting the lower order terms).
Since the lattice dimension ω = ∑ m
( k+s−1
)
s=u s is exponential in k, the running
time of this strategy will be poly{loga,exp(k)}. Thus for small fixed k, this
algorithm is polynomial in loga. Formally, we get the following result.
Theorem 7.15. Under Assumption 1, the EGACDP can be solved in time
poly{loga,exp(k)} when det(L) < g mω .