Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

145 7.7 EGACDP
SinceinthiscasethematrixcorrespondingtothelatticeLisnotsquare, finding
det(L) may not be easy for general k. Further, for large k, dimension of L will be
very large.
7.7.2 Method II
Here we follow the idea of Section 7.6. We have
ã 1 = gq 1 − ˜x 1 ,
ã 2 = gq 2 − ˜x 2 ,
.
ã k = gq k − ˜x k ,
where ã 1 ,...,ã k are known and ã i ≈ a for 1 ≤ i ≤ k. Suppose, ˜x i ≈ a β for
1 ≤ i ≤ k and g ≈ a 1−α . Then q i ≈ a α for i ∈ [1,k]. Let us construct
⎛
⎞
2 ρ ã 2 ã 3 ... ã k
0 −ã
M =
1 0 ... 0
⎜
⎝ . . .
...
⎟
. ⎠
0 0 0 ... −ã 1
where 2 ρ ≈ 2˜x 1 . One can note that (q 1 ,q 2 ,...,q k ) · M = (2 ρ q 1 ,˜x 1 q 2 −
q 1˜x 2 ,...,˜x 1 q k −q 1˜x k ) = b, say. It can be checked that
||b|| < 2 √ ka α+β . (7.31)
Moreover, |det(M)| = 2 ρ (ã 1 ) k−1 ≈ 2a β+k−1 . FollowingMinkowski’stheorem, there
is a vector v in the lattice L corresponding to M such that
||v|| < √ k2 1 k a
β+k−1
k . (7.32)
Under Assumption 2 (Section 7.6), and from (7.31) and (7.32), one can obtain b
from L if
a α+β < a β+k−1
k
⇔ β < 1− k
k −1 α,