Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...
Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...
Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Chapter 2: Mathematical Preliminaries 26<br />
In short, one can write the CF representation as [q 1 ,q 2 ,q 3 ,...,q m ]. For example,<br />
take the rational number 34<br />
34<br />
. One can write this as = [0,2,1,10,3], that is,<br />
99 99<br />
0+ 1 99<br />
34<br />
= 0+ 1<br />
2+ 31<br />
34<br />
= 0+ 1<br />
2+ 1 34<br />
31<br />
= 0+<br />
1<br />
2+ 1<br />
1+ 3<br />
31<br />
= 0+<br />
1<br />
2+ 1<br />
1+ 31<br />
1<br />
3<br />
= 0+<br />
1<br />
2+<br />
1<br />
1+ 1<br />
10+ 1 3<br />
.<br />
Now consider a subsequence [0,2,1] <strong>of</strong> [0,2,1,10,3]. Note that 0 + 1 =<br />
2+ 1 1<br />
1<br />
= 33<br />
34<br />
, which is very close to . This indicates that a subsequence <strong>of</strong> a CF<br />
3 99 99<br />
representation may produce a good approximation to the rational number. Any<br />
initial subsequence <strong>of</strong> [q 1 ,q 2 ,q 3 ,...,q m ], i.e, [q 1 ,q 2 ,q 3 ,...,q r ], where 1 ≤ r ≤ m<br />
is called a convergent <strong>of</strong> the original sequence [q 1 ,q 2 ,q 3 ,...,q m ]. For example,<br />
[0,2,1] is a convergent <strong>of</strong> [0,2,1,10,3], which implies that 1 = 33 is a convergent<br />
3 99<br />
. Also note that if the subsequence has a 1 at the end then it may also be<br />
<strong>of</strong> 34<br />
99<br />
representedbyaddingthat1tothepreviousintegerandthusshorteningthelength<br />
<strong>of</strong> the subsequence. For example, both [0,2,1] and [0,3] provide the same rational<br />
number. There are many interesting results about the convergence <strong>of</strong> continued<br />
fractionrepresentations. Forthepurposeathand, weneedthefollowingresult[47].<br />
Theorem 2.10. Suppose gcd(a,b) = gcd(c,d) = 1 and | a b − c d | < 1<br />
2d 2 . Then c d is<br />
represented by one <strong>of</strong> the convergents <strong>of</strong> the continued fraction expansion <strong>of</strong> a b .<br />
It is also important to note that for t bit integers a,b, the CF expression<br />
[q 1 ,q 2 ,q 3 ,...,q m ] <strong>of</strong> a can be computed in O(poly(t)) time and can be stored in<br />
b<br />
O(poly(t)) space. Let us see how this may be utilized to attack <strong>RSA</strong>.<br />
Wiener’s Attack<br />
We have ed ≡ 1 (mod N). So we can write ed = 1 + kφ(N) for some integer k.<br />
So,<br />
e<br />
φ(N) − k d = 1<br />
dφ(N) .