Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

31 2.5 Solving Modular Polynomials
3
4. ||v 4 1 ∗ || 2 = 4·5 3 = 15 > ||µ 4 2,1v ∗ 1 +v ∗ 2 || = || 1 5 (1,2)+(4 5 ,−2 )|| = ||(1,0)|| = 1.
5
5. v 1 = (1,0),v 2 = (1,2).
6. v ∗ 1 = v 1 = (1,0).
[ ]
7. [µ 2,1 ] = 〈v2 ,v ∗ 1 〉
||v ∗ 1
= [ 1] = 1. || 2 1
8. v 2 = (1,2)−1(1,0) = (0,2).
9.
3
4 ||v 1 ∗ || 2 = 3 4 < ||µ 2,1v 1 ∗ +v 2 ∗ || = ||0(1,0)+(0,2)|| = 2.
Hence LLL reduced basis is B ′ = {r 1 ,r 2 } with r 1 = (1,0),r 2 = (0,2).
There are numerous applications of lattices in cryptology, both for cryptanalysis
and for constructive cryptographic design. In this thesis we mainly focus on
Coppersmith’s [24] idea and its modifications for solving polynomials using lattice
basis reduction. The root finding techniques proposed by Coppersmith are comprehensively
discussed in the Doctoral thesis of Jochemsz [64]. For many more
applications of lattices, the reader may refer to the papers by Joux and Stern [68],
and Nguyen and Stern [94]. For more results related to lattices and lattice basis
reduction, refer to [21,95,106,121].
2.5 Solving Modular Polynomials
In 1996, Coppersmith [23] introduced a method for finding small modular roots of
univariate polynomial. Since then, the method is used in various applications in
Public Key Cryptography.
Let f N (x) = ∑ a i x i be a univariate modular polynomial over Z N . The terms
i
x i of f N with nonzero coefficients are called monomials. The norm of the polynomial
is defined as ||f N || = √ ∑i a2 i . In general, the roots of f N(x) can not be
found [25, Section 6] efficiently. However, finding small roots may be possible in
polynomial time. To find a small modular root x 0 of f N (x), one needs to find
a polynomial h(x) such that h(x 0 ) = 0 holds over integers. Then following the
method of Sturm sequence [70], the root x 0 may be obtained efficiently. This is
the main idea behind Coppersmith’s method.