Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

35 2.5 Solving Modular Polynomials
modular solutions to polynomials was generalized by Jochemsz and May [65], and
we shall discuss their method in the next section.
2.5.2 General Method by Jochemsz and May
In Asiacrypt 2006, Jochemsz and May [65] proposed a method to find a small
root (x (0)
1 ,...,x (0)
t ) of a polynomial f N (x 1 ,...,x t ) modulo a composite integer
N of unknown factorization. Let us first study the basic strategy proposed by
Jochemsz and May.
Basic Strategy
Suppose one knows an upper bound for the root, namely |x (0)
j | < X j for some given
X j , for j = 1,...,t. First choose a monomial l of f N such that no monomial in
f N besides l is divisible by l. Let a l be the coefficient of l in f N . Assume N,a l are
relatively prime. Otherwise we have a proper factor of N by computing gcd(N,a l ).
Define f ′ N = a−1 l
f N mod N. Also define the sets M k as in [65, Basic Strategy] for
0 ≤ k ≤ m, where m is a positive integer satisfying certain properties that we
shall discuss shortly.
M k = {x i 1
1 x i 2
2 ···x it
t |x i 1
1 x i 2
2 ···x it
t is a monomial of f m N
and xi 1
1 x i 2
2 ···x it
t
l k
Also denote M m+1 = ∅. Define the shift polynomials as follows:
g i1 ,...,i t,k(x 1 ,x 2 ,...,x t ) = xi 1
1 x i 2
2 ···x it
t
l k
f k N(x 1 ,x 2 ,...,x t ) k N m−k
is a monomial of f m−k
N
}.
for k = 0,...,m and x i 1
1 x i 2
2 ···x it
t ∈ M k \M k+1 .
Notethatforanyshiftpolynomialg,wehaveg(x (0)
1 ,...,x (0)
t ) ≡ 0 (mod N m ). Now
one needs to form a lattice L by taking the coefficient vectors of the polynomials
g(x 1 X 1 ,...,x t X t ) as a basis. In [65], it is proved that when X s 1
1 ···Xt st
< N s 0−ǫ
for some arbitrary small ǫ > 0 with s r = ∑ x i 1
1 ···x i t
t ∈M 0
i r for r = 1,...,t and s 0 =
∑1≤k≤m |M k|,thenonecanfindtmanypolynomialsr i suchthatr i (x (0)
1 ,...,x (0)
t ) =
0 after the LLL lattice reduction over L. Corresponding to the arbitrary small
ǫ > 0, it is always possible to get some positive integer m which satisfies the