Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 2: Mathematical Preliminaries 38
2.6 Solving Integer Polynomials
Although there exist several techniques for solving univariate polynomials over
integers, it is not so easy to solve bivariate integer polynomials. Coppersmith [22]
introduced a method to find small integer roots for a bivariate polynomial f(x,y).
Without loss of generality, we can assume that f(x,y) is irreducible. If f(x,y) is
reducible, we can factor f(x,y) by the method of Wang and Rothschild [129] and
try to find the roots of its factors individually. Coron [28] reformulated Coppersmith’s
method to propose the following idea.
2.6.1 Coron’s Method
The main aim is to find a polynomial h(x,y) which is algebraically independent
of f(x,y) and which shares the integer root (x 0 ,y 0 ) of f(x,y). Let, |x 0 | ≤ X,
|y 0 | ≤ Y, and assume that f(x,y) = ∑ i,j a ijx i y j . Now, define W = max|a ij X i Y j |.
i,j
Define R = X l 1
Y l 2
W for some non-negative integers l 1 ,l 2 . Further let us define
g ij (x,y) = x i y j R
f(x,y) and h
WX i Y j ij (x,y) = x i y j R,
for some pair of integers i,j. Note that these g ij (x,y)’s are analogous to the shift
polynomials as in Section 2.5.2. To ensure that all the shift polynomials g ij (x,y)
have integer coefficients, choose l 1 ≥ i and l 2 ≥ j. Also note that g ij (x 0 ,y 0 ) ≡ 0
(mod R) and h ij (x 0 ,y 0 ) ≡ 0 (mod R). Now, construct a lattice L using the coefficient
vectors of g ij (xX,yY) and h ij (xX,yY) as a basis. Let ω be the dimension
of the lattice L, and assume that r 1 (xX,yY),...,r ω (xX,yY) are the polynomials
corresponding to the vectors of the LLL reduced basis of L.
Now, from Lemma 2.20, we know that ||r 1 (xX,yY)|| ≤ 2 ω−1
4 det(L) 1 ω. Also,
from Theorem 2.22, we know that if ||r 1 (xX,yY)|| < R √ ω
, then r 1 (x 0 ,y 0 ) = 0.
So, when 2 ω−1
4 det(L) 1 ω < R √ ω
, then r 1 (x 0 ,y 0 ) = 0. Since we choose R = X l 1
Y l 2
W,
r 1 (x,y) is divisible byX l 1
Y l 2
. Now it can be shown that r 1 (x,y) is algebraically independent
of f(x,y). One can deduce this from the following result by Coron [28].
Theorem 2.25. If h(x,y) is a multiple of f(x,y), then h(x,y) is divisible by
X l 1
Y l 2
if and only if it has norm at least 2 −(ρ+1)2 +1 X l 1
Y l 2
W, where ρ is the maximum
degree of the polynomials f,h in each variable separately.
Hence, if ||r 1 (xX,yY)|| ≤ 2 ω−1
4 det(L) 1 ω ≤ 2 −(ρ+1)2 +1 X l 1
Y l 2
W = 2 −(ρ+1)2 +1 R,