Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 2: Mathematical Preliminaries 40
lattice reduction on L, are algebraically independent. If so, then we can collect
the root (x (0)
1 ,...,x (0)
t ) from f,r 1 ,r 2 ,...,r t−1 using the method of resultants. The
reader may note that this method is heuristic, depending on the validity of algebraic
independence assumption. However, in Eurocrypt 2007, Bauer and Joux [7]
proposed a deterministic method for finding integer roots of a trivariate polynomial.
But now, let us study a generalization of the above method.
2.6.2 General Method by Jochemsz and May
In Eurocrypt 2005, Blömer and May [10] presented a general technique for solving
a bivariate integer polynomial. In Asiacrypt 2006, Jochemsz and May [65] generalized
the same and proposed a method to find a small root (x (0)
1 ,...,x (0)
t ) of a
polynomial f(x 1 ,...,x t ). In this section we discuss this generalized idea.
Let d i be the maximal degree of x i in f for 1 ≤ i ≤ t. Let us define
W = ||f(x 1 X 1 ,x 2 X 2 ,...,x t X t )|| ∞ , and
R = WX d 1(m−1)
1 X d 2(m−1)
2 ···X dt(m−1)
t .
Let a 0 = f(0,0,...,0) and assume that a 0 ≠ 0. If a 0 = 0, then find
some (y 1 ,...,y t ) such that f(y 1 ,...,y t ) ≠ 0, and define a new polynomial
f 1 (x 1 ,x 2 ,...,x t ) = f(x 1 + y 1 ,x 2 + y 2 ,...,x t + y t ). Clearly, the constant term
of the new polynomial f 1 is nonzero as f 1 (0,0,...,0) = f(y 1 ,y 2 ,...,y t ) ≠ 0, and
one can find the roots of f 1 . Next, assume that gcd(a 0 ,R) = 1. If not, then using
the idea of [28, Appendix A], we increase X i ,W such that gcd(a 0 ,R) = 1. Now
we define f ′ (x 1 ,x 2 ,...,x t ) = a −1
0 f (mod R), and start with the basic strategy.
Basic Strategy
Define the following sets for some positive integer m.
S = ⋃ {x i 1
1 x i 2
2 ···x it
t |x i 1
1 x i 2
2 ···x it
t is a monomial of f m }, and
M = ⋃ {x i 1
1 x i 2
2 ···x it
t |x i 1
1 x i 2
2 ···x it
t is a monomial of f m+1 }.
Let l j be the largest exponent of x j that appears in the monomials of S.