Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

41 2.6 Solving Integer Polynomials
Also define the following polynomials:
g i1 ,i 2 ,...,i t
= x i 1
1 x i 2
2 ···x it
t ·f ′ (x 1 ,x 2 ,...,x t )·
t∏
j=1
h i1 ,i 2 ,...,i t
= x i 1
1 x i 2
2 ···x it
t ·R for x i 1
1 x i 2
2 ···x it
t ∈ M \S.
Note that for any shift polynomial g or h,
X l j−i j
j for x i 1
1 x i 2
2 ···x it
t ∈ S, and
g(x (0)
1 ,...,x (0)
t ) ≡ h(x (0)
1 ,...,x (0)
t ) ≡ 0 (mod R).
Now one have to construct a lattice L by taking the coefficient vectors of the
polynomials g(x 1 X 1 ,...,x t X t ) and h(x 1 X 1 ,...,x t X t ) as a basis. In [65], it is
proved that if
X s 1
1 ···X st
t < W s−ǫ
with s r = ∑ x i i 1
1 ···x i t
t ∈M\S r for r = 1,...,t and s = |S|, then one can find t − 1
many polynomials r i as the basis vectors of the LLL reduced basis of L, such that
r i (x (0)
1 ,...,x (0)
t ) = 0 for all 1 ≤ i ≤ t−1. Thereafter, subject to Assumption 1, we
can efficiently collect the common root (x (0)
1 ,...,x (0)
t ) from f,r 1 ,...,r t−1 . Note
that, similar to the modular case, the choice of m here depends on the arbitrary
constant ǫ > 0. Let us now discuss the extended strategy of [65] for finding integer
roots of a polynomial.
Extended Strategy
Alike the modular case, it is useful for some polynomials to use extra shifts for
some variable(s). Suppose that we use extra µ many shifts over x 1 . Then the
modified sets S, M will be defined as follows.
S = ⋃
{x i 1+j
1 x i 2
0≤j≤µ
2 ···x it
t |x i 1
1 x i 2
2 ···x it
t is a monomial of f m }, and
M = ⋃ {monomials of x i 1
1 x i 2
2 ···x it
t ·f |x i 1
1 x i 2
2 ···x it
t ∈ S}.
Now every idea of the basic strategy will remain the same except for the fact that
we have to define R = W ·∏t
j=1 Xl j
j , where l j is the maximum degree of x j in the
monomials of S. Let us now give a practical example of this strategy.