Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 2: Mathematical Preliminaries 42
Attack by Ernst et al [38]
In 2005, Ernst et al [38] studied the case when some most significant bits (MSBs)
of the decryption exponent d are known to the attacker. In such a situation,
the attacker needs to find out the root of a polynomial of the form f(x,y,z) =
a 0 +a 1 x+a 2 y+a 3 yz. Let (x 0 ,y 0 ,z 0 ) be the root of f(x,y,z) satisfying |x 0 | < X,
|y 0 | < Y and |z 0 | < Z. Now suppose that we use extra shifts over the variable z.
Let us discuss the technique with m = 1,µ = 1. In this case, we have
S = {1,x,y,z,xz,yz,yz 2 }, and
M = {1,x,y,z,xz,yz,yz 2 ,x 2 ,xy,xyz,y 2 ,y 2 z,x 2 z,xyz 2 ,y 2 z 2 ,y 2 z 3 }.
In this case W = max{|a 0 |,|a 1 X|,|a 2 Y|,|a 3 YZ|}. Define R = XYZ 2 W, and
calculate f ′ (x,y,z) = a −1
0 f(x,y,z) mod R = 1+ax+by +cyz. In this case, one
uses the shift polynomials
P 1 ={f ′ XYZ 2 ,xf ′ YZ 2 ,yf ′ XZ 2 ,zf ′ XYZ,xzf ′ YZ,yzf ′ XZ,yz 2 f ′ X}, and
P 2 ={x 2 R,xyR,xyzR,y 2 R,y 2 zR,x 2 zR,xyz 2 R,y 2 z 2 R,y 2 z 3 R},
and builds a lattice L with the basis elements coming from the coefficients of
p(xX,yY,zZ) where p ∈ P 1 ∪P 2 . The lattice L is represented as follows.
poly 1 x y z xz yz yz 2 x 2 xy xyz y 2 y 2 z x 2 z xyz 2 y 2 z 2 y 2 z 3
f ′ XY Z 2 T − − −
xf ′ Y Z 2 T − − −
yf ′ XZ 2 T − − −
zf ′ XY Z T − − −
xzf ′ Y Z T − − −
yzf ′ XZ T − − −
yz 2 f ′ X T − − −
x 2 R
X 2 R
xyR
XY R
xyzR
XY ZR
y 2 R
Y 2 R
y 2 zR
Y 2 ZR
x 2 zR
X 2 ZR
xyz 2 R
XY Z 2 R
y 2 z 2 R
Y 2 Z 2 R
y 2 z 3 R
Y 2 Z 3 R
Here T = XYZ 2 and ‘−’ denotes the non zero elements in the matrix. If we
perform the LLL lattice reduction on L, we get two polynomials f 1 (x,y,z) and
f 2 (x,y,z) which share the root (x 0 ,y 0 ,z 0 ) of f(x,y,z). From f,f 1 ,f 2 , we can
collect the root (x 0 ,y 0 ,z 0 ) by calculating the resultants, subject to Assumption 1.