Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

49 3.1 Our Basic Technique
Lemma 3.1. Let N = pq be the RSA modulus. Consider that e satisfies the
equation eX −ZY = 1 where |N −Z| = N τ . Then Y is one of the convergents in
X
e
the CF expansion of when 2XY < N N1−τ .
Proof. It is quite easy to note that
⇒
e
N − Y eX −NY 1−(N −Z)Y (N −Z)Y
= = ≈ − X NX NX NX
e
∣N − Y ∣ ∣∣∣ X∣ ≈ (N −Z)Y
NX ∣ = Nτ Y
NX = Nτ−1 Y
X .
So, Y X will be one of the convergents of e N if Nτ−1 Y
X
< 1
2X 2 ⇔ 2XY < N 1−τ .
We will use the above result later to demonstrate certain improvements over
existing schemes. Next we present the following theorem which is the core of our
results. For detailed ideas related to lattices, one may refer back to Chapter 2 or
have a look at [14,15].
Theorem 3.2. Let N = pq be the RSA modulus. Consider that e (= N α ) satisfies
the equation eX − ZY = 1 where |N − Z| = N τ , and |Y| = N γ . Then we can
apply LLL algorithm to get Z efficiently when
γ < 4ατ
⎛ √ (
⎝ 1
4τ + 1 1
12α − 4τ + 1 ) 2
+ 1
12α 2ατ
( 1
12 + τ
24α − α ) ⎞ ⎠.
8τ
Proof. We have eX −ZY = 1, which can also be written as eX = 1+NY +(Z−
N)Y. Hence, 1+NY +(Z −N)Y = 0 mod e. Thus, we have to find the solution
of f(x,y) = 1+Nx+xy in Z e , where x = Y,y = Z −N (the unusual assignment
of Y to x is to maintain similar notation as in [14] in the rest of the proof).
We have to find x,y such that 1+x(N+y) ≡ 0 (mod e), where |x| = N γ = e γ α
and |y| = N τ = e τ α. Let X 1 = e γ α,Y 1 = e τ α. One may refer to [14, Section 4] for
det x = e m(m+1)(m+2)/3 ·X m(m+1)(m+2)/3
1 ·Y m(m+1)(m+2)/6
1 ,
det y = e tm(m+1)/2 ·X tm(m+1)/2
1 ·Y t(m+1)(m+t+1)/2
1 .