Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

51 3.1 Our Basic Technique
• For a fixed α, the value of γ decreases when τ increases, and
• given a fixed τ, the value of γ increases as α increases.
In Table 3.1, we present the numerical values of γ corresponding to α following
Theorem 3.2 for three different values of τ, namely 1 4 , 1 2 and 3 4 .
α 1 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.875
τ = 1 4
0.482 0.555 0.629 0.704 0.780 0.856 0.934 1.012 1.091 1.150
τ = 1 2
0.284 0.347 0.412 0.477 0.544 0.612 0.681 0.751 0.821 0.875
τ = 3 4
0.131 0.188 0.245 0.305 0.365 0.427 0.489 0.553 0.618 0.667
Table 3.1: The numerical upper bounds of γ (in each cell) following Theorem 3.2,
given different values of α and τ.
In the work of [96], the value of τ has been taken as 1 . Thus we discuss some
2
cases when τ = 1 to highlight the improvements we achieve over [96]. Note that
2
for randomly chosen e with e < φ(N), the value of e will be O(N) in most of the
cases. In such a case, putting α = 1 and τ = 1 , we get that γ < 0.284.
2
When α < 1 and τ = 1 , the bound on γ will decrease and it will become 0
2
at α = 1 . However, for randomly chosen e with e < φ(N), this will happen in
2
negligibly small proportion of cases.
Most interestingly, the bound of γ will increase further beyond 0.284 when
α > 1. Wiener’s attack [130] becomes ineffective when e > N 1.5 and the attack
proposedbyBonehandDurfee[15]becomesineffectivewhene > N 1.875 . Similarto
theresultof[15], equationsoftheformeX−ZY = 1cannotbeusedfore > N 1.875 ,
since in such case no X will exist given the bound on Y. For τ = 1 , we have
2
presented the theoretical results for e reaching N 1.875 in Table 3.1. Experimental
results will not reach this bound as we work with small lattice dimensions in
practice, but even then the experimental results for e reach close to the value
N 1.875 as we demonstrate results for N 1.774 in Section 3.2.3 for 1000-bit N.
Note that here we present a theoretical estimate on the bound of γ. These
bounds may not be achievable in practice due to the large lattice dimensions.
However, the experimental results, presented in Sections 3.2.3, 3.3.1, are close to
the theoretical estimates.