Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

53 3.2 Improvements over Existing Work
• There is no need to have Y < X when X,Y are of O(N 1 4).
• The bound of either X or Y can be greater than N 1 4 when the other one is
less than N 1 4.
We have already noted that the values of e are bounded by O(N) in the work
of [96]. In our case, this bound ( is increased as well. The exponent e is of the order
of (p−u)(q−v)·Y N
, which is O
). 2−τ
Given τ = 1, when X is O(N 1 4), we get the
X
X 2 2
bound on e as O(N), which is same as what given in [96]. However, our bound
increases as X decreases.
3.2.2 Further Improvement in the Bounds
With our results in Theorem 3.2, we get further bounds on X,Y. Note that
Y = N γ and thus X = ⌈N 1+γ−α ⌉. This gives XY = N 1+2γ−α , where
γ < 4ατ
⎛ √ (
⎝ 1
4τ + 1 1
12α − 4τ + 1 ) 2
+ 1
12α 2ατ
( 1
12 + τ
24α − α ) ⎞ ⎠,
8τ
as in Theorem 3.2. Our result implies the following improvements.
• The bound on Y can be extended till N γ . One may have a look at Table 3.1
for the numerical values of the theoretical bounds of γ given some α. The
experimental results are presented in Section 3.2.3.
• X has to satisfy the equation eX −(p−u)(q −v)Y = 1, which gives X =
⌈N 1+γ−α ⌉. The value of X becomes smaller as α increases.
• The constraint 1 ≤ Y < X < 2 −1 4N 1 4 in [96] forces that the upper bound
of e has to be O(N). However, in our case the value of e can exceed this
bound and the result works for e up to N 1.875 theoretically, as described in
Section 3.1.
3.2.3 Experimental Results
Let us start with a complete example, as follows.