Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

59 3.3 A New Class of Weak Keys
this example. Thus the maximum value of α for which our method works in this
example is 1.653. The value of γ in such a case is 0.656 as Y is a 656-bit integer.
We like to point out that one can exploit the techniques using sublattices given
in [15] for improvement in the bound of γ than in Theorem 3.2 (where we use
the idea of lattices following [14]). In practice, the idea of sublattices helps in
getting the same result with less lattice dimension. During actual execution, for
fixed N,e,u,v,Y, consider that t 1 is the time in seconds to run the LLL algorithm,
t 2 is the time in seconds to calculate the resultant and t 3 is the time in
seconds to find the integer root of the resultant; and let us refer this as a tuple
〈(l N ,l e ,l u ,l v ,l Y ),t 1 ,t 2 ,t 3 〉 a , where l N ,l e ,l u ,l v ,l Y are the bitsizes of N,e,u,v,Y respectively;
and a = L for full rank lattice and a = S for sublattice. Our examples
are with lattice parameters m = 7,t = 3 and thereby giving the dimension 60 for
full rank lattice (following the idea of [14]) and dimension 43 for sublattice (exactly
following [15] the dimension should be 45, but due to the upper bounds X 1 ,Y 1 in
Theorem 3.2, we get lower sublattice dimension). The examples are as follows:
〈(1000,1000,52,175,240),20,373,4〉 L , 〈(1000,1000,52,175,240),14,377,4〉 S ,
〈(2000,1995,104,350,465),79,1074,16〉 L , 〈(2000,1995,104,350,465),68,1075,
15〉 S , 〈(9999,9999,520,1750,2350),4722,5021,248〉 L , 〈(9999,9999,520,1750,
2350),4426,5028,198〉 S .
As long as t 1 is much less than t 2 , using sublattices (following [15]) instead of
lattices (following [14]) will not provide significant improvement in total execution
time. However, when t 1 becomes dominant, then the implementation using
sublattices will provide faster execution.
3.3.2 Estimation of Weak Keys
In this section, we estimate the number of exponents for which our method works.
We first present a simple analysis.
Lemma 3.7. Consider RSA with N = pq, where p,q are primes such that q < p <
2q. Let e be the public encryption exponent that satisfies eX−(N −pu−v)Y = 1.
Then for X = Y = 1, N can be factorized in poly(logN) time from the knowledge
of N,e when u is not a multiple of q and |v| < N 1 4. The number of such weak keys
e, such that e < N is N 3 4 −ǫ , where ǫ > 0 is arbitrarily small for suitably large N.
Proof. Given the equation eX − (N − pu − v)Y = 1, we consider the scenario