Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 3: A class of Weak Encryption Exponents in RSA 60
when X = 1,Y = 1, i.e., when e = N − pu − v + 1. In such a case, from e,
we will immediately get pu + v and then following Theorem 3.4, one can get p
in O(poly(logN)) time when |v| < N 1 4 and u is not a multiple of q. Considering
1 < e < φ(N), we get that pu+v < N. Considering p,q are of same bitsize, i.e.,
q < p < 2q, one may find √ N < p < √ 2N and
√
N
< q < √ N. As, |v| < N 1 4
2
√
N
and v may be a negative integer, a conservative upper bound of u is and 2
clearly in such a case u is not a multiple of q. The total number of options of u,v
√ √
N
pairs when 0 < u < and |v| < N 1 N
4 is × 2N 1 4 = √ 2N 4. 3 As we have to
2 2
considerthosee’swhichareco-primetoφ(N), wecanonlyconsiderthoseu,v pairs
such that gcd(N −pu−v +1,φ(N)) = 1. Similar to the arguments of [9, Lemma
13] and [96, Theorem 6], the number of such u,v pairs is N 3 4 −ǫ , where ǫ > 0 is
arbitrarily small for suitably large N.
The result of Lemma 3.7 will actually work in a similar manner for any X,Y
which are bounded by a small constant as one can search those values of X,Y
pairs to guess pu+v. Now we discuss a more general scenario.
Consider τ ≤ 1 − ǫ 1 for some arbitrarily small positive constant ǫ 1 . We have
√
N < p <
√
2N, pu + v = N τ and |v| < N 1 4. Thus, it is enough to consider
u ≤ 1 √
2
N 1 2 −ǫ 1
. In such a case, N−pu−v will be c 1 N for some constant 0 < c 1 < 1.
Considering e = c 2 N, with 0 < c 2 < 1, a constant, we find that X,Y are of
the same order. As we consider e = c 2 N, we can estimate α as 1. Following
Theorem 3.2 and putting α = 1, we find that as τ goes towards 1 (i.e., ǫ 1 goes to
0), the value of
4ατ
⎛ √ (
⎝ 1
4τ + 1 1
12α − 4τ + 1 ) 2
+ 1
12α 2ατ
( 1
12 + τ
24α − α ) ⎞ ⎠
8τ
goes towards 0. Now, γ is less than this bound, and |Y| = N γ . Hence, given that
X,Y are of the same order, this puts a constraint on X as well, and we need to
consider X < N ǫ 3
where α = 1, τ = 1−ǫ 1 , and
ǫ 3 = 4ατ
⎛ √ (
⎝ 1
4τ + 1 1
12α − 4τ + 1 ) 2
+ 1
12α 2ατ
( 1
12 + τ
24α − α ) ⎞ ⎠.
8τ
Let us provide some computational results in this direction. Table 3.4 shows some
numerical values of ǫ 3 (i.e., the bound of γ) following Theorem 3.2, corresponding