Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

65 4.1 Theoretical Result
Hence the required result.
Now we may proceed to our main result for this section.
Theorem 4.2. Suppose that n ≥ 2 and (e 1 ,...,e n ) are n RSA encryption exponents
with common modulus N. Also suppose that gcd(e i ,e j ) = 1 for all
i ≠ j where 1 ≤ i,j ≤ n. Let d 1 ,...,d n be the corresponding decryption exponents
with d 1 ,...,d n < N δ . Then, under Assumption 1, one can factor N in
poly{logN,exp(n)} time if
⎧
⎪⎨
δ <
⎪⎩
0.422 for n = 2
3n−1
4n+4
for n ≥ 3
Proof. We have, e 1 d 1 = 1 + k 1 (N + r), e 2 d 2 = 1 + k 2 (N + r), ..., e n d n = 1 +
k n (N+r), where r = −p−q+1. Let ∏ n
i=1 e i = E. Multiplying the n equations by
E
e 1
, E e 2
,..., E e n
respectively, and then subtracting all the other equations from the
first one, we get
E
(
d 1 −
)
n∑
d i = E −
e 1
i=2
n∑
j=2
(
E E
+(N +r) k 1 −
e j e 1
n∑
j=2
)
E
k j .
e j
Now, we want to find a solution (d 1 −d 2 −···−d n ,k 1 ,...,k n ,r) of the polynomial
f(x 1 ,x 2 ,...,x n+2 ) = Ex 1 −
(
E
e 1
−
n∑
j=2
) (
E E
−(N +x n+2 ) x 2 −
e j e 1
n∑
j=2
)
E
x j+1 .
e j
Note that f(x 1 ,x 2 ,...,x n+2 ) is an irreducible polynomial as the encryption exponents
are relatively prime. Since d i < N δ for 1 ≤ i ≤ n, |d 1 − ∑ n
i=2 d i| < N δ ,
treating n as a constant and neglecting it. Also, we have |r| < ( 1+ √ 2 ) N 1 2 and
k i < N δ for 1 ≤ i ≤ n. Let X 1 = X 2 = ··· = X n+1 = N δ and X n+2 = N 1 2. Then
X 1 ,X 2 ,...,X n+2 aretheupperboundsof(d 1 − ∑ n
i=2 d i),k 1 ,...,k n ,r respectively,
neglecting constant terms. Using the extended strategy of Section 2.6.2, we define
S = ⋃
0≤j≤t
{x i 1
1 x i 2
2 ···x i n+2+j
n+2 : x i 1
1 x i 2
2 ···x i n+2
n+2 is a monomial of f m }
M = {monomials of x i 1
1 x i 2
2 ···x i n+2
n+2 ·f : x i 1
1 x i 2
2 ···x i n+2
n+2 ∈ S},