Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 4: Cryptanalysis of RSA with more than one Decryption Exponent 66
where t is a non-negative integer. Thus we get the following:
x i 1
1 x i 2
2 ···x i n+2
n+2 ∈ S ⇔
⎧
⎪⎨
i 1 = 0,...,m
i 2 = 0,...,m−i 1
.
⎪⎩
i n+1 = 0,...,m−i 1 −···−i n
i n+2 = 0,...,i 2 +···+i n+1 +t
x i 1
1 x i 2
2 ···x i n+2
n+2 ∈ M ⇔
⎧
⎪⎨
⎪⎩
i 1 = 0,...,m+1
i 2 = 0,...,m+1−i 1
.
i n+1 = 0,...,m+1−i 1 −···−i n ,
i n+2 = 0,...,i 2 +···+i n+1 +t.
Apart from f, we need to find at least n+1 more polynomials f 1 ,f 2 ,...f n+1 that
share the same root (d 1 −d 2 −···−d n ,k 1 ,...,k n ,r) over the integers.
Considering a small fixed n, we know that these polynomials can be found by
LLL [77] algorithm in poly(logN) time if
X s 1
1 X s 2
2 ···X s n+2
n+2 < W s
for s j = ∑ x i 1
1 ···x i n+2
n+2 ∈M\Si j with j = 1,...,n+2, s = |S|, and
W = ||f(x 1 X 1 ,...x n+2 X n+2 )|| ∞ ≥ Ne 2···e n X 2 ≈ N n+δ ,
assuming the e i ’s are of full bitsize for 2 ≤ i ≤ n. From the structure of the
polynomialf,itisclearthats 2 ,...,s n+1 areequal. Thusweonlyneedtocalculate 1
1 The detailed calculations for s,s 1 ,...,s n+2 are quite tedious and these are presented a little
later, not to hamper the continuity of this proof.