Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

67 4.1 Theoretical Result
s,s 1 ,s 2 and s n+2 . We get,
s ≈
s 1 ≈
s 2 = ··· = s n+1 ≈
s n+2 ≈
1
(n−1)! · m n+2
(n+1)(n+2) + t
(n−1)! · m n+1
n(n+1) ,
m n+2
(n−1)!·(n+2)(n+1) + tm n+1
(n−1)!·n(n+1) ,
m n+2
n!·(n+2) + tm n+1
(n−2)!·n(n−1)(n+1) ,
m n+2
(n−1)!·2(n+2) +t· m n+1 m n
(n−1)!·(n+1) +t2 ·
(n−1)!·2n .
Consider t = τm, where τ ≥ 0 is a real number. Putting the values of
X 1 ,X 2 ,...,X n+2 , s 1 ,...,s n+2 ,s, and the lower bound of W in the condition
X s 1
1 X s 2
2 ...X s n+2
n+2 < W s , we get
n 2 τ 2 +4n 2 τδ−2n 2 τ +3nτ 2 +4n 2 δ+8nτδ−3n 2 −4nτ +2τ 2 +4nδ+n < 0. (4.2)
The optimal value of τ to maximize δ is (1−2δ)n . One may note that τ ≤ 0 when
1+n
the maximum value of δ is greater than 1 . For the cases n ≥ 3, we get that the
2
upper bound of δ greater than 1 for τ = 0. Thus in these cases, it is enough to
2
consider τ = 0, i.e., t = 0. In these cases, putting τ = 0 in (4.2), we get
δ < 3n−1
4n+4 .
For the cases n ≥ 3, extra shifts over the variable x n+2 does not provide any
improvement in the theoretical bound. Thus, it is enough to consider i n+2 =
0,...,i 2 + ··· + i n+1 instead of i n+2 = 0,...,i 2 + ··· + i n+1 + t. For the case
n = 2 though, the extra shifts over x 4 provide theoretical improvements. Putting
τ = (1−2δ)n
1+n
in (4.2), we get δ < 0.422, which provides a better bound compared to
3×2−1
4×2+4 ≈ 0.416.
Using the strategy of Section 2.6, one can construct a lattice L from S,M. The
bitsize of the entries of L is poly(logN), and
dim(L) = |M| =
1
(n−1)!·
(m+1) n+2
(n+1)(n+2) +
(n−1)!·(m+1)n+1 t
+o((m+1) n+2 ).
n(n+1)
The running time of our algorithm is dominated by the LLL algorithm run on L,
which takes time polynomial in the dimension of the lattice and in the bitsize of