Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 4: Cryptanalysis of RSA with more than one Decryption Exponent 68
the entries. Since the lattice dimension in our case is exponential in n, so the total
running time for this method is poly{logN,exp(n)}.
Remark 4.3. If the encryption exponents are not relatively prime, as assumed
in Theorem 4.2, then f(x 1 ,x 2 ,...,x n+2 ) will not be an irreducible polynomial.
However, the GCD of any two encryption exponents will be small in general, and
hence f(x 1 ,x 2 ,...,x n+2 ) will be of the form cg(x 1 ,x 2 ,...,x n+2 ), where c is a small
constant. In this case, one needs to find the root of g(x 1 ,x 2 ,...,x n+2 ) instead.
n = 2 n = 3 n = 4 n = 5 n = 6
Method of [62] 0.357 0.400 0.441 0.468 0.493
Our Method 0.422 0.500 0.550 0.583 0.607
Table 4.1: Comparison of our theoretical bounds with that of [62].
Our bound in Theorem 4.2 is clearly better than that of Howgrave-Graham
and Seifert [62]. Our approach works when upper bound of d i is less than N 0.75 for
1 ≤ i ≤ n as n → ∞, whereas the bound is N 0.5 in [62]. In Table 4.1, we present
comparative upper bounds of d i for different values of n.
Theorem 4.2 may be extended when some of the most significant bits (MSBs)
of the decryption exponents are same (but unknown). This implicit information
increases the bound of decryption exponents even further, as follows.
Corollary 4.4. Let e 1 ,...,e n (where n ≥ 2) be RSA encryption exponents with
common modulus N, and suppose that d 1 ,...,d n are the corresponding decryption
exponents. Also suppose that gcd(e i ,e j ) = 1 for all i ≠ j where 1 ≤ i,j ≤ n. Let
d 1 ,d 2 ,...,d n < N δ and |d u −d v | < N β for u ≠ v ∈ [1,n]. Then one can factor N
in poly{logN,exp(n)} time when τ = max{0, −2nδ+n−2β+2δ
n+1
} and
n 2 τ 2 +4n 2 τδ−2n 2 τ +3nτ 2 +4nτβ +4n 2 δ
+4nτδ −3n 2 −4nτ +2τ 2 +4nβ +8τβ −8τδ +n < 0.
Proof. First consider the case when n is even. If E = ∏ n
i=1 e i, we have
E ·
n∑
(−1) i+1 d i =
i=1
(
n∑
n∑
)
(−1) j+1E +(N +r)·
e j
j=1(−1) j+1E k j .
e j
j=1