Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

69 4.1 Theoretical Result
We want to find a solution (d 1 −d 2 +d 3 −···−d n ,k 1 ,...,k n ,r) of the polynomial
f (x 1 ,x 2 ,...,x n+2 ) = Ex 1 −
n∑
j=1
( n∑
)
(−1) j+1 E
−(N +x n+2 )
e j
j=1(−1) j+1E x j+1 .
e j
In this case we have |d 1 −d 2 +d 3 −···−d n | < N β , assuming that n is a fixed
small integer, negligible compared to N β . Let X 1 = N β ,X 2 = ··· = X n+1 = N δ
and X n+2 = N 1 2. Then X 1 ,X 2 ,...,X n+2 are the upper bounds of d 1 −d 2 +d 3 −
··· − d n ,k 1 ,...,k n ,r respectively, neglecting constant terms. Now proceeding as
in the proof of Theorem (4.2), we get the claimed bound. The situation can
be handled in a similar manner for odd n as |2d 1 −d 2 +d 3 −···−d n−1 −d n | =
|(d 1 −d 2 +d 3 −···−d n−1 )+(d 1 −d n )| can be bounded above by N β .
Detailed Calculations related to Theorem 4.2
Calculation of s
One may note that s is the number of solutions of 0 ≤ i 1 + ··· + i n+1 ≤ m,
0 ≤ i n+2 ≤ i 2 +···+i n+1 +t. Using Lemma 4.1 and neglecting lower order terms,
s =
≈
which gives the following:
m∑
( ) r+n−1
(1+r+t)(m+1−r)
r
m∑
r n−1
(1+r+t)(m+1−r)
(n−1)!
r=0
r=0
s ≈
≈
m∑ r n−1
(r +t)(m−r)
(n−1)!
r=0
1
(n−1)! ·
m n+2
(n+1)(n+2) +
t
(n−1)! ·
m n+1
n(n+1) .