Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 2: Mathematical Preliminaries 18
1
2
3
4
5
6
Input: Two positive integers a,b
Output: gcd(a,b), the GCD of the two input integers
Initialize r 0 = a, r 1 = b and m = 1;
while r m ≠ 0 do
q m ← ⌊ r m−1
r m
⌋;
r m+1 ← r m−1 −q m r m ;
m = m+1 ;
end
m=m-1 ;
Return r m ;
Algorithm 3: The Euclidean Algorithm [126].
Let us present a simple proof that the Euclidean algorithm is efficient, that is,
it runs in time polynomial in the size of the inputs. Note that we can list down
the steps of the Euclidean algorithm as follows (with a = r 0 , b = r 1 ).
r 0 = q 1 r 1 +r 2 with 0 < r 2 < r 1 ,
r 1 = q 2 r 2 +r 3 with 0 < r 3 < r 2 ,
.
r m−2 = q m−1 r m−1 +r m with 0 < r m < r m−1 ,
r m−1 = q m r m +0 as r m+1 = 0.
Thus, we have a = r 0 > b = r 1 > r 2 > r 3 > ··· > r m−1 > r m = gcd(a,b)
from the algorithm. Again, we know that q i ≥ 1 for each i = 1,...,m, and thus
r 0 ≥ r 1 +r 2 > 2r 2 , r 2 ≥ r 3 +r 4 > 2r 4 , and so on. This produces the relation
b =
{
r 1 > 2r 3 > 4r 5 > ··· > 2 m−1 r m
r 1 > r 2 > 2r 4 > 4r 6 > ··· > 2 m−2 r m
if m is odd,
if m is even,
which, in turn, gives m < log 2 b+2. Notice that m is the number of steps the loop
in the Euclidean algorithm runs, and hence, the time complexity of the algorithm
to find gcd(a,b) comes as O(logb) divisions. Each of these divisions takes at most
O(log 2 a) operations where a ≥ b. Hence, the time complexity of finding gcd(a,b)
amounts to O(log 2 a · logb), that is O(log 3 a). If we perform a more rigorous
analysis, the computational complexity to find the GCD of two integers, each of
size l N , can be proved to be O(l 2 N ) [126], and one needs to iterate this step a few
times to obtain a suitable e.