Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 2: Mathematical Preliminaries 26
In short, one can write the CF representation as [q 1 ,q 2 ,q 3 ,...,q m ]. For example,
take the rational number 34
34
. One can write this as = [0,2,1,10,3], that is,
99 99
0+ 1 99
34
= 0+ 1
2+ 31
34
= 0+ 1
2+ 1 34
31
= 0+
1
2+ 1
1+ 3
31
= 0+
1
2+ 1
1+ 31
1
3
= 0+
1
2+
1
1+ 1
10+ 1 3
.
Now consider a subsequence [0,2,1] of [0,2,1,10,3]. Note that 0 + 1 =
2+ 1 1
1
= 33
34
, which is very close to . This indicates that a subsequence of a CF
3 99 99
representation may produce a good approximation to the rational number. Any
initial subsequence of [q 1 ,q 2 ,q 3 ,...,q m ], i.e, [q 1 ,q 2 ,q 3 ,...,q r ], where 1 ≤ r ≤ m
is called a convergent of the original sequence [q 1 ,q 2 ,q 3 ,...,q m ]. For example,
[0,2,1] is a convergent of [0,2,1,10,3], which implies that 1 = 33 is a convergent
3 99
. Also note that if the subsequence has a 1 at the end then it may also be
of 34
99
representedbyaddingthat1tothepreviousintegerandthusshorteningthelength
of the subsequence. For example, both [0,2,1] and [0,3] provide the same rational
number. There are many interesting results about the convergence of continued
fractionrepresentations. Forthepurposeathand, weneedthefollowingresult[47].
Theorem 2.10. Suppose gcd(a,b) = gcd(c,d) = 1 and | a b − c d | < 1
2d 2 . Then c d is
represented by one of the convergents of the continued fraction expansion of a b .
It is also important to note that for t bit integers a,b, the CF expression
[q 1 ,q 2 ,q 3 ,...,q m ] of a can be computed in O(poly(t)) time and can be stored in
b
O(poly(t)) space. Let us see how this may be utilized to attack RSA.
Wiener’s Attack
We have ed ≡ 1 (mod N). So we can write ed = 1 + kφ(N) for some integer k.
So,
e
φ(N) − k d = 1
dφ(N) .