Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 2: Mathematical Preliminaries 32
2.5.1 Coppersmith’s Method
Suppose we have a modular polynomial f N (x) with a small root x 0 in Z N . To
construct the polynomial h(x), we fix a positive integer m and generate a set of
univariate polynomials g jk , called the shift polynomials, as follows.
g jk (x) = x j (f N (x)) k N m−k for k = 0,...,m and some choice of j.
Clearly, g jk (x 0 ) = 0 mod N m . Thus, any integer linear combination h(x) of g jk (x)
has also got a root x 0 modulo N m . Now if |h(x 0 )| < N m , then h(x 0 ) = 0 holds
over integers as well, and we have obtained our desired function h(x).
The following theorem due to Howgrave-Graham [59] reformulates Coppersmith’s
idea of finding modular roots to prescribe a condition under which we can
conclude that h(x 0 ) = 0 holds over integers.
Theorem 2.22. Let h(x) ∈ Z[x] be an integer polynomial with n monomials.
Further, let m be a positive integer. Then, h(x 0 ) = 0 over integers if the following
two conditions are satisfied.
• h(x 0 ) ≡ 0 (mod N m ) and |x 0 | < X
• ||h(xX)|| < Nm √ n
.
Proof. Notice that we have
∑
|h(x 0 )| =
h
∣ i x i 0
∣ ≤ ∑ i i
∑
∣ hi x i ∣
0 ≤ |h i |X i ≤ √ n·||h(xX)|| < N m .
i
Now since N m divides h(x 0 ) by the first condition, h(x 0 ) = 0.
To obtain the desired function h(x), we construct a lattice L with basis vectors
coming from the coefficient vectors of the polynomials g jk (xX). Now, our goal is
to find an integer linear combination of these coefficient vectors, that is a vector
in the lattice L, for which the norm is smaller than Nm √ n
. Such a function will
satisfy the conditions of Theorem 2.22. But this problem is analogous to finding
a short vector in a given lattice, and one can use the LLL algorithm to the basis
spanned by the coefficient vectors of g jk (xX) to do so. Note that the polynomial
r 1 (x) corresponds to the smallest vector generated by the LLL algorithm over an