Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...
Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...
Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Chapter 2: Mathematical Preliminaries 34<br />
• R(r 1 ,r 2 ) ≠ 0 if r 1 ,r 2 are algebraically independent, i.e., gcd(r 1 ,r 2 ) = 1, and<br />
• R(r 1 ,r 2 )(x (0)<br />
1 ,...,x (0)<br />
t−1) = 0.<br />
Using the method <strong>of</strong> resultants recursively, we can find a polynomial in x 1<br />
(with root x (0)<br />
1 ) in t −1 iterations. We can then find x (0)<br />
1 easily using some root<br />
finding algorithm. Furthermore, using back-substitution t−1 times, we can find<br />
x (0)<br />
2 ,...,x (0)<br />
t as well, one in each step <strong>of</strong> back-substitution.<br />
Similarly one can use the technique <strong>of</strong> Gröbner Basis [30] to find the roots.<br />
The Gröbner Basis G = {g 1 ,g 2 ,...,g l } is a set <strong>of</strong> polynomials such that<br />
g 1 (x (0)<br />
1 ,...,x (0)<br />
t ) = g 2 (x (0)<br />
1 ,...,x (0)<br />
t ) = ··· = g l (x (0)<br />
1 ,...,x (0)<br />
t ) = 0.<br />
Each polynomial g i can be computed with respect to some ordering that eliminates<br />
the variables. So it is easy to extract the desired root. However, the elimination<br />
<strong>of</strong> variables fails if the variety V(I) <strong>of</strong> the ideal I generated by r 1 ,r 2 ,...,r t is not<br />
zero-dimensional. An interested reader may refer to [30] for more details regarding<br />
Gröbner Basis.<br />
Occasionally, one can collect the roots by examining special structure in the<br />
polynomials as well. For example, if we get a polynomial f(x,y) = ax − by + b<br />
where a,b are constants, then (b,a+1) is quite clearly a root <strong>of</strong> f(x,y).<br />
From our discussion so far, we can conclude that in case <strong>of</strong> solving multivariate<br />
modular polynomials, one needs the following assumption before attempting a<br />
lattice based technique.<br />
Assumption 1: The common root (x (0)<br />
1 ,...,x (0)<br />
t ) can be efficiently collected from<br />
the polynomials r 1 ,...,r t using the method <strong>of</strong> resultants, Gröbner Basis technique<br />
or exploiting the structure <strong>of</strong> the polynomials.<br />
Once we assume the above mentioned statement, (2.1) reduces the condition for<br />
solving a modular polynomial using LLL to the following:<br />
2 ω(ω−1)<br />
4(ω+1−t) det(L)<br />
1<br />
ω+1−t <<br />
N m<br />
√ ω<br />
.<br />
If we treat the number <strong>of</strong> variables t, and the dimension <strong>of</strong> lattice L as constants,<br />
then we can simply state the condition as det(L) < N mω . This technique <strong>of</strong> finding