Conference Proceeding

Implicit Factoring with Shared Most Significant and Middle Bits.

01/2010; DOI:10.1007/978-3-642-13013-7_5 In proceeding of: Public Key Cryptography - PKC 2010, 13th International Conference on Practice and Theory in Public Key Cryptography, Paris, France, May 26-28, 2010. Proceedings
Source: DBLP

ABSTRACT We study the problem of integer factoring given implicit information of a special kind. The problem is as follows: let N
1 = p
1
q
1 and N
2 = p
2
q
2 be two RSA moduli of same bit-size, where q
1, q
2 are α-bit primes. We are given the implicit information that p
1 and p
2 share t most significant bits. We present a novel and rigorous lattice-based method that leads to the factorization of N
1 and N
2 in polynomial time as soon as t ≥ 2 α + 3. Subsequently, we heuristically generalize the method to k RSA moduli N

i
= p

i

q

i
where the p

i
’s all share t most significant bits (MSBs) and obtain an improved bound on t that converges to t ≥ α + 3.55... as k tends to infinity. We study also the case where the k factors p

i
’s share t contiguous bits in the middle and find a bound that converges to 2α + 3 when k tends to infinity. This paper extends the work of May and Ritzenhofen in [9], where similar results were obtained when the
p

i
’s share least significant bits (LSBs). In [15], Sarkar and Maitra describe an alternative but heuristic method for only two
RSA moduli, when the p

i
’s share LSBs and/or MSBs, or bits in the middle. In the case of shared MSBs or bits in the middle and two RSA moduli, they
get better experimental results in some cases, but we use much lower (at least 23 times lower) lattice dimensions and so we
obtain a great speedup (at least 103 faster). Our results rely on the following surprisingly simple algebraic relation in which the shared MSBs of p
1 and p
2 cancel out: q
1
N
2 − q
2
N
1 = q
1
q
2 (p
2 − p
1). This relation allows us to build a lattice whose shortest vector yields the factorization of the N

i
’s.

0 0
 · 
0 Bookmarks
 · 
65 Views
  • IACR Cryptology ePrint Archive. 01/2010; 2010:146.
  • Source
    [show abstract] [hide abstract]
    ABSTRACT: In this paper, we analyze how to calculate the GCD of k ( ≥ 2) many large integers, given their approximations. This problem is known as the approximate integer common divisor problem in literature. Two versions of the problem, presented by Howgrave-Graham in CaLC 2001, turn out to be special cases of our analysis when k = 2. We relate the approximate common divisor problem to the implicit factorization problem as well. The later was introduced by May and Ritzenhofen in PKC 2009 and studied under the assumption that some of Least Significant Bits (LSBs) of certain primes are the same. Our strategy can be applied to the implicit factorization problem in a general framework considering the equality of (i) most significant bits (MSBs), (ii) least significant bits (LSBs), and (iii) MSBs and LSBs together. We present new and improved theoretical as well as experimental results in comparison with the state of the art work in this area.
    IEEE Transactions on Information Theory 07/2011; · 2.62 Impact Factor

Full-text

View
10 Downloads

Jean-Charles Faugère