On Factoring Arbitrary Integers with Known Bits

Transcription

1 On Factong Abtay Integes wth Known Bts Mathas Hemann, Alexande May Faculty of Compute Scence, TU Damstadt, 689 Damstadt, Gemany Abstact: We study the factong wth known bts poblem, whee we ae gven a composte ntege = p p...p and oacle access to the bts of the pme factos p, =,...,. Ou goal s to fnd the full factozaton of n polynomal tme wth amnmal numbe of calls to the oacle. We pesent agoous algothm that effcentlyfactos gven H )log bts, whee H denotes the th hamonc numbe. Intoducton One of the most challengng tasks n algothmc numbe theoy s to effcently fnd the factozaton of a composte numbe. The secuty of the most popula publc key cyptosystem RSA s based on the dffculty of the factozaton poblem. Thus, t s no supse that consdeable effots have been made to lowe the computatonal complexty of factozaton algothms. In the Tung machne model, the cuently best algothms the Ellptc CuveMethod and the umbe Feld Seve eque subexponental tme. On the othe hand, anothe nteestng lne of eseach establshed n the last two decades that deals wth elaxatons of the factozaton poblem whch ae solvable n polynomal tme. Anatual elaxaton s to povde addtonal lmted oacle access to the pme factos bts. Ths elaxaton s motvated by cyptogaphc pactce, whee seveal sdechannels ae known that leak bts of the factos. Rvest and Sham[RS86] showed n 985, that fo an RSA-modulus = pq an amount of 3 log of the bts of p s suffcent to facto. Ths esult was mpoved by Coppesmth [Cop96] n 996 to 3 0 log bts, and n 997 agan by Coppesmth[Cop97] to log bts. In 999, Boneh, Dufee and Howgave-Gaham[BDHG99] genealzed the Coppesmth esult to modul of the fom = p k k q.theyshowed that k +) log bts ae suffcent to fnd the factozaton of n polynomal tme. One should notce that ths esult concdes wth the one of Coppesmth fo the RSA case, whee k =. Recently, Santoso, Kunho, Kanayama and Ohta [SKKO06] genealzed the factozaton wth known bts appoach to squae-fee modul = p...p,whee all pme factos p, =,..., have the same bt-sze. Santoso et al showed that the full factozaton of can be found gven + ) log bts. 95

2 We would lke to emak that ths esult does not concde wth Coppesmth s bound fo the RSA case, n whch =.Moeove, as opposed to the esults of Coppesmth and Boneh, Dufee, Howgave-Gaham the appoach n [SKKO06] s not goous. Santoso et al model the factozaton poblem as alattce-based oot fndng poblem fo an -vaate polynomal. The authos use a heustc algothm of Coon [Co0] fo fndng a oot of a multvaate polynomal equaton. The oot n tun yelds all the pme factos. Ou contbuton: We pesent a goous algothm fo factong squae-fee nteges = p p...p.asopposed to [SKKO06], wesolvethe factozaton poblem teatvely byfndng one pme facto of n each teaton. Ths allows us to model the factozaton as a oot fndng poblem fo modula unvaate polynomals. Theefoe, we can use Coppesmth s goous algothm fo fndng the oots of unvaate polynomal equatons. Ou factozaton algothm eques only atotal of H )log bts, whee H = = s the th hamonc numbe. Ths mpoves upon the bound of Santoso et al fo all.moeove,fo the RSA-case =the bound concdes wth the Coppesmth bound of log bts. The complextyof ou factozaton algothm s polynomal n log, ). We also consde the case whee the pme factos p ae not of the same bt-sze. We show that n ou teatve pocess of factong, t s best to ecove n each teaton the smallest pme facto p. The smalle p s elatve tothe othe factos, the less bts we need to dscove t. Consequently, the case whee all pme factos ae of the same bt-sze tuns out to be the wost case fo ou algothm n tems of the numbe of oacle calls. Thus, H )log bts s an uppe bound fo geneal nteges of the fom = p p...p. Futhemoe, ou algothm easlyextends to nteges that contan abtaypme powes,.e. the pmes factos p must not necessaly be dstnct. Once agan, we can show that ou uppe bound holds, and the moe multplctes has, the less oacle calls ae equed n ou algothm. We would lke topont out that ou esults have mplcatons fo fast vaants of RSA, whch make use of multpme RSA modul. Applcaton fo such modul have been poposed by Boneh, Shacham [BS0] n ode to speed up the RSA decypton/sgnng pocess. The Factozaton Algothm At Euocypt 96, Coppesmth pesented amethod fo fndng small oots of unvaate modula polynomals [Cop96]. We wll use the esult n the efomulaton of May[May07]: Theoem. Let be an ntege ofunknown factozaton wth advso b β. Let f b x ) be aunvaate, monc polynomal of degee δ.futhemoe, let c be afuncton that s uppe-bounded by apolynomal n log.then we can fnd all solutons x 0 fo the equaton f b x )=0mod b wth x 0 c β δ ) n polynomal tme n log,δ ). 96

3 ow wepesent amethod to facto an ntege of the fom = p p... p gven access to an oacle whch delves bts of of the pmes, applyng the method fom Coppesmth. We compute the pme factos n an teatve manne. I.e. we stat bylookng at apolynomal wth asmall oot modulo one of the pme factos of, w.l.o.g. p,and contnue wth apolynomal whch has asmall oot modulo apme facto of = p and so on. Algothm Factozaton Algothm Input :, = p p w.l.o.g. p p... p fo =to do p Call Oacle fo + log most sgnfcant bts of pme facto p of p ApplyTheoem wth the polynomal f p = p + x p end fo Output: p,...,p Theoem. Let be acomposte squae-fee ntege wth pme factos p,...,p of the same bt-sze. Ifwehave appoxmaton of p,...,p wth then we can facto n polynomal tme n log, ). p p +) ) The constucton of p,... p eques H ) log calls to the oacle. Poof. The polynomal f = p + x has asmall oot p p modulo p.ou goal s to fnd ths oot, whch yelds the pme facto p.toapply Theoem, we need to bound the sze ofthe dvso used. Fo atleast one of the pme factos we have p j >.Fom the assumpton we made, we know p fo all,snce all factos have the same bt-sze. To obtan abound β,we ewte = log.hence we defne β = log. The degee of f equals and wth the paamete c = weobtan the followng uppe bound on the szeofthe oots β δ = log + log ) = 3) In ode to ecove p weneed to know = log most sgnfcant bts of p.gven p wecan smplfy to = p = p...p.ow consde the polynomal f = p + x.weknowthat f has asmall oot modulo advso of,namely p.along the lnes of f weestablsh alowe bound on the sze ofthe dvso. But n ths case, the sze sdffeent, snce we don t consde but. Analog to the above, we obtan a bound on the szeofthe dvso by log p = p 3...p = ) 97

4 Wth β = log, δ =we compute β δ = ) + ) log log ) ) = ) ) 5) To expess n tems of,we use asmla agumentaton as befoe. Snce p j fo at least one j,wecan uppe bound p fo all as theyhaveall the same bt-sze. Then = p.contnung equaton 5) we obtan ) ) ) ) ) ) ) Hence wemayapply Theoem wth c = and obtan β δ ) 6) Thus weeque ) = ) log most sgnfcant bts of p. Fothe -th pme wehave p = p +... p Then = p... p β δ + = + log { ) + f < ) ) + f { +)+ ) ) +) +) f < ) 3 +) +) f and 7) 8) By usng the case dffeentaton, we pevent c fom beng exponental n.itsbased on the fact, that at most of the pmes can be of sze.wethen havetochoose c as +)+ ) 3 +) espectvely +).The maxmum of c n the nteval 0 s. Theefoe the equement of Theoem fo c to be polynomal n log s fulflled. In ths fashon wefomulate bounds on the equed appoxmatons fo of the pme factos of weget the last one fo fee). Eventuallyweae nteested n the total numbe of bts equed to facto the composte numbe.summng up the values fo the p,we need the followng numbe of oacle calls: = + log = ) H log 9) Ou algothm mpoves on aecent esult ) fom Santoso, Kunho, Kanayama, Ohta [SKKO06]. They eque + + ɛ ) log hgh bts fo each of the pme factos, whch sums up to + log bts n total. Addtonally ou algothm s goous,.e. t does not depend on aheustc assumpton lke the one n [SKKO06]. 98

5 3 Unbalanced Pme Factos and Pme Powes In the pevous secton we assumed balanced pme factos of asquae-fee composte ntege. The followng theoems state that ths s actually the wost case,.e. the numbe of equed oacle calls gets smalle f wehaveunbalanced pme factos o pme powes. The poofs can be found n the full veson of ths pape,avalable at the authos webstes. Theoem 3. Let n = = k.tofacto an ntege ofthe fom = p k...pk,whee the p have the same bt-sze, weeque calls to the oacle. = k n j = k j ) n n j = k j ) n H n ) 0) We applythe same technque as n Secton except that wemakeuse of the pme powes byconsdeng oots of polynomals f p x )= p + x )mod p k. Theoem. The esult H ) log fom equaton 9) s an uppe bound fo the numbe of equed oacle calls to facto an abtay composte ntege. Refeences [BDHG99] D. Boneh, G. Dufee, and. Howgave-Gaham. Factong =p k qfo Lage, Advances n Cyptology,CRYPTO 99. Spnge, LCS, 666:36 337, 999. [BS0] D. Boneh and H. Shacham. Fast vaants of RSA, 00. [Cop96] [Cop97] [Co0] [May07] [RS86] Don Coppesmth. Fndnga Small Root of a BvaateIntegeEquaton; Factong wth Hgh Bts Known. In EUROCRYPT, pages 78 89, 996. D. Coppesmth. Small Solutons to Polynomal Equatons, and Low Exponent RSA Vulneabltes. Jounal of Cyptology, 0):33 60,997. Jean-Sébasten Coon. Fndng Small Roots of Bvaate Intege Polynomal Equatons Revsted. InChstanCachnandJanCamensch, edtos, EUROCRYPT,volume 307 of Lectueotes n Compute Scence, pages Spnge, 00. Alexande May. Usng LLL-Reducton fo Solvng RSA and Factozaton Poblems: ASuvey. LLL+5 Confeence n honou of the 5th bthday of the LLL algothm, 007. RL Rvest and A. Sham. Effcent factong based on patal nfomaton. EURO- CRYPT 85, pages 3 3, 986. [SKKO06] Bagus Santoso, obou Kunho, aok Kanayama, and Kazuo Ohta. Factozaton of Squae-Fee Integes wth Hgh Bts Known. In Phong Q. guyen, edto, VIETCRYPT, volume 3 of Lectue otes n Compute Scence, pages Spnge,