Improved Factoring Attacks on Multi-Prime RSA with Small Prime Difference

Transcription

1 Impoved Factoing Attacks on Multi-Pime RSA with Small Pime Diffeence Mengce Zheng 1,2, Nobou Kunihio 2, and Honggang Hu 1 1 Univesity of Science and Technology of China, China mengce.zheng@gmail.com 2 The Univesity of Tokyo, Japan kunihio@k.u-tokyo.ac.jp Abstact. In this pape, we study the secuity of multi-pime RSA with small pime diffeence and popose two impoved factoing attacks. The modulus involved in this vaiant is the poduct of distinct pime factos of the same bit-size. Zhang and Takagi (ACISP 2013) showed a Femat-like factoing attack on multi-pime RSA. In ode to impove the pevious esult, we gathe moe infomation about the pime factos to deive simultaneous modula equations. The fist attack is to combine all the equations and solve one multivaiate equation by geneic lattice appoaches. Since the equation fom is simila to multi-pime Φ-hiding poblem, we popose the second attack by applying the optimal lineaization technique. We also show that ou attacks can achieve bette bounds in the expeiments. Keywods: Cyptanalysis Multi-pime RSA Small pime diffeence Factoing attack Lattice-based lineaization technique 1 Intoduction 1.1 Backgound RSA [22] is a famous public key cyptosystem that has been widely used in vaious settings. Howeve, the oiginal RSA is not fit fo some constained envionments. Since people need faste and moe efficient RSA encyption/decyption pocesses, seveal vaiants have been poposed and suveyed [3]. In this pape, we focus on a vaiant called multi-pime RSA. It is descibed as follows. Key Geneation. Geneate distinct pimes p 1, p 2,..., p of same bit-size and modulus N = p i. Pick a andom numbe that is copime to ϕ(n) = (p i 1) as the public key e and compute the coesponding pivate key d = e 1 mod ϕ(n). Encyption. Tansfom the message sting into an intege M Z N and compute the ciphetext as C = M e mod N. Decyption. Compute M i = C d i mod p i fo d i = d mod (p i 1), 1 i. Combine M i s by the Chinese Remainde Theoem to obtain the plaintext M = C d mod N. This vaiant modifies the modulus to N = p 1 p 2 p fo 3. It was patented by Compaq [5], using a modulus of the fom N = p 1 p 2 p 3. We then discuss the pefomance of multi-pime RSA. The advantage is the efficiency when using Chinese Remainde Theoem in its decyption pocess. Fom [3], we know that the asymptotic This pape is the full vesion of [29].

2 2 speedup ove the standad RSA is appoximately 2 4. Moeove, odinay attacks such as small pivate exponent attack and patial key exposue attack ae less effective as inceases. But should not be unestictedly lage because of the Elliptic Cuve Method [20]. Since factoing a multi-pime RSA modulus using ECM is much easie with inceasing, one might choose = 3, 4 and 5 fo most settings. Geneally speaking, multi-pime RSA with appopiate might be a pactical altenative fo educing the decyption costs. Without loss of geneality, we have the following assumption fo a multi-pime RSA modulus N with pime factos p 1 < p 2 < < p, 1 2 N 1 < p1 < N 1 < p < 2N 1. It indicates that the pime factos ae balanced, which means that they ae oughly of the same bit-size. The pime diffeence is defined as := max i j p i p j = p p 1 = N γ fo 0 < γ < 1. The secuity of multi-pime RSA has been investigated fo small pivate exponent [4,13,14] and fo small pime diffeence [1,24,27,28]. Pime diffeence was intoduced by de Wege [11] to show that one can find an enhanced small pivate exponent attack with small pime diffeence. As fo multipime RSA, it is also applied to obtain some impovements. Theeafte we eview some elated pevious attacks. Suppose that N is a multi-pime RSA modulus with pime factos. Let e N be a valid public key and d = N δ be its coesponding pivate key. Bahig-Bhey-Nass [1]. Given the pime diffeence = N γ and the public key (N, e), then multi-pime RSA is insecue if γ and d satisfy 2d < N 2 γ. 6 Zhang-Takagi [27,28]. Given the pime diffeence = N γ and the public key (N, e), then d can be pobabilistically found in time polynomial in log N if γ and δ satisfy The bound was late efined to δ < 1 δ < γ γ 3 fo γ δ 4, δ < γ fo γ < δ 4. They also pesented a Femat-like factoing attack fo γ < 1 2.

3 Takayasu-Kunihio [24]. Given the pime diffeence = N γ and the public key (N, e), then d can be pobabilistically found in time polynomial in log N if γ and δ satisfy δ < γ 3 fo 3 ( ) γ < 1 4, ( ( δ < γ 12 ) ( 1 + 2γ 3 ) ) 1 2γ fo γ < 3 2 ( 1 1 ). 4 Notice that the condition δ 4 in Zhang-Takagi attack degeneates to δ 4 fo = 6, and the condition 3 2 ( ) in Takayasu-Kunihio attack degeneates to 0 fo = 4. Thus, Zhang-Takagi attack and Takayasu-Kunihio attack depend on δ with γ < 1 fo lage. In such cases, factoing attacks with quite small γ ae much moe effective without any estiction on δ. The distinction is the dependence on the pivate exponent and this is also the advantage of factoing attacks Ou Contibutions In this pape, we aim to facto the multi-pime RSA modulus with small pime diffeence. Moe concetely, N can be factoed in polynomial time unde which condition when given the multi-pime RSA modulus N that is the poduct of distinct pimes and its pime diffeence N γ. Let x i = p i p fo i = 1, 2,..., with x i = p i p < p p 1 = N γ fo p = [N 1 ]. At ACISP 2013, Zhang and Takagi [27] solved x i fom each equation and computed pime factos by p i = x i +p. In ou opinion, they only made use of patial advantage about given infomation. In contast, we tansfom the knowledge of all balanced pime factos with pime diffeence into the following system of equations, x 1 + p = p 1, x 2 + p = p 2,. x + p = p. Futhemoe, we can deive the following system of modula equations, x 1 + p = 0 mod p 1, x 2 + p = 0 mod p 2,. x + p = 0 mod p. Ou factoing poblem is somewhat simila to multi-pime Φ-hiding poblem intoduced by Kiltz et al. [18] because of the modula equation fom. The definition of multi-pime Φ-hiding poblem is given. Let N = p 1 p be a composite intege (of unknown factoization) with distinct pime factos of same bit-size. Given N and a pime e, decide whethe e divides p i fo 1 i 1 o not.

4 4 In ode to solve multi-pime Φ-hiding poblem, one can ty to solve the following simultaneous equations and then conclude that e is Φ-hidden in N o not. ex = 0 mod p 1, ex = 0 mod p 2,. ex = 0 mod p 1. Thee exist some diffeences between these two poblems. In Φ-hiding poblem, since it is not necessay to know the exact values of the unknowns but enough to know if the equations can be solved, one can pefom a lineaization on the poduct 1 (ex i + 1) and then decide if 1 (ex i + 1) = 0 mod p 1 p 2 p 1 can be solved. Thus, it is like a decision -fom poblem. Ou factoing poblem is like a seach -fom one because we must extact the value of evey unknown vaiable. In ou optimized method, we can tansfom the factoing poblem into a decision -fom poblem and then apply the optimal lineaization technique. Anothe diffeence is that we do not have ex +1 = 0 mod p in Φ-hiding poblem. This special featue can be applied to impove the bound [26]. Howeve we can not diectly use the same technique to solve the factoing poblem. Ou impovements ae based on two ideas. The fist one is a diect method by gatheing all the equations togethe to solve an -vaiate modula (o intege) equation. The dawback of this method is that the unning time is exponential in. Thus, we povide an optimized method by combining fewe equations. Inspied by Tosu and Kunihio [25], we can benefit fom the optimal lineaization technique with fewe unknowns and less cost. Thus, we will tobtain a geat speedup and efficient pefomance in the pactical implementation. We show that multi-pime RSA modulus with small pime diffeence can be efficiently factoed in the following cases due to vaious s. Fo = 3, we have γ < 2 ( + 2). Fo > 3 with an optimal l, we have γ < 2 l + 1 ( ) l+1 1 l. Fo much lage with the base of natual logaithm e, we have γ < 2 e(log + 1).

5 5 1.3 Oganization The est of this pape is oganized as follows. In Sect. 2, we intoduce the latticebased method to solve modula and intege equations. In Sect. 3, we pesent ou impoved factoing attacks on multi-pime RSA with small pime diffeence. In Sect. 4, we veify ou attacks by vaious expeiments and compaisons. We conclude the pape in Sect Peliminaies 2.1 Lattice-Based Method We biefly intoduce lattice-based method including the LLL algoithm [19], Coppesmith s technique [6,7,8], Howgave-Gaham s lemma [15] and Coon s efomulation [9,10]. The technique is to constuct a set of polynomials modulo R shaing the common oots and then educe them to the equations ove the integes. Afte tansfoming known paametes into constucted polynomials coefficients that fom a lattice basis matix with dimension w. One can compute some shot lattice vectos whose nom is expected to be sufficiently small by the LLL algoithm. Eventually, one can solve the desied oots. The LLL algoithm poposed by Lensta, Lensta and Lovász is pactically used fo finding appoximately small lattice vectos. Lemma 1 (Lensta-Lensta-Lovász [19]). Let L be a given lattice with deteminant det(l). The LLL algoithm outputs a educed basis (v 1, v 2,..., v w ) in polynomial time, and fo 1 i w, the educed basis vectos satisfy v 1, v 2,..., v i 2 w(w 1) 1 4(w+1 i) det(l) w+1 i. The following lemma given by Howgave-Gaham helps us to judge whethe the oots of a modula equation ae also oots ove the integes. To a given polynomial of n vaiables g(x 1,..., x n ) = a i1,...,i n x i 1 1 x in n, its nom is defined as g(x 1,..., x n ) 2 := a i1,...,i n 2. Lemma 2 (Howgave-Gaham [15]). Let g(x 1,..., x n ) Z[x 1,..., x n ] be an intege polynomial that is a sum of at most m monomials. Suppose that 1. g(x 1 X 1,..., x n X n ) R/ m, 2. g(x (0) 1,..., x(0) n ) = 0 mod R fo x (0) 1 X 1,..., x (0) n X n. Then we have g(x (0) 1,..., x(0) n ) = 0 ove the integes. The above fundamental lemmas give us the final condition, which is oughly det(l) < R w. Some RSA cyptanalytic applications [2,8,12] ae deived fom such lattice-based method. But Boneh and Dufee [2] have noted that solving multivaiate equations is heuistic because the polynomials deived fom lattice eduction algoithms ae not guaanteed to be algebaically independent. In ode to extact the exact oots in pactice, we ely on the following assumption.

6 6 Assumption 1. The polynomials deived fom the LLL algoithm in lattice-based method ae algebaically independent. Futhemoe, the solution can be efficiently found by Göbne basis computations. Ou impoved attacks can be educed to solving multivaiate linea equations that was studied by Hemann and May. Lemma 3 (Hemann-May [12]). Let ɛ > 0 and let N be a sufficiently lage composite intege (of unknown factoization) with a diviso p N β. Futhemoe, let f(x 1,..., x n ) Z[x 1,..., x n ] be a linea polynomial in n vaiables. Unde Assumption 1, we can find solutions (x (0) 1,..., x(0) n ) of the equation f(x 1,..., x n ) = 0 mod p with x (0) 1 N η 1,..., x (0) n N ηn if n η i 1 (n + 1)(1 β) + n(1 β) n+1 n ɛ. The unning time is polynomial in log N and (e/ɛ) n. The lattice-based algoithm fo solving modula equations was late impoved by Lu et al. [21] and Takayasu and Kunihio [23]. Oppositely, we can solve an -vaiate intege polynomial f(x 1,..., x ) by the following lemma. Let X i fo positive intege N and eal positive numbe η i be the uppe bounds on the unknown vaiables fo i = 1, 2,...,. We also define f( ) as the lagest coefficient (in absolute value fom) of all the monomials in polynomial f( ). Lemma 4 (Jochemsz [16]). Given an -vaiate intege polynomial f(x 1, x 2,..., x ) = (x i + p) N Z[x 1, x 2,..., x ]. Fo any ɛ > 0 with sufficiently lage N and W = f(x 1 X 1, x 2 X 2,..., x X ), the oot (x (0) 1, x(0) 2,..., x(0) ) satisfying x (0) X i fo i = 1, 2,..., can be found if i X 1 X 2 X < W 2 +1 ɛ. The unning time is polynomial in log N and (1/ɛ). One can efe to [16] fo detailed analysis. One special case was showed by Coppesmith in [8] fo finding the bound XY < W 2 3 of the polynomial f(x, y) = (p 0 + x)(q 0 + y) N in ode to facto the modulus N with known bits of pime factos. Late, Jochemsz [16,17] povided a geneic stategy fo finding oots of intege (and also modula) polynomials. Since ou cyptanalysis is based on appoximations, we neglect the lowe ode tems and emove ɛ in ou methods fo simplicity. 2.2 Some Notations We intoduce the following notations fo ou methods. p denotes the value of ounding N 1 to the neaest intege and it is mentioned above as p = [N 1 ].

7 σi k denotes the elementay symmetic polynomial in k vaiables y 1,..., y k of degee i and it is defined by σi k := y j. j λ λ {1,2,...,k}, λ =i Q k denotes the poduct of k pime factos that ae chosen fom p 1, p 2,..., p and hence Q k is a diviso of N. Q k denotes the numeical value of the left side afte solving the equation and hence Q k is a multiple of Q k. 7 3 Impoved Factoing Attacks 3.1 The Diect Method As mentioned befoe, we gathe all the equations togethe to solve an -vaiate modula (o intege) equation. Moe concetely, we pesent the following factoing attack. Poposition 1. Let N = p 1 p be a multi-pime RSA modulus fo p 1 < < p and p p 1 = N γ fo 0 < γ < 1. Then unde Assumption 1, N can be factoed in time polynomial in log N but exponential in if γ < 2 ( + 1). Ou appoach utilizes the equation fom of multi-pime Φ-hiding poblem. Let e be the invese of p modulo N, namely e = p 1 mod N. Then y i + p = 0 mod p i can be ewitten as ey i + 1 = 0 mod p i and we obtain ey = 0 mod p 1,. ey + 1 = 0 mod p. Combining all equations togethe gives us (ey i + 1) = e i σi + 1 = 0 mod N. We have e = p 1 mod N that is equivalent to ep = 1 mod N. It can be educed to ei σi + ep = 0 mod N and futhe e i 1 σi + p = 0 mod N. Regading each σi as a new vaiable makes ei 1 σi + p a linea equation. We then figue out each η i of σi < N η i fo i = 1,..., and apply Lemma 3 with

8 8 β = 1. It is not had to know that η i = iγ fo 1 i. Thus, the final condition is iγ < 1, which can be simplified to γ < 2 ( + 1). Afte solving the linea equation, we obtain the values of σ1,..., σ. Then we extact x 1,..., x by solving x σ1 x ( 1) σ = 0 ove the integes. Finally, we compute the pime factos p 1,..., p fo p i = x i + p. The full desciption of the algoithm is given below. Algoithm 1 Input: Multi-pime RSA modulus N with and small pime diffeence N γ. Output: The factoization N = p 1 p. 1: Compute p = [N 1 ] and e = p 1 mod N. 2: Constuct the linea modula equation with unknown vaiables σ i : σ 1 + e 1 σ e 1 σ + p = 0 mod N. 3: Figue out η i s that ae elated to the bounds N η i on σ i fo 1 i : σ i < N iγ. 4: Extact each σ i by applying Lemma 3. 5: Solve x σ 1x ( 1) σ = 0 ove the integes. 6: Set p i = p + x i in inceasing ode with oots x i fo 1 i. Howeve, we obseve that the expeimental esults ae always a cetain distance away fom the asymptotic pedictions. In this case, solving an intege polynomial gives us a moe pecise and cedible condition. Thus, we pesent a evised and coected factoing attack. Poposition 2. Let N = p 1 p be a multi-pime RSA modulus fo p 1 < < p and p p 1 = N γ fo 0 < γ < 1. Then unde Assumption 1, N can be factoed in time polynomial in log N but exponential in if In fact, we have f(x 1, x 2,..., x ) = γ < 2 ( + 2). (x i + p) N = f pi (x i ) N = p i N = 0. Befoe we apply Lemma 4 to above polynomial, we must figue out η i (satisfying X i = N η i ) fo i = 1,..., and W. It is clea that η i = γ since x i = p i p < p p 1 = N γ. Howeve, it may be a little complicated fo W. We oughly have W = max{n p, p 1 N γ } by its definition. Since all pimes have a small diffeence N γ, N and p diffe fom each othe in N γ least significant bits. Hence, it can be easily infeed that W = max{n γ, N 1 +γ } = N 1 +γ.

9 9 Fom Lemma 4, the condition educes to (we omit the tiny tem ɛ) γ < 2 ( ) 1 + γ, + 1 that is Thus, the final condition is ( ) ( + 1) γ 1 2 γ < 2 ( + 2). < 1. Fo the completeness, we povide the concete lattice constuction fo solving above intege polynomial f(x 1, x 2,..., x ) = (x i + p) N. Define two sets S and S R fo a positive integes s. S = {x i 1 2 x i : x i 1 2 x i is a monomial of f s 1}, S R = {x i 1 2 x i : x i 1 2 x i is a monomial of f s}. By calculating the expansion of f s 1 (and f s ), we know the elation of evey element in S (and S R ) to its exponent i j fo j = 1, 2,...,. Fo R = W Xs 1 i x i 1 2 x i S : i j = 0,..., s 1, fo j = 1, 2,...,, x i 1 2 x i S R : i j = 0,..., s, fo j = 1, 2,...,. and the following shift polynomials, = N 1 +γ+γ(s 1), we define g : x i 1 2 x i f f = (p N) 1 f mod R R W j=1 Xi j j, fo x i 1 2 x i S, g : x i 1 2 x i R, fo x i 1 2 x i S R \S. Notice that above shift polynomials g and g modulo R ae equal to zeo. Aftewads, we use the LLL algoithm to seach seveal intege linea combinations of g and g, whose nom is ensued to be sufficiently small. (This has been mentioned in Sect. 2.) The lattice L is constucted by the coefficient vectos of g and g by substituting x i X i fo each x i. It is always epesented by a squae basis matix whose ows ae coesponding vectos. Befoe showing an example of such a basis matix, we fist define the monomial ode in ou method as x i 1 2 x i x j 1 1 x j 2 2 x j if i 1 + i i < j 1 + j j o k=1 i k = k=1 j k, t k=1 i k > t k=1 j k fo t = 1, 2,..., 1. Then a toy example is showed in Table 1, whee non-zeo off-diagonal enties ae maked by.

10 10 Table 1. A toy example of the lattice basis matix fo s = 1 and = 3 1 x 1 x 2 x 3 x 1x 2 x 1x 3 x 2x 3 x 1x 2x 3 g 0,0,0 1 g 1,0,0 RX 1 g 0,1,0 RX 2 g 0,0,1 RX 3 g 1,1,0 RX 1X 2 g 1,0,1 RX 1X 3 g 0,1,1 RX 2X 3 g 1,1,1 RX 1X 2X 3 When the condition is satisfied and a suitable s is chosen, we can obtain many intege equations apat fom f. Moeove, they shae a common oot (p 1 p, p 2 p,..., p p) ove the integes. We can solve p i fo 1 i unde Assumption 1, which diectly lead to the factoization of N. The desciption of the algoithm is simila to Algoithm 1, so we omit it hee. The unning time depends on educing the basis matix and extacting the common oots. The LLL algoithm can output the desied polynomials in time polynomial in log N but exponential in. This may be a dawback due to lage and foces us to find moe efficient method. The Göbne basis computation fo finding the common oots is usually polynomial time in pactice. Additionally, one can obtain moe polynomials deived fom the LLL algoithm and hence the Göbne basis computation is suggested athe than esultant computation. 3.2 The Optimized Method As descibed in the diect method, we still solve the factoing poblem in the view of a seach -fom poblem. Its dawback is that the time complexity is exponential in. Consequently, the factoing attack becomes less efficient fo lage. When consideing taking fewe equations to fom one modula equation, we have some inteesting obsevations. We andomly choose k (2 k 1) equations and obtain a new equation F (y 1,..., y k ) = 0 mod Q k. Fotunately, it is enough to know the numeical value Q k of the left side and not necessay to know exact values of y 1,..., y k. Then, computing the geatest common diviso gcd (Q k, N) gives us all combinations of k pime factos that indicate evey pime facto. In fact, the factoing poblem is efined to become of decision -fom. Thus, we can employ the optimal lineaization simila to the technique poposed by Tosu and Kunihio [25] when solving multi-pime Φ-hiding poblem. The idea is to examine all possible lineaization cases to find the optimal setting when it can be efficiently solved. We pesent the optimized factoing attack below. Poposition 3. Let N = p 1 p be a multi-pime RSA modulus fo p 1 < < p and p p 1 = N γ fo 0 < γ < 1. Then unde Assumption 1, N can be factoed in time polynomial in log N with an optimal l if γ < 2 l + 1 ( ) l+1 1 l. We conside combining k equations and pefoming a lineaization of l (2 l k) vaiables. Note that the paametes k and l need to be decided late. Fist, we have

11 11 (y 1 + p)(y 2 + p) (y k + p) = 0 mod Q k. It can be ewitten as The expansion is k p k i σi k = 0 mod Q k. i=0 σ k k + pσk k 1 + p2 σ k k pk = 0 mod Q k. Then, we apply a lineaization fo the case of l vaiables. Let t 1,..., t l+1 be the integes satisfying t 1 = k > t 2 > > t l+1 = 0. We obtain p k t 1 u 1 + p k t 2 u p k t l u l + p k = 0 mod Q k, whee u i := t i j=t i+1 +1 p t i j σ k j fo 1 i l. Fo y i < N γ, p N 1 and γ < 1, we know that the bound is u i < N t i t i+1 1 +(t i+1 +1)γ. In othe wods, we have η i = t i t i (t i+1 + 1)γ. Thus, we can find the oots of the linea equation by Lemma 3 with β = k and above η i if n η i < 1 (l + 1)(1 β) + l(1 β) l+1 l. Then we have γ < ( k+1 l + ( ) 1 k ) l+1 l 1 l + l i=2 t i The above bound eaches its maximum by setting (t 1, t 2, t 3,..., t l ) to be (k, l 1, l 2..., 1). The condition now is γ < 2 l + 1 ( ( k k ) l+1 ) l 1. We can futhe optimize k to obtain the best bound on γ by calculating the deivative on k. It can be veified that k = 1 is the most suitable choice. Thus, we deive the condition It means that we need to solve γ < 2 l + 1 ( ) l+1 1 l. u 1 + p l u p 2 u l + p 1 = 0 mod Q 1..

12 12 The optimal value of l can be discoveed by numeical computation. Fo each positive intege 10, the optimal cases ae l = 2 fo = 3, 4, 5, and l = 3 fo = 6, 7, 8, 9, 10. To be specific, we show the final equations need to be solved in ou optimized method as follows. Fo = 3, 4, 5, that is Fo = 6, 7, 8, 9, 10, that is u 1 + p 2 u 2 + p 1 = 0 mod Q 1. u 1 + p 3 u 2 + p 2 u 3 + p 1 = 0 mod Q 1. As analyzed in [25], we set l log fo much lage and the condition is appoximated 2 γ < e(log + 1), whee e is the base of natual logaithm. Theefoe, we also pesent the factoing attack fo much lage. Poposition 4. Let N = p 1 p be a multi-pime RSA modulus fo p 1 < < p and p p 1 = N γ fo 0 < γ < 1. Then unde Assumption 1, N can be factoed in time polynomial in log N fo much lage if γ < 2 e(log + 1). Afte solving the modula equation, we obtain the values of u 1,..., u l. Then we know all combinations of 1 pime factos by gcd (Q 1, N). Finally, we compute each pime facto by N gcd (Q 1, N). Note that the unknown vaiables u i s in the optimized method ae quite unbalanced. So we can make futhe impovement by applying bette lattice constuctions poposed by Takayasu and Kunihio [23]. The full desciption of the optimized algoithm and detailed lattice constuction ae given below. In Takayasu-Kunihio lattice constuction, we caefully wok out the selection of polynomials by consideing the sizes of oot bounds. Fo example, we deal with u 1 + p 2 u 2 + p 1 = 0 mod Q 1 in ou optimized method. We use u i 2 2 (u 1 + p 2 u 2 + p 1 ) i 1 N max{t i 1,0} as the shift polynomials with positive integes m and t that will be optimized late. The indexes i 1 and i 2 satisfy 0 i 1 + i 2 m and 0 γ 1 i 1 + γ 2 i 2 1 t in ode to select as many helpful polynomials as possible and to let the basis matix be tiangula. Thus, the shift polynomials modulo p t have the common oots fo u 1 and u 2. We span a lattice by the coefficient vectos of above shift polynomials and the equations ae deived fom the educed LLL basis vectos. The small oots can be easily ecoveed by Göbne basis computation. Note that we can find all pime factos by solving the linea equation once because evey combination (o poduct) of 1 pime factos is equivalent to each othe. Using l log implies that ou method woks in time polynomial in log N and.

13 13 Algoithm 2 Input: Multi-pime RSA modulus N with and small pime diffeence N γ. Output: The factoization N = p 1 p. 1: Compute p = [N 1 ]. 2: Choose an optimal l accoding to. 3: Constuct the linea modula equation with unknown vaiables u i: u 1 + p l u p 2 u l + p 1 = 0 mod Q 1. 4: Figue out η i s that ae elated to the bounds N η i on σi fo 1 i l with known (t 1, t 2, t 3,..., t l, t l+1 ) = ( 1, l 1, l 2..., 1, 0): u i < N t i t i+1 1 +(t i+1 +1)γ. 5: Extact each u i by using Takayasu-Kunihio lattice constuction. 6: Compute Q 1 = u 1 + p l u p 2 u l + p 1 with oots {u 1,..., u l }. 7: Set p i = N/ gcd (Q 1, N) in inceasing ode fo 1 i. 3.3 Discussions Compaed with the diect method, we have two impovements in ou optimized method. Fistly, we decease the numbe of unknown vaiables and significantly impove the pactical pefomance fo lage. Secondly, we can achieve a bette bound fo much lage at the same time. But fo smalle, the diect method offes a highe bound and hence the factoing attack still stays in polynomial time. Note that the unknown vaiables u i s in the optimized method ae quite unbalanced and we apply Takayasu-Kunihio lattice constuctions [23]. Hee we omit the complicated analysis and show anothe advantage. Fo 10, the optimal l is always 2. It means that the final equation we need to solve in the optimized method is u 1 + p 2 u 2 + p 1 = 0 mod Q 1. Thus, we futhe educe the unning time of the optimized factoing attack. Table 2 shows the compaison of the uppe bounds on γ due to above factoing attacks fo 10. The fouth column povides the esults using bette lattice constuction that is discussed above. It is visible that ou methods ae supeio. Table 2. The compaison of the uppe bounds on γ due to distinct factoing attacks Sect. 3.1 Sect. 3.2 Sect. 3.3 [27]

14 14 4 Expeimental Results We now state some expeimental esults to show the pactical pefomance of ou methods. These expeiments ae caied out unde Sage 7.3 unning on a laptop with Intel Coe i7 CPU 2.70 GHz and 8 GB RAM. The numbes we used ae chosen unifomly at andom and Assumption 1 is found to hold fo the expeiments. Duing the expeiments, we always deal with modula equations (though the evised condition is obtained fom an intege polynomial in Sect. 3.1) and collect many polynomials satisfying ou equiements. In othe wods, we obtain enough sufficiently shot vectos afte unning the LLL algoithm. Hence, we extact the common oots by Göbne basis computation and finally attain the factoization of multi-pime RSA modulus. We povide the expeimental esults on two attacks accoding to Sect. 3.1 and Sect. 3.2 (actually efined by Sect. 3.3), namely the γ e1 -column and γ e2 -column, espectively. The γ zt -column povides the expeimental bound of Zhang-Takagi method. The esults about the compaison ae showed in Table 3. Table 3. The expeimental esults of the uppe bounds on γ γ zt γ e1 γ e We fistly comment the expeiments fo = 3. We educe a 220-dimensional lattice fo the diect method while we use a lattice whose dimension is 300 fo the optimized method. A 1536-bit multi-pime RSA modulus can be successfully factoed by a 174-bit pime diffeence by the diect method. While using the optimized method, a 172-bit diffeence leads to the factoization of a 1536-bit modulus. Thus, we conclude that the diect method pefoms bette fo = 3 with oughly simila lattice setting. On the othe hand, we obseve that the optimized method uns much faste, which is pedicted above. Fo 4 7, we use the optimized method with lattices whose dimension is aound 300 since it is moe efficient. We cay out expeiments fo much smalle moduli with almost the same lattice setting and they wok much bette. We also do expeiments fo moduli of the same size with vaious lattice dimensions fo = 3, 4. The esults become bette as the lattice dimension inceases. So the lattice dimension may be a citical limitation that influences the pactical pefomance of lattice-based methods. The optimized bounds fo 4 7 showed in the γ e2 -column ae those obseved in the expeiments with much smalle moduli. Moe details about the expeimental esults ae showed below. Fistly, as showed in Fig. 1 and Fig. 2, uppe bound on γ gets bette when the lattice dimension inceases. Fo the diect method, uppe bound on γ emains stable when the lattice dimension is between 50 and 170. Fo the optimized method, the value is between 60 and 300.

15 We then show the expeimental esults fo = 3 using the diect method in Fig. 3. As the size of the modulus inceases, γ finally aives aound This value is beyond the asymptotic bound 1 9 of pevious Zhang-Takagi method. The emaining gaphs ae elated to the expeiments fo 3 7 with vaious moduli using the optimized method. The lattice dimension of each expeiment is set aound 300. Fom Fig. 4, Fig. 5, Fig. 6, Fig. 7 and Fig. 8, we find that uppe bound on γ is highe fo smalle modulus and then goes to a lowe value. Also it will finally aive at a cetain value that may be detemined by the lattice dimension. Anothe obsevation is that these lattices whose dimension is aound 300 seem less effective fo moduli with lage bit-size. To be specific, it is less effective fo the moduli of geate than 500-bit when = 3. The citical bit-size is 700-bit fo = 4, 5 and 1000-bit fo = 6, 7. Thus, we guess that the lattices used in ou expeiments ae effective fo the pime facto of less than 160-bit. To obtain desied uppe bounds, we need to apply some lattices with huge dimension Gamma Lattice Dimension Fig. 1. The expeimental esults of uppe bound on γ with vaious lattice dimensions and the same bit-size moduli fo = 3 using the diect method 5 Conclusions Factoing attack woks bette than small pivate exponent attack on multi-pime RSA with much smalle pime diffeence, and the fome emoves the estiction on the pivate exponents. We futhe upgade the insecue bound on the pime diffeence and popose impoved factoing attacks based on lattice appoach and the optimal lineaization technique. To summaize, ou factoing attacks make significant impovements by taking full knowledge of the small pime diffeence. We combine moe equations athe than only one equation to solve the factoing poblem. Futhemoe, applying the optimal lineaization technique on unknown vaiables helps us to educe the time cost and obtain bette esults.

16 Gamma Lattice Dimension Fig. 2. The expeimental esults of uppe bound on γ with vaious lattice dimensions and the same bit-size moduli fo = 4 using the optimized method Fo ou factoing attacks on multi-pime RSA modulus with pimes, solving an -vaiate linea equation constucted by simultaneous modula equations is pefeed fo = 3. And solving an l-vaiate (that depends on ) linea equation constucted by 1 equations is pefeed fo > 3. Both factoing attacks can be done in polynomial time. Acknowledgments. The fist autho was financially suppoted by China Scholaship Council Gant No This eseach was patially suppoted by JST CREST Gant Numbe JPMJCR14D6, Japan and JSPS KAKENHI Gant Numbe 16H02780, and National Natual Science Foundation of China (Gant Nos , ). Refeences 1. Bahig, H.M., Bhey, A., Nass, D.I.: Cyptanalysis of multi-pime RSA with small pime diffeence. In: Chim, T., Yuen, T. (eds.) ICICS LNCS, vol. 7618, pp Spinge, Heidelbeg (2012) 2. Boneh, D., Dufee, G.: Cyptanalysis of RSA with pivate key d less than N IEEE Tansactions on Infomation Theoy 46(4), (2000) 3. Boneh, D., Shacham, H.: Fast vaiants of RSA. CyptoBytes 5(1), 1 9 (2002) 4. Ciet, M., Koeune, F., Laguillaumie, F., Quisquate, J.J.: Shot pivate exponent attacks on fast vaiants of RSA. Tech. ep., UCL Cypto Goup Technical Repot Seies CG-2002/4, Univesité Catholique de Louvain (2002) 5. Collins, T., Hopkins, D., Langfod, S., Sabin, M.: Public key cyptogaphic appaatus and method (1997), US Patent#5,848, Coppesmith, D.: Finding a small oot of a bivaiate intege equation; factoing with high bits known. In: Maue, U. (ed.) EUROCRYPT LNCS, vol. 1070, pp Spinge, Heidelbeg (1996) 7. Coppesmith, D.: Finding a small oot of a univaiate modula equation. In: Maue, U. (ed.) EUROCRYPT LNCS, vol. 1070, pp Spinge, Heidelbeg (1996)

17 Gamma N (bits) Fig. 3. The expeimental esults of uppe bound on γ with vaious moduli fo = 3 using the diect method 8. Coppesmith, D.: Small solutions to polynomial equations, and low exponent RSA vulneabilities. Jounal of Cyptology 10(4), (1997) 9. Coon, J.S.: Finding small oots of bivaiate intege polynomial equations evisited. In: Cachin, C., Camenisch, J.L. (eds.) EUROCRYPT LNCS, vol. 3027, pp Spinge, Heidelbeg (2004) 10. Coon, J.S.: Finding small oots of bivaiate intege polynomial equations: A diect appoach. In: Menezes, A. (ed.) CRYPTO LNCS, vol. 4622, pp Spinge, Heidelbeg (2007) 11. De Wege, B.: Cyptanalysis of RSA with small pime diffeence. Applicable Algeba in Engineeing, Communication and Computing 13(1), (2002) 12. Hemann, M., May, A.: Solving linea equations modulo divisos: On factoing given any bits. In: Piepzyk, J. (ed.) ASIACRYPT 2008, LNCS, vol. 5350, pp Spinge, Heidelbeg (2008) 13. Hinek, M.J.: On the secuity of multi-pime RSA. Jounal of Mathematical Cyptology 2(2), (2008) 14. Hinek, M.J., Low, M.K., Teske, E.: On some attacks on multi-pime RSA. In: Nybeg, K., Heys, H. (eds.) SAC LNCS, vol. 2595, pp Spinge, Heidelbeg (2003) 15. Howgave-Gaham, N.: Finding small oots of univaiate modula equations evisited. In: Danell, M. (ed.) Cytogaphy and Coding. LNCS, vol. 1355, pp Spinge, Heidelbeg (1997) 16. Jochemsz, E.: Cyptanalysis of RSA vaiants using small oots of polynomials. Ph.D. thesis, Technische Univesiteit Eindhoven (2007) 17. Jochemsz, E., May, A.: A stategy fo finding oots of multivaiate polynomials with new applications in attacking RSA vaiants. In: Lai, X., Chen, K. (eds.) ASIACRYPT LNCS, vol. 4284, pp Spinge, Heidelbeg (2006) 18. Kiltz, E., O Neill, A., Smith, A.: Instantiability of RSA-OAEP unde chosen-plaintext attack. In: Rabin, T. (ed.) CRYPTO 2010, LNCS, vol. 6223, pp Spinge, Heidelbeg (2010) 19. Lensta, A.K., Lensta, H.W., Lovász, L.: Factoing polynomials with ational coefficients. Mathematische Annalen 261(4), (1982) 20. Lensta J, H.W.: Factoing integes with elliptic cuves. Annals of Mathematics 126(3), (1987) 21. Lu, Y., Zhang, R., Peng, L., Lin, D.: Solving linea equations modulo unknown divisos: Revisited. In: Iwata, T., Cheon, J.H. (eds.) ASIACRYPT 2015, LNCS, vol. 9452, pp Spinge, Heidelbeg (2015) 22. Rivest, R.L., Shami, A., Adleman, L.: A method fo obtaining digital signatues and public-key cyptosystems. Communications of the ACM 21(2), (1978)

18 Gamma N (bits) Fig. 4. The expeimental esults of uppe bound on γ with vaious moduli fo = 3 using the optimized method 23. Takayasu, A., Kunihio, N.: Bette lattice constuctions fo solving multivaiate linea equations modulo unknown divisos. In: Boyd, C., Simpson, L. (eds.) ACISP LNCS, vol. 7959, pp Spinge, Heidelbeg (2013) 24. Takayasu, A., Kunihio, N.: Geneal bounds fo small invese poblems and its applications to multi-pime RSA. In: Lee, J., Kim, J. (eds.) ICISC LNCS, vol. 8949, pp Spinge, Heidelbeg (2014) 25. Tosu, K., Kunihio, N.: Optimal bounds fo multi-pime Φ-hiding assumption. In: Susilo, W., Mu, Y., Sebey, J. (eds.) ACISP 2012, LNCS, vol. 7372, pp Spinge, Heidelbeg (2012) 26. Xu, J., Hu, L., Saka, S., Zhang, X., Huang, Z., Peng, L.: Cyptanalysis of multi-pime Φ- hiding assumption. In: Bishop, M., Nascimento, A.C.A. (eds.) ISC 2016, LNCS, vol. 9866, pp Spinge, Heidelbeg (2016) 27. Zhang, H., Takagi, T.: Attacks on multi-pime RSA with small pime diffeence. In: Boyd, C., Simpson, L. (eds.) ACISP LNCS, vol. 7959, pp Spinge, Heidelbeg (2013) 28. Zhang, H., Takagi, T.: Impoved attacks on multi-pime RSA with small pime diffeence. IEICE Tansactions on Fundamentals of Electonics, Communications and Compute Sciences 97(7), (2014) 29. Zheng, M., Kunihio, N., Hu, H.: Impoved factoing attacks on multi-pime RSA with small pime diffeence. In: Piepzyk, J., Suiadi, S. (eds.) ACISP LNCS, vol , pp Spinge Intenational Publishing, Cham (2017)

19 Gamma N (bits) Fig. 5. The expeimental esults of uppe bound on γ with vaious moduli fo = 4 using the optimized method Gamma N (bits) Fig. 6. The expeimental esults of uppe bound on γ with vaious moduli fo = 5 using the optimized method

20 Gamma N (bits) Fig. 7. The expeimental esults of uppe bound on γ with vaious moduli fo = 6 using the optimized method Gamma N (bits) Fig. 8. The expeimental esults of uppe bound on γ with vaious moduli fo = 7 using the optimized method