Implicit Factoring with Shared Most Significant and Middle Bits

Abstract

Abstract.We study the problem of integer factoring given implicit information of a special kind. The problem is as follows: let N 1 = p 1 q 1 and N 2 = p 2 q 2 be two RSA moduli of same bit-size, where q 1 , q 2 are α-bit primes. We are given the implicit information that p 1 and p 2 share t most significant bits. We present a novel and rigorous lattice-based method that leads to the factorization of N 1 and N 2 in polynomial time as soon as t ≥ 2α + 3. Subsequently, we heuristically generalize the method to k RSA moduli N i = p i q i where the p i 's all share t most significant bits (MSBs) and obtain an improved bound on t that converges to t ≥ α + 3.55 ... as k tends to infinity. We study also the case where the k factors p i 's share t contiguous bits in the middle and find a bound that converges to 2α + 3 when k tends to infinity. This paper extends the work of May and Ritzenhofen in [9], where similar results were obtained when the p i 's share least significant bits (LSBs). In [15], Sarkar and Maitra describe an alternative but heuristic method for only two RSA moduli, when the p i 's share LSBs and/or MSBs, or bits in the middle. In the case of shared MSBs or bits in the middle and two RSA moduli, they get better experimental results in some cases, but we use much lower (at least 23 times lower) lattice dimensions and so we obtain a great speedup (at least 10 3 faster). Our results rely on the following surprisingly simple algebraic relation in which the shared MSBs of p 1 and p 2 cancel out: q 1 N 2 − q 2 N 1 = q 1 q 2 (p 2 − p 1 ). This relation allows us to build a lattice whose shortest vector yields the factorization of the N i 's.

A Simple Improvement for Integer Factorizations with Implicit Hints

“…To make this assertion more clear, we need to implement our method for more cases. Contrary to the experimental evaluation, we get no cant and middle bits [2]; 6. Application to other RSA moduli types, for example Okamoto-Uchiyama's RSA modulus p 2 q [12] and Takagi's RSA modulus p r q [17].…”

Approximate Integer Common Divisor Problem Relates to Implicit Factorization

“…Further, the technique takes care of the case considering some portions of MSBs and LSBs together. Our work is of the same quality (in general) and slightly improved (in certain cases) in comparison to [MAY09,FAU10]. We generalize the ideas of [HOW01] for the lattice based technique that we exploit in this paper and our strategy is different from that of [MAY09,SAR09,FAU10].…”

“…However, the technique of [SAR09] could only be applied for k = 2. Recently in [FAU10], the results of [SAR09] has been improved. Note that the work of [FAU10] and certain part of this work (Sections 2, 3, except Section 3.1) [SAR10] are done independently at the similar time.…”

“…, p k . Thus the work of [MAY09] (the LSB case) as well as that of [FAU10] (the work for MSB case) are considered in the same framework. Further, the technique takes care of the case considering some portions of MSBs and LSBs together.…”

Factoring RSA Keys from Certified Smart Cards: Coppersmith in the Wild

“…Ritzenhofen and May [19] and Faugère, Marinier, and Renault [9] give algorithms to factor RSA moduli when it is known that two or more moduli have prime factors that share large numbers of bits in common. Unfortunately, these results seem to apply only when the moduli have prime factors of unbalanced size, whereas in our case, both prime factors have 512 bits.…”