A New Method of Constructing a Lattice Basis and Its Applications to Cryptanalyse Short Exponent RSA

Abstract

We provide a new method of constructing an optimal lattice. Applying our method to the cryptanalysis of the short exponent RSA, we obtain our results which extend Boneh and Durfee's work. Our attack methods are based on a generalization to multivariate modular polynomial equation. The results illustrate the fact that one should be careful when using RSA key generation process with special parameters.

1. Introduction

The RSA [1] cryptosystem is the most widely used public-key cryptosystem. The modulo 𝑁 of RSA cryptosystem is the product of two large prime numbers 𝑝 and 𝑞, without loss of generality, we assume that 𝑝<𝑞. The public exponent 𝑒 and the secret exponent 𝑑 satisfy the equation

𝑒𝑑≡1(mod𝜙(𝑁)), (1.1) where 𝜙(𝑁)=(𝑝−1)(𝑞−1) is Euler’s totient function. In a typical RSA cryptosystem, 𝑝 and 𝑞 have approximately the same number of bits and 𝑒<𝑁. The most basic security requirement for public key cryptosystem is that it should be hard to recover the secret key from the public key.

In order to speed up the decryption or signing process, one might be tempted to use small secret exponent. Unfortunately, Wiener [2] showed that if 𝑑<𝑁^1/4, then the factorization of 𝑁 can be found in polynomial time using only the public information (𝑁,𝑒). In 1996, Coppersmith [3] introduced two methods for finding small roots of polynomial equations using lattice reduction, where one is for the univariate modular case and the other is for the bivariate case over the integers. Coppersmith’s technique has been found many applications for breaking variants of RSA; for example, Boneh and Durfee [4] improved the bound of secret exponent to 𝑑<𝑁^0.292, Coron and May [5] applied Coppersmith’s technique to show the deterministic equivalence between recovering the secret exponent 𝑑 and factoring 𝑁, and May [6] presented two polynomial time attacks for the case of imbalanced prime factors 𝑝 and 𝑞.

For a given RSA modulo 𝑁, it is not difficult to get a polynomial time algorithm for finding [√𝑁], where [√𝑁] is the integral part of 𝑁. Then 𝑝 and 𝑞 can be rewritten as 𝑝=[√𝑁]−𝑥₀ and 𝑞=[√𝑁]+𝑦₀, where 𝑥₀,𝑦₀ are unknown positive integers. Our observation is that the bound of secret exponent 𝑑 of balanced RSA is related to the bound of |𝑥₀−𝑦₀|. For instance, when 𝑝 and 𝑞 are twin prime numbers, that is, 𝑞−𝑝=2, then 𝑝 is a root of the following polynomial:

𝑁=𝑥(𝑥+2). (1.2) Therefore, for any security exponent 𝑑, there often exists an algorithm that factors 𝑁 with polynomial time. In general case, relations between the bound |𝑥₀−𝑦₀| and the bound of secret exponent 𝑑 are obtained. Boneh and Durfee’s results in [4] are special cases of our results in this paper.

We reduce our method into two cases according to the size of the public exponent 𝑒 and obtain the results by applying a new method of constructing a lattice basis. When 𝑒 is large, set 𝑓_𝑒(𝑥,𝑦)∶=𝑥(𝑦−𝐴)+1, then the polynomial 𝑓_𝑒(𝑥,𝑦) has (𝑘,𝑈) as a root modulo 𝑒, where 𝑈=𝑦₀−𝑥₀ and 𝑘 satisfies

𝑒𝑑+𝑘(𝑁+1−𝑝−𝑞)=1. (1.3) Let

𝑔_𝑖1𝑖2𝑥(𝑥,𝑦)=^𝑖1𝑦^𝑖2𝑙^𝑘𝑓_𝑒(𝑥,𝑦)^𝑘𝑒^𝑚−𝑘, (1.4) for 𝑘=0,…,𝑚, where 𝑙 is a leading monomial of 𝑓_𝑒 (for a detailed definition, see Section 3). All the polynomials 𝑔_𝑖1𝑖2 have the root (𝑘,𝑈) modulo 𝑒^𝑚. A lattice 𝐿 is defined by taking the coefficient vectors of 𝑔_𝑖1𝑖2(𝑥𝑋,𝑦𝑌) as a basis. In general, one can force the matrix of the lattice to be lower triangular. According to the 𝐿𝐿𝐿-algorithm, one hopes that the dimension of the lattice is as large as possible and entries of the diagonal are as small as possible. The following definitions are useful for describing our method clearly.

Definition 1.1. Suppose a lattice 𝐿 is spanned by vectors {𝑏₁,𝑏₂,…,𝑏_𝜔} and the matrix describing 𝐿 is a lower triangular. A vector of which the last entry of the row exceeds the modulo of the lattice is called a bad vector. A vector of which the last entry of the row is less than the modulo of the lattice is called a good vector. A lattice spanned by a basis of which all its vectors are good is called an optimal lattice.

The key ingredient of the lattice reduction technique is to construct an optimal lattice of which the dimension is as large as possible. Jochemsz and May’s strategy of constructing a lattice basis [7] is to chose a continued subset of the polynomials 𝑔_𝑖1𝑖2 as a lattice basis in which there may be some bad vectors. Our most significant contribution is that we can discard all the unnecessary bad vectors in a lattice basis with a simple new way and construct a lattice whose dimension of the lattice is large enough. We construct an optimal lattice basis by choosing a discontinued subset of the polynomials 𝑔_𝑖1𝑖2. When 𝑒 is small, a difference polynomial is chosen; similar methods but more complicated are applied to construct a lattice basis. In order to show that our method is practical, the properties of resultant are considered also in this paper.

The paper is organized as follows: some lattice preliminaries are given in Section 2. Section 3 shows the proposed method of attacking the RSA with large 𝑒. Section 4 shows the method of attacking the RSA with small 𝑒. The last section is the conclusion.

2. Lattice Theory

Let 𝑏₁,𝑏₂,…,𝑏_𝜔∈ℤ^𝑛 be linearly independent vectors with 𝜔≤𝑛. A lattice 𝐿 spanned by {𝑏₁,𝑏₂,…,𝑏_𝜔} is the set of all integer linear combinations of 𝑏₁,𝑏₂,…,𝑏_𝜔. Such a set of vectors 𝑏_𝑖’s is called a lattice basis. We say that the lattice is full rank if 𝜔=𝑛.

Let 𝑓(𝑥,𝑦)=∑_𝑖,𝑗𝑎_𝑖𝑗𝑥^𝑖𝑦^𝑗∈ℤ[𝑥,𝑦] be a bivariate polynomial with coefficients 𝑎_𝑖𝑗 in the ring of integers. The Euclidean norm of 𝑓 is defined as the norm of the coefficient vector ‖𝑓‖²=∑_𝑖𝑗𝑎²_𝑖𝑗.

Lemma 2.1. Let 𝐵={𝑏₁,𝑏₂,…,𝑏_𝑛} be a basis. On input 𝐵, the 𝐿³-algorithm outputs another basis {𝑣₁,𝑣₂,…,𝑣_𝑛} with ‖𝑣₁‖≤‖𝑣₂‖≤2^𝑛/4det(𝐿)^1/(𝑛−1), (2.1) in time polynomial in 𝑛 and in the bit-size of the entries in 𝐵.

Based on the 𝐿𝐿𝐿-algorithm, Coppersmith [3] presented a method of finding small solutions to the modular polynomial which has the desired small root over the integers. Howgrave-Graham [8] formulated a useful condition on how to find such a polynomial in terms of normal of a polynomial.

Lemma 2.2 (Howgrave-Graham [8]). Let ℎ(𝑥,𝑦)∈ℤ[𝑥,𝑦] which is the sum of at most 𝜔 monomials. Suppose that ℎ(𝑥₀,𝑦₀)≡0mod𝜑^𝑚, where |𝑥₀|<𝑋,|𝑦₀|<𝑌 and ‖ℎ(𝑥𝑋,𝑦𝑌)‖<𝜑^𝑚/√𝜔. Then ℎ(𝑥₀,𝑦₀)=0 holds over the integers.

3. The Case for Large 𝑒

Let 𝑒,𝑑 be integers such that 𝑒𝑑≡1(mod𝜙(𝑁)). It follows that there exists an integer 𝑘 satisfying

𝑒𝑑+𝑘(𝑁+1−𝑝−𝑞)=1. (3.1) Suppose that the public key and the security key satisfy 𝑒<𝑁^𝛼,𝑑<𝑁^𝛽 for some 𝛼,𝛽. In this section, we consider the case that 𝑒 is of the same order of magnitude as 𝑁 and therefore 𝛼 is very close to 1.

By (3.1), we have

𝑘<2𝑒𝑑𝑁≤𝑁^{𝛼+𝛽−1}. (3.2) Rewriting 𝑝=[√𝑁]−𝑥₀, 𝑞=[√𝑁]+𝑦₀, 𝐴=𝑁+1−2[√𝑁], and 𝑈=𝑦₀−𝑥₀, we obtain

𝑘(𝐴−𝑈)≡1(mod𝑒). (3.3) Suppose 𝑓_𝑒(𝑥,𝑦)∶=𝑥(𝑦−𝐴)+1, then the polynomial 𝑓_𝑒(𝑥,𝑦) has (𝑘,𝑈) as a root modulo 𝑒.

A monomial 𝑙 of 𝑓_𝑒, with coefficient 𝑎_𝑙, is called a leading monomial if there are no monomials in 𝑓_𝑒 besides 𝑙 that is divisible by 𝑙. Here the leading monomial of 𝑓_𝑒 is 𝑥𝑦 and its coefficient is 1. Let 𝜀>0 be an arbitrarily small constant. Depending on 1/𝜀, we fix an integer 𝑚. For 𝑘∈{0,…,𝑚+1}, we define the sets 𝑀_𝑘 of monomials as

𝑀₀∶={𝑥^𝑖1𝑦^𝑖2∣𝑥^𝑖1𝑦^𝑖2isamonomialof𝑓^𝑚_𝑒}_{1≤𝑗≤𝑡}{𝑥^𝑖1𝑦^𝑖1+𝑗∣1≤𝑖₁𝑀≤𝑚},_𝑘∶={𝑥^𝑖1𝑦^𝑖2∣𝑥^𝑖1𝑦^𝑖2isamonomialof𝑓^𝑚_𝑒𝑥and^𝑖1𝑦^𝑖2𝑙^𝑘isamonomialof𝑓_𝑒^𝑚−𝑘}_{1≤𝑗≤𝑡}{𝑥^𝑖1𝑦^𝑖1+𝑗∣𝑘≤𝑖₁≤𝑚}, (3.4) where 𝑡 is a parameter to be chosen later. We note that each set 𝑀_𝑘 in [7] is the whole monomials of 𝑓_𝑒^𝑚−𝑘, while, in our method, we discard all bad rows of the lattice and consider part monomials of 𝑓_𝑒^𝑚−𝑘.

We define the following shift polynomials

𝑔_𝑖1𝑖2𝑥(𝑥,𝑦)=^𝑖1𝑦^𝑖2𝑙^𝑘𝑓_𝑒(𝑥,𝑦)^𝑘𝑒^𝑚−𝑘, (3.5) for 𝑘=0,…,𝑚, and 𝑥^𝑖1𝑦^𝑖2∈𝑀_𝑘⧵𝑀_𝑘+1.

All the polynomials 𝑔_𝑖1𝑖2 have the root (𝑘,𝑈) modulo 𝑒^𝑚. We define a lattice 𝐿 by taking the coefficient vectors of 𝑔_𝑖1𝑖2(𝑥𝑋,𝑦𝑌) as a basis. We can force the matrix describing 𝐿 to be lower triangular. It is not difficult to see that the sets 𝑀_𝑘 can be rewritten as

𝑀₀∶={𝑥^𝑖1𝑦^𝑖2∣0≤𝑖₂≤𝑖₁≤𝑚}_{1≤𝑗≤𝑡}{𝑥^𝑖1𝑦^𝑖1+𝑗∣1≤𝑖₁𝑀≤𝑚},_𝑘∶={𝑥^𝑖1𝑦^𝑖2∣𝑘≤𝑖₂≤𝑖₁}_{1≤𝑗≤𝑡}{𝑥^𝑖1𝑦^𝑖1+𝑗∣𝑘≤𝑖₁≤𝑚}. (3.6) As an example, we consider the case 𝑚=2, and 𝑡=1. From the definition of 𝑀_𝑘, we have

𝑀₀={𝑥²𝑦³,𝑥²𝑦²,𝑥𝑦²,𝑥²𝑦,𝑥²𝑀,𝑥𝑦,𝑥,1},₁={𝑥²𝑦³,𝑥²𝑦²,𝑥𝑦²,𝑥²𝑦},𝑀₂={𝑥²𝑦³,𝑥²𝑦²}. (3.7) The matrix of the lattice for 𝑚=2 is shown in Table 1.

Table 1 

In general, we find that the condition det(𝐿)<𝑒^{𝑚(𝜔+1−𝑛)}, derived from Lemmas 2.1 and 2.2, can be reduced to

𝑋^𝑠1𝑌^𝑠2<𝑒^𝑠𝑁𝑠,for^𝑡=_{𝑥𝑖1𝑦𝑖2∈𝑀0}𝑖_𝑡𝑠,𝑡=1,2_𝑁=^𝑚_𝑘=1|𝑀_𝑘|. (3.8) Assuming that |𝑈|≤𝑁^𝛾, inequality (3.8) is equivalent to

(𝛼+𝛽−1)𝑠₁+𝛾𝑠₂−𝛼𝑠_𝑁<0. (3.9) By calculation, we obtain that

𝑠₁=𝑚(𝑚+1)(2𝑚+4+3𝑡)6,𝑠₂=𝑚(𝑚+1)(𝑚+2)6+𝑚𝑡(𝑚+𝑡+2)2,𝑠_𝑁=𝑚(𝑚−1)(𝑚+1+3𝑡)6. (3.10) For any 𝑚, the left hand side of (3.9) is minimized at 𝑡=𝑚(1−𝛽−𝛾)/2𝛾. Plugging this value into (3.9) and omitting a neglect number, we have

4𝛼𝛾+2𝛽𝛾+𝛾²−3𝛽²−2𝛾+6𝛽−3<0. (3.11)

Notice that there are some bad rows in the above lattice. Next, we refine the construction method and improve the above result. In fact, the following lattice is an optimal lattice.

For 𝑘∈{1,…,𝑚+1}, let

𝑡_𝑘=2−𝛼−𝛽−𝛾𝛾𝑘,𝑡₀=max{𝑡₁,…,𝑡_𝑚𝑀},₀∶={𝑥^𝑖1𝑦^𝑖2∣𝑥^𝑖1𝑦^𝑖2isamonomialof𝑓^𝑚_𝑒}_{0≤𝑘≤𝑚1≤𝑗≤𝑡𝑘}{𝑥^𝑖1𝑦^𝑖1+𝑗∣𝑖₁𝑀=𝑘},_𝑘∶={𝑥^𝑖1𝑦^𝑖2∣𝑥^𝑖1𝑦^𝑖2isamonomialof𝑓^𝑚_𝑒𝑥and^𝑖1𝑦^𝑖2𝑙^𝑘isamonomialof𝑓_𝑒^𝑚−𝑘}_{𝑘≤𝑙≤𝑚1≤𝑗≤𝑡𝑙}{𝑥^𝑖1𝑦^𝑖1+𝑗∣𝑖₁=𝑙}. (3.12)

The definition of shift polynomials 𝑔_𝑖1𝑖2(𝑥,𝑦) is the same as above. From the definition of 𝑀_𝑘, we have

𝑀₀∶={𝑥^𝑖1𝑦^𝑖2∣0≤𝑖₂≤𝑖₁≤𝑚}_{0≤𝑘≤𝑚1≤𝑗≤𝑡𝑘}{𝑥^𝑖1𝑦^𝑖1+𝑗∣𝑖₁𝑀=𝑘},_𝑘∶={𝑥^𝑖1𝑦^𝑖2∣𝑘≤𝑖₂≤𝑖₁}_{𝑘≤𝑙≤𝑚1≤𝑗≤𝑡𝑙}{𝑥^𝑖1𝑦^𝑖1+𝑗∣𝑖₁=𝑙}. (3.13) By some rather complex calculations, we obtain that

𝑠₁=𝑚(𝑚+1)(𝑚+2)3+𝑎𝑚(𝑚+1)(2𝑚+1)6,𝑠₂=𝑚(𝑚+1)(𝑚+2)6+𝑎²𝑚(𝑚+1)(2𝑚+1)12+𝑎𝑚(𝑚+1)4+𝑎𝑚(𝑚+1)(2𝑚+1)6,𝑠_𝑁=𝑚(𝑚−1)(𝑚+1)6+𝑎𝑚(𝑚+1)(2𝑚+1)6, (3.14) where 𝑎=(2−𝛼−𝛽−𝛾)/𝛾. The inequality (3.9) leads to

−2𝛼+2𝛽+𝛼²−𝛽²+𝛼𝛾<0. (3.15) From Lemma 2.1 and the estimations of (3.8), it is easy to see that if

−2𝛼+2𝛽+𝛼²−𝛽²+𝛼𝛾<0, (3.16) we are guaranteed to find two vectors in 𝐿 that are shorter than the bound 𝑒^𝑚/dim(𝐿). The vectors are the coefficient vectors of two bivariate polynomials ℎ₁(𝑥𝑋,𝑦𝑌) and ℎ₂(𝑥𝑋,𝑦𝑌). By Howgrave-Graham's theorem, ℎ₁(𝑥,𝑦) and ℎ₂(𝑥,𝑦) have the same root (𝑘,𝑈) over the integers. By taking resultant of ℎ₁(𝑥,𝑦) and ℎ₂(𝑥,𝑦) with respect to 𝑦, we get 𝑔(𝑥) with root 𝑘. We can easily extract 𝑘 from 𝑔(𝑥) with standard root finding algorithms. Therefore, we can find 𝑈 from ℎ₁(𝑥,𝑦) or ℎ₂(𝑥,𝑦). This completes the description of the attack. The heuristic fact that we have in our approach is as follows.

Fact 1. The probability that the construction described above yields zero polynomial that is, 𝑔(𝑥) is a zero polynomial is neglectable.

In practice, we can assume that 𝑔(𝑥) is a nonzero polynomial. The following lemma shows that Fact 1 holds.

Lemma 3.1. Let ℎ₁(𝑥,𝑦),ℎ₂(𝑥,𝑦), and 𝑔(𝑥) be defined as above. Then 𝑔(𝑥) is a zero polynomial if and only if gcd(ℎ₁(𝑥,𝑦),ℎ₂(𝑥,𝑦))≠1.

Proof. Lemma 3.1 follows from Lemma 8.2 in [9].

In fact, if the polynomials ℎ₁,ℎ₂ are random chosen, then the probability that 𝑔(𝑥) is a zero polynomial is neglectable. From the above discussion, we get the following result.

Theorem 3.2. Let 𝑒,𝑑 be defined as above and 𝑈<𝑁^𝛾. If −2𝛼+2𝛽+𝛼²−𝛽²+𝛼𝛾<0, (3.17) then we can factor 𝑁 with polynomial time.

We note that when 𝛼=1, 𝛾=1/2, the inequality in Theorem 3.2 becomes

𝛽²1−2𝛽+2>0, (3.18) which is the result in [4]

4. The Case for Small Exponent 𝑒

In this section, we suppose that 𝛼 is smaller than 1. Rewriting

𝑝=[𝑁]−𝑥₀,𝑞=[𝑁]+𝑦₀,𝐴=1−2[𝑁],𝑈=𝑦₀−𝑥₀, (4.1) by (3.1), we have

𝑒𝑑+𝑘(𝐴−𝑈)≡1(mod𝑁). (4.2) Let

𝑓_𝑁(𝑥,𝑦,𝑧)=𝑦𝑧−𝑒𝑥−𝐴𝑦+1. (4.3) It is easy to see that 𝑓_𝑁(𝑥,𝑦,𝑧) has (𝑑,𝑘,𝑈) as a root modulo 𝑁. The similar method in section 3 can be applied to three variants polynomial 𝑓_𝑁. Here the leading monomial of 𝑓_𝑁 is 𝑦𝑧 and the coefficient is 1. Let 𝜀>0 be an arbitrarily small constant. According to the size of 1/𝜀, we fix an integer 𝑚. For 𝑘∈{0,…,𝑚+1}, let

𝑡_𝑘=𝑎𝑘−𝑏𝑚,𝑡₀=max{𝑡₁,…,𝑡_𝑚}, (4.4) and 𝑐=𝑏/𝑎, where 𝑎=(2−𝛼−𝛾)/𝛾,𝑏=𝛽/𝛾. Define the sets 𝑀_𝑘 of monomials as follows

𝑀₀∶={𝑥^𝑖1𝑦^𝑖2𝑧^𝑖3∣𝑥^𝑖1𝑦^𝑖2𝑧^𝑖3isamonomialof𝑓^𝑚}_{1≤𝑗≤𝑡0}{𝑥^𝑖1𝑧^𝑗∣0≤𝑖₁≤𝑚−𝑐𝑚}_{𝑐𝑚≤𝑘≤𝑚1≤𝑗≤𝑡𝑘}{𝑥^𝑖1𝑦^𝑘𝑧^𝑘+𝑗∣1≤𝑖₁𝑀≤𝑚−𝑘},_𝑘∶={𝑥^𝑖1𝑦^𝑖2𝑧^𝑖3∣𝑥^𝑖1𝑦^𝑖2𝑧^𝑖3isamonomialof𝑓^𝑚𝑥and^𝑖1𝑦^𝑖2𝑧^𝑖3𝑙^𝑘isamonomialof𝑓^𝑚−𝑘}_{𝑐𝑚≤𝑘≤𝑚𝑘≤𝑙≤𝑚1≤𝑗≤𝑡𝑙}{𝑥^𝑖1𝑦^𝑙𝑧^𝑙+𝑗∣1≤𝑖₁≤𝑚−𝑘}. (4.5) We define the following shift polynomials:

𝑔_{𝑖1𝑖2𝑖3}𝑥(𝑥,𝑦,𝑧)=^𝑖1𝑦^𝑖2𝑧^𝑖3𝑙^𝑘𝑓(𝑥,𝑦,𝑧)^𝑘𝑁^𝑚−𝑘, (4.6) for 𝑘=0,…,𝑚, and 𝑥^𝑖1𝑦^𝑖2𝑧^𝑖3∈𝑀_𝑘⧵𝑀_𝑘+1.

All the polynomials 𝑔_{𝑖1𝑖2𝑖3} have the root (𝑑,𝑘,𝑈) modulo 𝑁^𝑚. We define a lattice 𝐿 by taking the coefficient vectors of 𝑔_{𝑖1𝑖2𝑖3}(𝑥𝑋,𝑦𝑌,𝑧𝑍) as a basis. We can force the matrix describing 𝐿 to be lower triangular. The sets 𝑀_𝑘 can be rewritten as follows:

𝑀₀={𝑥^𝑖1𝑦^𝑖2𝑧^𝑖3∣0≤𝑖₁+𝑖₂≤𝑚,and0≤𝑖₃≤𝑖₂}_{1≤𝑗≤𝑡0}{𝑥^𝑖1𝑧^𝑗∣0≤𝑖₁≤𝑚−𝑐𝑚}_{𝑐𝑚≤𝑘≤𝑚1≤𝑗≤𝑡𝑘}{𝑥^𝑖1𝑦^𝑘𝑧^𝑘+𝑗∣1≤𝑖₁𝑀≤𝑚−𝑘},_𝑘={𝑥^𝑖1𝑦^𝑖2𝑧^𝑖3∣𝑘≤𝑖₁+𝑖₂≤𝑚,and𝑘≤𝑖₃≤𝑖₂}_{𝑐𝑚≤𝑘≤𝑚𝑘≤𝑙≤𝑚1≤𝑗≤𝑡𝑙}{𝑥^𝑖1𝑦^𝑙𝑧^𝑙+𝑗∣1≤𝑖₁≤𝑚−𝑘}. (4.7)

For example, we consider the case 𝑚=2. From the definition of 𝑀_𝑘, we have

𝑀₀={𝑦²𝑧²,𝑦²𝑧,𝑥𝑦𝑧,𝑦𝑧,𝑦²,𝑥𝑦,𝑥²𝑀,𝑥,𝑦,1},₁={𝑦²𝑧²,𝑦²𝑧,𝑥𝑦𝑧,𝑦𝑧},𝑀₂={𝑦²𝑧²}. (4.8)

The matrix of the lattice for 𝑚=2 is shown in Table 2.

Table 2 

In general, we find that det(𝐿)<𝑁^{𝑚(𝜔+1−𝑛)}, derived from Lemmas 2.1 and 2.2, can be reduced to

𝑋^𝑠1𝑌^𝑠2𝑍^𝑠3<𝑁^𝑠𝑁𝑠,for^𝑡=_{𝑥𝑖1𝑦𝑖2𝑧𝑖3∈𝑀0}𝑖_𝑡𝑠,𝑡=1,2,3,_𝑁=^𝑚_𝑘=1|𝑀_𝑘|. (4.9) Let |𝑈|≤𝑁^𝛾. Hence, the inequality (4.9) is equivalent to

𝛽𝑠₁+(𝛼+𝛽−1)𝑠₂+𝛾𝑠₃≤𝑠_𝑁. (4.10) By calculation, we obtain that

𝑠₁=𝑚⁴+24(𝑎−𝑏)⁴24𝑎³𝑚⁴+𝑂(𝑚³𝑠),₂=𝑚⁴+𝑎12⁴−2𝑎³𝑏+2𝑎𝑏³−𝑏⁴12𝑎³𝑚⁴+𝑂(𝑚³𝑠),_𝑁=𝑚⁴+24(𝑎−𝑏)⁴24𝑎²𝑚⁴+𝑎⁴−2𝑎³𝑏+2𝑎𝑏³−𝑏⁴12𝑎³𝑚⁴+𝑂(𝑚³). (4.11) Plugging these value into (4.10) and omitting the neglect terms, we get that

𝛽(3𝑎³+(𝑎−𝑏)³(3𝑎+𝑏))+𝛼(2𝑎³+2(𝑎+𝑏)(𝑎−𝑏)³)+𝛾(𝑎³+(𝑎−𝑏)³(𝑎²−𝑎𝑏+2𝑎+2𝑏))−(3𝑎³+(𝑎−𝑏)³(7𝑎−3𝑏))<0, (4.12) which guarantees that we can find three vectors in 𝐿 that are shorter than the bound 𝑁^𝑚/dim(𝐿). These vectors are the coefficient vectors of three trivariate polynomials 𝑓₁(𝑥𝑋,𝑦𝑌,𝑧𝑍), 𝑓₂(𝑥𝑋,𝑦𝑌,𝑧𝑍), and 𝑓₃(𝑥𝑋,𝑦𝑌,𝑧𝑍). By Howgrave-Graham’s theorem, 𝑓₁(𝑥,𝑦,𝑧), 𝑓₂(𝑥,𝑦,𝑧), and 𝑓₃(𝑥,𝑦,𝑧) have the root (𝑑,𝑘,𝑈) over the integers. Afterward, we take the resultant of these integral polynomials with respect to the variable 𝑧 and obtain two bivariate polynomials 𝑔₁(𝑥,𝑦) and 𝑔₂(𝑥,𝑦) with root (𝑑,𝑘). By taking resultant of 𝑔₁(𝑥,𝑦) and 𝑔₂(𝑥,𝑦) with respect to 𝑦, we get 𝑔(𝑥) with root 𝑑. 𝑑 can be easily extracted from 𝑔(𝑥) with standard root finding algorithms. Therefore, we can find 𝑘 from 𝑔₁(𝑥,𝑦) or 𝑔₂(𝑥,𝑦). Similarly, we can get 𝑈. By 𝑈=𝑥₀−𝑦₀ and 𝑁=([𝑁])²+[𝑁](𝑦₀−𝑥₀)−𝑥₀𝑦₀, then 𝑁 can be factored with polynomial time. This completes the description of the attack. The heuristic fact that we have in our approach is as follows.

Fact 2. The probability that the construction described above yields zero polynomial that is, 𝑔(𝑥) is a zero polynomial is neglectable.

A similar discussion as Fact 1, we have that for random choice 𝑓₁(𝑥,𝑦,𝑧), 𝑓₂(𝑥,𝑦,𝑧), and 𝑓₃(𝑥,𝑦,𝑧), the probability that 𝑔(𝑥) is a zero polynomial is neglectable. Therefore, in practice, we can assume that 𝑔(𝑥) is a nonzero polynomial.

Theorem 4.1. Let 𝑒,𝑑 be defined as above and 𝑈<𝑁^𝛾. If 𝛽(3𝑎³+(𝑎−𝑏)³(3𝑎+𝑏))+𝛼(2𝑎³+2(𝑎+𝑏)(𝑎−𝑏)³)+𝛾(𝑎³+(𝑎−𝑏)³(𝑎²−𝑎𝑏+2𝑎+2𝑏))−(3𝑎³+(𝑎−𝑏)³(7𝑎−3𝑏))<0, (4.13) then we can factor 𝑁 with polynomial time, where 𝑎=(2−𝛼−𝛾)/𝛾,𝑏=𝛽/𝛾.

As a special case of Theorem 4.1, one can see that when 2𝛼+𝛾≤1.5 and 𝑑≤𝑁^1/2, there exists an algorithm that factors 𝑁 with polynomial time.

5. Conclusion

In this paper, we obtained our results by taking advantage of lattice reduction technique. By improving the Jochemsz and May [7] strategy of constructing a lattice basis, we throw the bad rows in the lattice and obtain an optimal lattice. Applying the method of constructing an optimal lattice to cryptanalyse short exponent RSA, we get the main results which extend those of Boneh and Durfee in [4].

Acknowledgments

This work is supported by National 973 (Grant no. 2007CB807902), NSFC project under (Grant no. 60873041), nature science of Shandong province (Grant no. Y2008G23), and Doctoral Fund of Ministry of Education of China (Grant no. 20090131120012).