An Attack Bound for Small Multiplicative Inverse of φ ( N ) mod e with a Composed Prime Sum p + q Using Sublattice Based Techniques

In this paper, we gave an attack on RSA when φ(N) has small multiplicative inverse modulo e and the prime sum p + q is of the form p + q = 2k0 + k1 where n is a given positive integer and k0 and k1 are two suitably small unknown integers using sublattice reduction techniques and Coppersmith’s methods for finding small roots of modular polynomial equations. When we compare this method with an approach using lattice based techniques, this procedure slightly improves the bound and reduces the lattice dimension.


Introduction
RSA Cryptosystem is the first public key cryptosystem invented by Ronald Rivest, Adi Shamir and Leonard Adalman in 1977 where the encryption and decryption are based on the fact that if N = pq, is the modulus for RSA, p, q distinct primes, if 1 ≤ e ≤ ϕ(N ) with (e, ϕ(N )) = 1 and d, the multiplicative inverse of e modulo ϕ(N ), then m ed = m mod N , for any message m, an integer in Z N .The security of this system depends on the difficulty of finding factors of a composite positive integer, that is product of two large primes.In 1990, M.J.Wiener [20] was the first one to describe a cryptanalytic attack on the use of short RSA deciphering exponent d.This attack is based on continued fraction algorithm which finds the fraction t d , where t = ed−1 ϕ(n) in a polynomial time when d is less than N 0.25 for N = pq and q < p < 2q.Using lattice reduction approach based on the Coppersmith techniques [7] for finding small solutions of modular bivariate integer polynomial equations, D. Boneh and G. Durfee [4] improved the wiener result from N 0.25 to N 0.292 in 2000 and J. Blömer and A. May [5] has given an RSA attack for d less than N 0.29 in 2001, that requires lattices of dimension smaller than the approach by Boneh and Durfee.In 2006, E. Jochemsz and A. May [10], described a strategy for finding small modular and integer roots of multivariate polynomial using lattice-based Coppersmith techniques and by implementing this strategy they gave a new attack on an RSA variant called common prime RSA.
In our paper [2], first we described an attack on RSA when ϕ(N ) has small multiplicative inverse k of modulo e, the public encryption exponent by using lattice and sublattice based techniques.Let N = pq, q < p < 2q, p − q = N β and e = N α > p + q.As (e, ϕ(N )) = 1, there exist unique r, s such that (p − 1)r ≡ 1(mod e) and (q − 1)s ≡ 1(mod e).For k = rs(mod e), kϕ(N ) ≡ 1(mod e) and define g(x, y) = x(y + B) − 1 where B = N + 1 − 2 √ N .Then the pair (x 0 , y 0 ) = (k, −((p + q) − 2 √ N )) is a solution for the modular polynomial equation g(x, y) ≡ 0(mod e).Now applying the lattice based techniques given by Boneh-Durfee in [4] using x, y shifts and using only x shifts to the above modular polynomial equation, we get the attack bounds for δ, |k| ≤ N δ are δ < by implementing the sublattice based techniques with lower dimension given by J. Blömer and A. May in [5], this bound is slightly less than the above bound but this method requires lattices of smaller dimension than the above method.All these attack bounds are depending on the prime difference p−q = N β and α− √ αβ is the maximum upper bound for δ.
Later we described that, for β ≈ 0.5, the maximum bound for δ may be improved if the prime sum p + q is in the form of the composed sum p + q = 2 n k 0 + k 1 where n is a given positive integer and k 0 and k 1 are two suitably small unknown integers.Define the polynomial congruence f (x, y, z) ≡ 0(mode) for f (x, y, z) where 2 n is an inverse of 2 n mod e.By using lattice based techniques to the above polynomial congruence, the attack bound for δ is such that δ < Now in this paper we slightly improved the above bound by using the sub-lattice based techniques given by J. Blömer, A. May in [5] to the above polynomial congruence and this method requires lattice of smaller dimension than the above method.

Preliminaries
In this section we state basic results on lattices, described briefly lattice basis reduction, Coppersmith's method and Howgrave-Graham theorem that are based on lattice reduction techniques are described.A basis for L is any set of independent vectors that generates L. The dimension of L is the number of vectors in a basis for L. In 1982, A. K. Lenstra, H. W. Lenstra, Jr. and L. Lovasz [11] invented the LLL lattice based reduction algorithm to reduce a basis and to solve the shortest vector problem in polynomial time.The general result on the size of individual LLL-reduced basis vectors is given in the following Theorem.
An important application of lattice reduction found by Coppersmith in 1996 [7] is finding small roots of low-degree polynomial equations.This includes modular univariate polynomial equations and bivariate integer equations.In 1997 Howgrave-Graham [8] reformulated Coppersmith's techniques and proposed a result which shows that if the coefficients of h(x, y) are sufficiently small, then the equality h(x 0 , y 0 ) = 0 holds not only modulo N , but also over integers.The generalization of Howgrave-Graham result in terms of the Euclidean norm of a polynomial h(x 1 , x 2 , ..., x n ) = a i1...in x i1 1 ...x in n is defined by the Euclidean norm of its coefficient vector i.e., ||h(x 1 , x 2 , ..., x n )|| = a 2 i1...in given as follows: Theorem 2. (Howgrave-Graham): Let h(x 1 , x 2 , ..., x n ) ∈ Z[x 1 , x 2 , ..., x n ] be an integer polynomial that consists of at most ω monomials.Suppose that ≡ 0 mod e m for some m where |x ω .Then h(x 1 , x 2 , ..., x n ) = 0 holds over the integers.

Resultant of two polynomials:
The resultant of two polynomials f (x 1 , x 2 , . . ., x n ) and g(x 1 , x 2 , . . ., x n ) with respect to the variable x i for some 1 ≤ i ≤ n, is defined as the determinant of Sylvester matrix of f (x 1 , x 2 , . . ., x n ) and g(x 1 , x 2 , . . ., x n ) when considered as polynomials in the single indeterminate x i , for some 1 ≤ i ≤ n.
Remark 2. The resultant of two polynomials is non-zero if and only if the polynomials are algebraically independent .
n is a common solution of algebraically independent polynomials f 1 , f 2 , . . ., f m for m ≥ n, then these polynomials yield g 1 , g 2 , . . ., g n−1 resultants in n − 1 variables and continuing so on the resultants yield a polynomial t(x i ) in one variable with x i = x (0) i for some i is a solution of t(x i ).Note the polynomials considered to compute resultants are always assumed to be algebraically independent.

An Attack Bound Using Sublattice Reduction Techniques
In this section, an attack bound for a small multiplicative inverse k of ϕ(N ) modulo e when the prime sum p + q is of the form p + q = 2 n k 0 + k 1 , where n is a given positive integer and k 0 and k 1 are two suitably small unknown integers using sublattice reduction techniques is described.
In our paper [2], we proposed an attack on RSA when ϕ(N ) has small multiplicative inverse modulo e and the prime sum p + q is of the form p + q = 2 n k 0 + k 1 , where n is a given positive integer and k 0 and k 1 are two suitably small unknown integers using lattice reduction techniques.
where l is a leading monomial of f and define the shift polynomials as and f = a −1 l f mod e for the coefficient a l of l.For 0 ≤ k ≤ m, divide the above shift polynomials according to t = 0 and t ≥ 1.Then for t = 0, the shift polynomials g(x, y, z) are and for t ≥ 1, the shift polynomials h(x, y, z) are Let L be the lattice spanned by the coefficient vectors g(xX, yY, zZ) and h(xX, yY, zZ) shifts with dimension . Let M be the matrix of L with each row is the coefficients of the shift polynomial g-shifts .., z t , xz 2 , ..., xz 1+t , ..., x m z m+1 , ..., x m z m+t , xyz, ..., xyz t , x 2 yz 2 , ..., x 2 yz 1+t , ..., x m yz m , ..., x m yz (m−1)+t , . . .
x m y m z, ..., x m y m z t .As xy is the leading monomial in f (x, y, z) with coefficient 1, the diagonal elements in the matrix M are g-shifts Note that the matrix M is lower triangular matrix.Therefore, the determinant is where n(e), n(X), n(Y ) and n(Z) are denotes the number of e's, X's, Y 's and Z's in all diagonal elements respectively.Let N δ , N γ1 and N γ2 be the upper bounds for X, max{k 0 , k 1 } and min{k 0 , k 1 } respectively, then the bound for δ in which the generalized Howgrave-Graham result holds given in the following theorem.Theorem 3. [2] Let N = pq be an RSA modulus with q < p < 2q.Let e = N α , X = N δ , Y = N γ1 , Z = N γ2 and k be the multiplicative inverse of ϕ(N ) modulo e. Suppose the prime sum p + q is of the form p + q = 2 n k 0 + k 1 , for a known positive integer n and for |k| ≤ X, To improve this bound in a lower dimension than the above dimension, first we construct a sublattice S L of L and after that we apply the sublattice based techniques to the lattice S L given by J. Blömer, A. May in [5], and are described in the following sections.

Construction of a sublattice S S S L of L
The construction of a sublattice S L of L in order to improve the bound for δ is given in the following.
• First remove some rows in M corresponding to g-shifts, are such that e m , xe m , xze m , ..., x m−1 e m , ..., Therefore the remaining rows in M corresponding to g-shifts are x m e m , x m ze m , ..., x m z m e m , x m−1 f e m−1 , ..., x m−1 z m−1 f e m−1 , . . .
.., xz t+1 f m−1 e, zf m , ..., z t f m , and its corresponding h-shifts can be written as Now let S L be the sub-lattice of L spanned by the coefficients of the vectors g s (xX, yY, zZ) and h s (xX, yY, zZ) shifts and M s be the matrix of the lattice S L .Note that the matrix M s is not square.So apply the sublattice based techniques to the basis of S L or the rows of M s to get a square matrix.Using that square matrix, the attack bound can be found and is given in the following section.

Applying sub-lattice based techniques to get an attack bound
In [5], J. Blomer, A. May proposed a method to find an attack bound for low deciphering exponent in a smaller dimension than the approach by Boneh and Durfee's attack in [4].Apply their method based on sublattice reduction techniques to our lattice S L to get an attack bound and is described in the following.
In order to apply the Howgrave-Graham's theorem by using Theorem 1, we need three short vectors in S L as our polynomial consists three variables.But note that M s is not a square matrix.So, first construct a square matrix M sl by removing some columns in M s , which are small linear combination of non-removing columns in M s .Then the short vector in M sl lead to short reconstruction vector in S L .
Construction of a square sub-matrix M sl of M s .
Columns in M and M s are same and each column in M is nothing but the coefficients of a variable, which is a leading monomial of the polynomial g or h-shifts.The first ( 1 6 m 3 + m 2 + 11 6 m + 1) and remaining 1 2 (m 2 + m)t + (m + 1)t columns are corresponding to the leading monomial of the polynomials g and h-shifts respectively.Therefore, 1. the first ( 1 6 m 3 +m 2 + 11 6 m+1) columns are the coefficients of the each variable x i1 y i2 z i3 for i 1 = i 2 = k, i 3 = 0 and i 1 = k + 1, ..., m, i 2 = k, i 3 = 0, ..., (i 1 − i 2 ) and remaining 1  2 (m 2 + m)t + (m + 1)t columns are the coefficients of the each variable x i1 y i2 z i3 for i 1 = i 2 = k, i 3 = 1, ..., t and i 2. As 1, x, xy, xz are the monomials of f , the set of all monomials of f m for m ≥ 0 is {x i1 y i2 z i3 ; i 1 = 0, ..., m, i 2 = 0, ..., i 1 , i 3 = 0, ..., i 1 − i 2 }.Therefore, the coefficient of the variable Remove columns in M s corresponding to the coefficients of the variable x a y b z c for all 0 ≤ a ≤ m − 1 and note that every such column is remaining rows in M s .We prove this theorem in two cases.
Case(i): Any column in first ( 1 6 m 3 + m 2 + 11 6 m + 1) columns of M s .i.e., a column corresponding coefficients of a variable x a y b z c with a ≥ b + c, from the above analysis in (1).
Given that 0 ≤ a ≤ m − 1.From the above analysis in ( 1) and ( 2), the coefficient of x a y b z c is non-zero in g s -shifts x k1 z k2 f n e k1 if and only Therefore, the coefficient of x a y b z c is non-zero in g s -shifts x k1 z k2 f n e k1 if and only if Similarly we can prove that, the coefficient of x a y b z c is non-zero in h s -shifts x k1 z k2 f n e k1 if and only if 1) and ( 2), and say min{c, k 1 + t} = l t The formula for finding a coefficient of a variable and coefficient of x a y b z c in x k1 y k2 f n e k1 is nothing but a coefficient of Note that a column corresponding to a variable x m y m−a z c is in the non-removing columns in M s and coefficient of x m y m−a z c is zero for The columns corresponding to a variable x a y b z c and a variable x m y m−a z c only with non-zero terms is depicted in Table 1.Therefore, from Table 1 the result holds in this case.
Case(ii): Any column in remaining 1 2 (m 2 + m)t + (m + 1)t columns of M s , i.e.,a column corresponding coefficients of a variable x a y b z c with a < b + c, from the above analysis in (1).
Note that coefficient of x m y m−a z c is zero in all g s -shifts as a > c and for k 1 > a − b in h s -shifts.The columns corresponding to a variable x a y b z c and a variable x m y m−a z c only with non-zero terms is depicted in Table 2. Therefore, from Table 2 the result holds in this case.

Rows corresponding to g and h shifts
Column corresponding to x a   From the above theorem, all columns corresponding to a variable x a y b z c for all 0 ≤ a ≤ m − 1 are depending on a non-removed column, corresponding to a variable x m y m−(a−b) z c in M s .Let M sl be a matrix formed by removing all above columns from the matrix M s and S l be a lattice spanned by rows of M sl .Then the short vector in S l lead to short reconstruction vector in S L , i.e., if u = b∈B c b b is a short vector in S l then this lead to a short vector ū = As we removed all depending columns in M s to form a matrix M sl , apply the lattice based techniques to S l instead of S L to get an attack bound and this lattice reduction techniques gives a required short vectors in S L for a given bound.
The matrix M sl is lower triangular with rows same as in M s and each column corresponding to coefficients of one of the variables ( leading monomials of g s and h s -shifts) x m , x m z, ..., x m z m , x m y, ..., x m yz m−1 , . . .
x m y m−1 z 2 , ..., x m y m−1 z 1+t , x m y m z, .., x m y m z t .
Since S l is full-rank lattice, det S l = det M sl = e n(e) X n(X) Y n(Y ) Z n(Z) where n(e), n(X), n(Y ), n(Z) are denotes the number of e s, X s, Y s, Z s in all the diagonal elements of M sl respectively.As x n y n is a leading monomial of f n with coefficient 1, we have we improved the bound for δ up to α − √ αβ by implementing the sublattice based techniques given by Boneh and Durfee in [4] under the condition δ > α − β(1 + α) and improved the bound for δ up to δ < 2α−6β+2 √ α 2 −αβ+4β 2 5

Definition 1 .
Let b 1 , b 2 , ..., b n ∈ R m be a set of linearly independent vectors.The lattice L generated by b 1 , b 2 , ..., b n is the set of linear combinations of b 1 , b 2 , ..., b n with coefficients in Z.

Remark 1 .
If L is a full rank lattice, means n = m then the determinant of L is equal to the determinant of the n × n matrix whose rows are the basis vectors b 1 , b 2 , ..., b n .

1 X 11 6 5 Preprints
a multiple of a non-removed column, corresponding to the coefficients of x m y m−(a−b) z c and is proved in the following theorem.Theorem 4. Each column in M s corresponding to the coefficients of the variable x a y b z c , a leading monomial of the polynomial g or h-shifts, for all 0≤ a ≤ m − 1 is m−(a−b) (m−a)!b! • m−a Y m−a multiple of a non-removed column, represents the coefficients of the variable x m y m−(a−b) z c .Proof.For n = 0, ..., m, k 1 = m − n, k 2 = 0, ..., k 1 , the g s -shifts x k1 z k2 f n e k1 corresponds first ( 1 6 m 3 + m 2 + m+1) rows in M s and for n = 0, ..., m, k 1 = m−n, k 2 = k 1 +1, ..., k 1 +t, the h s -shifts x k1 z k2 f n e k1 corresponds (www.preprints.org)| NOT PEER-REVIEWED | Posted: 20 July 2018 doi:10.20944/preprints201807.0379.v1Peer-reviewed version available at Cryptography 2018, 2, 36; doi:10.3390/cryptography2040036

+ 11 6 m
+ 1) columns of Ms and a column corresponding to coefficients of a variable x m y m−a z c only with non-zero terms.Rows corresponding to Column corresponding to x a y b z c Column corresponding to x m y m−a z c g and h shifts x a−b Ms and a column corresponding to coefficients of a variable x m y m−a z c only with non-zero terms.

b∈B
c b b (same coefficients c b ) in S L where B and B are the basis for S l and S L respectively.