A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants

Jochemsz, Ellen; May, Alexander

doi:10.1007/11935230_18

Cited by 123 publications

(92 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[HG01] May [May10] gives a unified formulation of Coppersmith and Howgrave-Graham's results to find small solutions to polynomial equations modulo unknown divisors of integers. Later work by Jutla [Jut98] and Jochemsz and May [JM06] has generalized Coppersmith's method to multivariate equations, and Herrmann and May [HM08] obtained results for multivariate equations modulo divisors.…”

Section: Extensions To Coppersmith's Methodsmentioning

confidence: 99%

Cryptographic Applications of Capacity Theory: On the Optimality of Coppersmith’s Method for Univariate Polynomials

Chinburg

Hemenway

Heninger

et al. 2016

Advances in Cryptology – ASIACRYPT 2016

View full text Add to dashboard Cite

We draw a new connection between Coppersmith's method for finding small solutions to polynomial congruences modulo integers and the capacity theory of adelic subsets of algebraic curves. Coppersmith's method uses lattice basis reduction to construct an auxiliary polynomial that vanishes at the desired solutions. Capacity theory provides a toolkit for proving when polynomials with certain boundedness properties do or do not exist. Using capacity theory, we prove that Coppersmith's bound for univariate polynomials is optimal in the sense that there are no auxiliary polynomials of the type he used that would allow finding roots of size N 1/d+ǫ for monic degree-d polynomials modulo N . Our results rule out the existence of polynomials of any degree and do not rely on lattice algorithms, thus eliminating the possibility of even superpolynomial-time improvements to Coppersmith's bound. We extend this result to constructions of auxiliary polynomials using binomial polynomials, and rule out the existence of any auxiliary polynomial of this form that would find solutions of size N 1/d+ǫ unless N has a very small prime factor.

show abstract

Section: Extensions To Coppersmith's Methodsmentioning

confidence: 99%

Cryptographic Applications of Capacity Theory: On the Optimality of Coppersmith’s Method for Univariate Polynomials

Chinburg

Hemenway

Heninger

et al. 2016

Advances in Cryptology – ASIACRYPT 2016

View full text Add to dashboard Cite

show abstract

“…This is suggested by Coppersmith [4] and fully explained by Blömer and May in the case of bivariate integer equation [1]. For general polynomials, Jochemsz and May proposed general methods for construction of optimal lattice basis [11]. Although their method is general and effective, it cannot handle constrained variables case.…”

Section: Our Strategies Vs General Strategies For Construction Of Lamentioning

confidence: 99%

Solving Generalized Small Inverse Problems

Kunihiro

2011

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

Abstract. We introduce a "generalized small inverse problem (GSIP)" and present an algorithm for solving this problem. GSIP is formulated as finding small solutions of f (x0, x1, . . . , xn) = x0h(x1, . . . , xn) + C = 0(mod M ) for an n-variate polynomial h, non-zero integers C and M . Our algorithm is based on lattice-based Coppersmith technique. We provide a strategy for construction of a lattice basis for solving f = 0, which are systematically transformed from a lattice basis for solving h = 0. Then, we derive an upper bound such that the target problem can be solved in polynomial time in log M in an explicit form. Since GSIPs include some RSA-related problems, our algorithm is applicable to them. For example, the small key attacks by Boneh and Durfee are re-found automatically. This is a full version of [13].

show abstract

“…The next step is to build up a lattice following the extended strategy from [JM06]. This means we use the monomials of f m−1 as shifts and furthermore include extrashifts in the variables u and v up to some parameter t which has to be optimized later.…”

Section: Crt Exponentsmentioning

confidence: 99%

Maximizing Small Root Bounds by Linearization and Applications to Small Secret Exponent RSA

Herrmann

May

2010

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. We present an elementary method to construct optimized lattices that are used for finding small roots of polynomial equations. Former methods first construct some large lattice in a generic way from a polynomial f and then optimize via finding suitable smaller dimensional sublattices. In contrast, our method focuses on optimizing f first which then directly leads to an optimized small dimensional lattice.Using our method, we construct the first elementary proof of the Boneh-Durfee attack for small RSA secret exponents with d ≤ N 0.292 . Moreover, we identify a sublattice structure behind the Jochemsz-May attack for small CRT-RSA exponents dp, dq ≤ N 0.073 . Unfortunately, in contrast to the Boneh-Durfee attack, for the Jochemsz-May attack the sublattice does not help to improve the bound asymptotically. Instead, we are able to attack much larger values of dp, dq in practice by LLL reducing smaller dimensional lattices.

show abstract

A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants

Cited by 123 publications

References 14 publications

Cryptographic Applications of Capacity Theory: On the Optimality of Coppersmith’s Method for Univariate Polynomials

Cryptographic Applications of Capacity Theory: On the Optimality of Coppersmith’s Method for Univariate Polynomials

Solving Generalized Small Inverse Problems

Maximizing Small Root Bounds by Linearization and Applications to Small Secret Exponent RSA

Contact Info

Product

Resources

About