Factoring Integers by CVP Algorithms for the Prime Number Lattice - PowerPoint PPT Presentation

Factoring Integers by CVP Algorithms for the Prime Number Lattice Claus P . Schnorr Department of Computer Science and Mathematics Goethe-University Frankfurt Main Quantum Cryptanalysis, Schloss Dagstuhl 1.-6. Oct. 2017

The prime number lattice 2 The prime number lattice L ( B n , c ) with basis B n , c = [ b 1 , ..., b n ] ∈ R ( n + 1 ) × n for factoring large integers N : � 0  ln p 1 0 0    · · · · · ·     .     ... . B n , c = , N c =    .  0 0         � 0 0 ln p n 0     N c ln p 1 N c ln p n N c ln N · · · and target vector N c ∈ R n + 1 and the first n primes p 1 , ..., p n . Consider vectors b = � n i = 1 e i b i ∈ L ( B n , c ) close to N c ; e i ∈ Z . i > 0 p e i i < 0 p − e i We identify b ∼ ( u , v ) for u := � i , v := � . i Then || b − N c || 2 ≥ ln uv + ˆ z 2 b − N c holds for the last coordinate z b − N c = u − vN vN N c ( 1 ± o ( 1 )) of b − N c , using lim n , N →∞ o ( 1 ) = 0 ˆ with equality iff uv is squarefree. We compute b ∈ L ( B n , c ) close to N c with | u − vN | ≤ p 3 n .

The factoring method 3 The factoring method. Find ( u j , v j ) with p n -smooth e ′ u j , | u j − v j N | for j = 1 , ..., n + 1. Hence u j − v j N = ± � n i , j i = 1 p , i e ′ e i , j − e ′ e i , j u j = � n = � n � n i , j i , j i = 1 p i = 0 p mod N , i = 0 p = 1 mod N i i i for p 0 = − 1, e i , j , e ′ i , j ∈ N , e 0 , j = 0. Any solution t 1 , ..., t n + 1 ∈ { 0 , 1 } of the equations � n + 1 j = 1 t j ( e i , j − e ′ i , j ) = 0 mod 2 for i = 0 , ..., n (3.1) 1 � n + 1 j = 1 t j ( e i , j − e ′ i , j ) solves X 2 = 1 mod N by X = � n 2 i = 0 p mod N . i If X � = ± 1 mod N this yields factors gcd ( X ± 1 , N ) / ∈ { 1 , N } of The linear equations (3.1) can be solved within O ( n 3 ) bit N . operations if the vectors ( e 0 , j − e ′ 0 , j , ..., e n , j − e ′ 1 , n ) for j = 1 , ..., n + 1 are linearly independent. This factoring method goes back to Morrison & Brillhart [MB75]. We get � n i = 1 p ie i , j = ± � n e ′ fac-relations i = 0 p i mod N i , j z b − N c ≈ u − vN from vectors b ∈ L ( B n , c ) close to N c . Then ˆ vN N c makes | u − vN | ≤ vN 1 − c || b − N c || / √ n small for c > 1.

Results of Dickman, De Bruijn, Hildebrand 4 Let Ψ( X , y ) denote the number of integers in [ 1 , X ] that are y -smooth. D ICKMAN [1930] shows lim y →∞ Ψ( y z , y ) y − z = ρ ( z ) for any fixed z > 0. ρ ( z ) is the Dickman, De Bruijn ρ - function. It is known that ρ ( z ) = 1 for 0 ≤ z ≤ 1, ρ ( z ) = 1 − ln z for 1 ≤ z ≤ 2 � e ± o ( 1 ) � z = 1 / z z + o ( z ) for z → ∞ ρ ( z ) = (4.1) z ln z H ILDEBRAND [H84] extended (4.1) to a wide finite range of z . For any fixed ε > 0 � ln ( z + 1 ) Ψ( y z , y ) y − z = ρ ( z ) � �� 1 + O (4.2) ln y holds uniformly for 1 ≤ z ≤ y 1 / 2 − ε , y ≥ 2 under the Riemann Hypothesis.

The relevant area of ( u , v , | u − vN | ) 5 The area of p n -smooth triplets ( u , v , | u − vN | ) for large v . Let # N , n ,δ denote the number and REL N , n ,δ the set of such triplets 2 N δ < v ≤ N δ , 1 2 N 1 + δ < u ≤ N 1 + δ . n and 1 such that | u − vN | ≤ p 3 Neglecting for y = p n , y z = N δ , z = δ ln N ln p n the O ( ln ( z + 1 ) ) -term of ln y (4.2), the number of p n -smooth v ∈ [ 1 2 N δ , N δ ] is for z v := δ ln N ln p n , v := z v − ln 2 z ′ ln p n Ψ( N δ , p n ) − Ψ( N δ / 2 , p n ) ≈ N δ � ρ ( z v ) − 1 2 ρ ( z ′ � v ) . Hence random v ∈ R [ 1 2 N δ , N δ ] are p n -smooth with probability close to 2 ( ρ ( z v ) − 1 v )) . Random u ∈ [ 1 2 ρ ( z ′ 2 N 1 + δ , N 1 + δ ] are p n -smooth with probability close to 2 ( ρ ( z u ) − 1 2 ρ ( z ′ u )) for z u := ( 1 + δ ) ln N , z ′ u := z u − ln 2 ln p n . Hence ln p n # N , n ,δ ≈ 4 N δ p 3 � ρ ( z u ) − 1 2 ρ ( z ′ �� ρ ( z v ) − 1 2 ρ ( z ′ � n ρ ( 3 ) u ) v ) (5.1) if p n -smoothness of u , v and | u − vN | are nearly statist. indep.

I: The number of p n -smooth triplets u , v , | u − vN | 6 10 14 10 20 2 100 2 200 2 400 2 800 N ≈ n 48 100 256 1350 7850 41350 p n 223 541 1619 11149 80173 497561 δ 0 . 35 0 . 55 0 . 71 1 . 2 1 . 57 2.1 # N , n ,δ 126 215 392 1608 10131 49591 0 . 8468 1 . 14 1 . 3902 1 . 998 2 . 4478 3 . 029 c ln ( N δ / p 3 n ) − 4 . 9 6 . 4 27 138 401 1132 Table 1 : parameters n , p n , δ, c = δ + 1 − 3 ln p n for factoring N ln N δ of table 1 nearly maximizes # N , n ,δ and n is nearly minimal such that # N , n ,δ clearly surpasses n . We have δ > 3 ln p n ln N . Corollary Let c = δ + 1 − ln p 3 n = N o ( 1 ) and let ln N , p 3 n || b − N c || 2 ≈ ||L ( B n , c ) − N c || 2 for nearly squarefree 2 N δ < v ≤ N δ and ( u , v ) ∼ b ∈ L ( B n , c ) such that 1 n . Then || b − N c || 2 � λ 2 | u − vN | ≤ p 3 1 ( L ) − ln N .

I: Proof of the Corollary 7 z b − N c = u − vN c N c ( 1 ± o ( 1 )) that We get from ˆ vN | u − vN | ≈ vN 1 − c || b − N c || / √ n . 2 N δ < v ≤ N δ if Hence | u − vN | ≤ p 3 n holds for 1 1 + δ − c + ln ( || b − ln N c || / √ n ) / ln N ≤ 3 ln p n ln N where ln ( || b − N c || / √ n ) / ln N = o ( 1 ) . As the run time of the CVP for L ( B n , c ) , N c increases with c we choose for the search of fac-relations u , v , | u − vN | with 2 N δ < v ≤ N δ in practice c ≈ δ + 1 − 3 ln p n / ln N . 1 In fact the p n -smooth ( u , v ) that satisfy | u − vN | ≤ p 3 n and 2 N δ < v ≤ N δ yield b ∈ L ( B n , c ) , b ∼ ( u , v ) with nearly minimal 1 || b − N c || for c ≈ δ + 1 − 3 ln p n ln N .

I: finding n + 1 fac-relations efficiently 8 Iterative increase of c so that vectors b ∈ L ( B n , c ) close to N c yield distinct p n -smooth u , | u − vN | (fac-relations) . The Corollary shows that || b − N c || 2 � λ 2 1 − ln N holds for 2 N δ < v ≤ N δ and n / ln N if b ∼ ( u , v ) and 1 c = δ + 1 − ln p 3 | u − vN | ≤ p 3 n . Such b are particularly close to N c and yield a fac-relation if | u − vN | is p n -smooth which happens with probability ρ ( 3 ) ≈ 0 . 0486. We get distinct fac-relations from c and c ′ ≥ c + ln 2 / ln N . The vectors b ∈ L ( B n , c ) , b ∼ ( u , v ) close to N c satisfy z b − N c | = N c | u − vN | ( 1 ± o ( 1 )) . Then | u − vN | ≤ p 3 n = N o ( 1 ) | ˆ vN implies v ≥ N c − 1 ( 1 − o ( 1 )) for c > 1. Therefore both v and u / N increase proportionate to N c − 1 . Thus v of ( u , v ) ∼ b close to N c satisfies v � N c − 1 and v ′ of ( u ′ , v ′ ) ∼ b ′ close to N c ′ satisfies v ′ � N c ′ − 1 ≥ 2 N c − 1 . Hence Rel N , n ,δ ∩ Rel N , n ,δ ′ ≈ ∅ for δ ′ ≥ δ + ln 2 / ln N . So we iteratively increase δ and c to δ ′ := δ + ln 2 / ln N and c ′ := c + ln 2 / ln N per round so that δ passes the area for which # N , n ,δ of (4.1) is substantial.

I: Decreasing the dimension n of L ( B n , c ) 9 Recall: We identify b = � n i = 1 e i b i ∈ L ( B n , c ) ∼ ( u , v ) where i > 0 p e i i < 0 p − e i u := � i , v := � . i To minimize the time to get about n fac-relations we simply transform a reduced basis of L ( B n , c ) to a reduced basis of L ( B n , c ′ ) by multiplying the last coordiates of the b i of B n , c T and of N c by N c ′ − c .This replaces N c by N c ′ . We do not adjust the success rate ¨ β t to small increases of c . By iteratively increasing c we can in table 1 decrease n = dim L ( B n , c ) = 41350 for N ≈ 2 800 to n = 40000. This decreases # N , n , 2 . 1 from 49591 to 717. So we find about 700 fac-relations by minimizing ||L ( B n , c ) − N c || for c = 2 . 1 − 3 ln p n / ln N . Then we increase c to c + ln 2 / ln N to generate fac-relations in Rel N , n ,δ ′ for δ ′ := δ + ln 2 / ln N .

I: Time for SVP 10 The efficiency of our SVP algorithm for L ( B ) depends on the invariant rd ( L ) := λ 1 γ − 1 / 2 ( det L ) − 1 / n which we call the relative n λ 2 1 = rd ( L ) 2 γ n ( det L ) 2 density of L . ( ) Proposition Let the basis B = QR , R ∈ R n × n of L satisfy � λ 1 � 1 � 2 and GSA and let L have a shortest lattice e π rd ( L ) ≤ � b 1 � 2 n vector b ′ that satisfies SA . Then E NUM with linear pruning finds such b ′ under the volume heuristics in polynomial time. GSA : The basis B = QR , R = [ r i , j ] 1 ≤ i , j ≤ n satisfies r i , j = 0 for i < j and r 2 i , i / r 2 i − 1 , i − 1 = q for 2 ≤ i ≤ n for some q > 0. SA : There is a vector b ′ ∈ L ( B ) such that � b ′ � = λ 1 and � π t ( b ′ ) � 2 � n − t + 1 λ 2 1 for t = 1 , . . . , n . || b || = r 1 , 1 . n Linear pruning means to cut off all stages ( e t , ..., e n ) that i = t e i b i ) || 2 > n − t + 1 satisfy || π t ( � n λ 2 1 . n