Bound Estimation for Divisors of RSA Modulus with Small Divisor-Ratio
Total Page:16
File Type:pdf, Size:1020Kb
International Journal of Network Security, Vol.23, No.3, PP.412-425, May 2021 (DOI: 10.6633/IJNS.202105 23(3).06) 412 Bound Estimation for Divisors of RSA Modulus with Small Divisor-ratio Xingbo Wang (Corresponding author: Xingbo Wang) Department of Mechatronic Engineering, Foshan University Guangdong Engineering Center of Information Security for Intelligent Manufacturing System, China Email: [email protected]; [email protected] (Received Nov. 16, 2019; Revised and Accepted Mar. 8, 2020; First Online Apr. 17, 2021) Abstract make it easier to find the small divisor; articles [2, 10] found out the distribution of an odd integer's square-root Through subtle analysis on relationships among ances- in the T3 tree; articles [11, 15, 17] investigated divisors' tors, symmetric brothers, and the square root of a node distribution of an RSA number, presenting in detail how on the T3 tree, the article puts a method forwards to cal- two divisors distribute on the levels of the T3 tree in terms culate an interval that contains a divisor of a semiprime of their divisor-ratio. whose divisor-ratio is less than 3/2. Concrete mathemat- This paper, following the studies in [11, 15, 17], and ical reasonings to derive the method and programming based on the inequalities proved in [12] as well as the procedure from realizing the calculations are shown in theorems proved in [13, 16], gives in detail a bound esti- detail. Numerical experiments are made by applying the mation to the divisors of an RSA number. The results in method on both ordinary small semiprimes and the RSA this paper are helpful to design algorithm to search the numbers. In the end, the paper makes predictions on divisors. the divisors' bounds of RSA232, RSA240, RSA250, and RSA260. Keywords: Binary Tree; Bound Estimation; Cryptogra- 2 Preliminaries phy; RSA Modulus 2.1 Symbols & Notations Symbol bxc is the floor function, an integer function of 1 Introduction real number x that satisfies inequality x − 1 < bxc ≤ x, or equivalently bxc ≤ x < bxc + 1. Symbol fxg = x − bxc Since the RSA numbers came into being, factoring an is the fractional part of x. RSA number has been a challenge in the research of net- work security. In spite that reports of factoring certain A valuated binary tree T is such a binary tree that RSA numbers have been made now and then, it is a fact each of its nodes is assigned a value. An odd number N- that conventional and systematic methods to factorize rooted tree, denoted by TN is a recursively constructed RSA numbers in high efficiency are still under develop- valuated binary tree whose root is the odd number N with ment [1, 4]. This is the reason why there are still re- 2N − 1 and 2N + 1 being the root's left and right sons, searchers working on the issue of seeking new approaches respectively. In this whole paper, symbol T3 is the T3 to factorize large integers [5, 6]. In 2016, article [7] pro- tree and symbol N(k;j) is by default the node at position k posed an approach to study integers by putting the odd j on level k of T3, where k ≥ 0 and 0 ≤ j ≤ 2 − 1. integers bigger than 1 on a full perfect binary tree from Figure 1 shows the first 6 levels of the T3 tree. By using top to bottom and from left to right. Such a binary tree is the asterisk wildcard *, symbol N(k;∗) means a node lying on level k. Node N(k;s)is called a brother of N(k;j) if s 6= called a T3 tree, as analyzed in article [8]. The T3 tree en- ables us to analyze an odd integer and its divisors' distri- j. N(k;s)is called a symmetric brother of N(k;j) if N(k;s) bution on its layers (levels) and exhibits many new prop- and N(k;j) are at the symmetric positions in a subtree. erties of semiprimes, especially in knowing a semiprime by An integer X is said to be clamped on level k of T3 if k+1 k+2 ^ means of analyzing its divisor-ratio that is calculated by 2 ≤ X ≤ 2 − 1 and use symbol X = k to indicate the semiprime's big divisor divided by the small divisor. such a clamping relation. An odd integer O satisfying k+1 k+2 For example, article [9] proved that the small divisor of a 2 + 1 ≤ O ≤ 2 − 1 is said to be on level k of T3, semiprime would lie in an interval that is uniquely deter- and use symbol O =∆ k to express it. Symbol (p =◦ q) = k mined by the divisor-ratio and a bigger divisor-ratio could means integers p and q are on the same level k or clamped International Journal of Network Security, Vol.23, No.3, PP.412-425, May 2021 (DOI: 10.6633/IJNS.202105 23(3).06) 413 : on the same level k. Symbol p=· q means p and q separately Lemma 3. (See in [17]).Let N > 64 be an odd integer lie on two different levels. Symbol A ⊗ B means A holds and k = blog2Nc − 1, where divisors p and q satisfy 1 < q and simultaneously B holds, symbol A ⊕ B means A or p < q and 1 < p < 2; then B holds. Symbol (a = b) > c means a takes the value of b and a > c. Symbol A ) B means conclusion B can be 1) There are 3 possible cases in terms of the levels on derived from condition A. Symbol A <> B means the which p and q lie; They are relation between A and B is uncertain. If a semiprime q N = pq satisfies 1 < p < q and 1 < < 3 , then N is said 8 ∆ k+1 ∆ k+1 p 2 > (p = 2 − 2) ⊗ (q = 2 − 1) to be a semiprime with small divisor-ratio. < (p =∆ k+1 − 1) ⊗ (q =∆ k+1 − 1) An odd interval [a; b] is a set of consecutive odd num- 2 2 :> ∆ k+1 ∆ k+1 bers that take a as the lower bound and b as the upper (p = 2 − 1) ⊗ (q = 2 ) bound, for example, [3; 11] = f3; 5; 7; 9; 11g. Intervals in this whole article are by default the odd ones unless par- 2) If k > 2 then ticularly mentioned. Symbol mod is the modulo operation and expression r = a mod b means a ≡ r(modb). $p % jp k k + 1 N k + 1 N =^ − 1 ) =^ − 2 2 2 2 2.2 Lemmas Lemma 1. (See in [8]). T tree has the following fun- 3 In general, for arbitrary positive integers M and k it holds damental properties. P1. Every node is an odd integer and every odd integer ( M ^ ^ 2 = k − 1 bigger than 1 must be on T . Odd integer N with M = k ) ^ 3 2M = k + 1 N > 1 lies on level blog2Nc − 1. P2. N(k;j) is calculated by Lemma 4. (See in [11]).For a semiprime N = pq with q 3 k+1 k 1 < p < q and 1 < p < 2 , let k = blog2Nc − 1 then it N(k;j) = 2 + 1 + 2j; j = 0; 1; :::; 2 − 1 holds for an even k and thus k+1 k+1 jp k b 2 c b 2 c−5 k+1 k+2 2 + 2 + 1 ≤ p ≤ N 2 + 1 ≤ N(k;j) ≤ 2 − 1: and P3. Nodes N(k+1;2j) and N(k+1;2j+1) on level k + 1 are p j k b k+1 c+1 b k+1 c−1 respectively the left and right sons of node N(k;j). On N ≤ q ≤ 2 2 + 2 2 − 1 level (k+i) the descendants of N(k;j) are N(k+i;2ij+!) with ! satisfying ( 0 ≤ ! ≤ 2i − 1),namely, whereas it holds for an odd k N(k+i;2ij);N(k+i;2ij+1);N(k+i;2ij+2); :::; N(k+i;2ij+2i−1) p k+1 k+1 −2 j k 2b 2 c − 2b 2 c + 1 ≤ p ≤ N P4. Multiplication of arbitrary two nodes of T3, say N(m,α) and N(n,β), is a third node of T3. Let J = and m n p 2 (1 + 2β) + 2 (1 + 2α) + 2αβ + α + β; the multipli- j k k+1 +1 N ≤ q ≤ 2b 2 c − 1 cation N(m,α) × N(n,β) is given by m+n+2 N(m,α) × N(n,β) = 2 + 1 + 2J Consequently, m+n+1 If 0 ≤ J < 2 , then N(m,α) × N(n,β) = N(m+n+1;J) ∆ k + 1 ∆ k + 1 ∆ k + 1 m+n+1 ((p = −2)⊕(p = −1))⊗(q = −1) lies on level m + n + 1; whereas, if J ≥ 2 ,N(m,α) × 2 2 2 m+n+1 N(n,β) = N(m+n+2,χ) with χ = J − 2 lying on level m + n + 2. if k is odd, whereas Lemma 2. (See in [10]).Let N > 3 be an odd in- k+1 jp k ∆ k + 1 ∆ k + 1 ∆ k + 1 b 2 c (p = − 1) ⊗ ((q = − 1) ⊕ (q = )) teger and k = blog2Nc − 1; then 2 ≤ N < 2 2 2 p k+1 +1 j k ^ k−1 2b 2 c , namely, N = . Particularly, 2 if k is even. jp k j k+1 p k ^ b 2 c k−1 ( N ≤ 2 2 ) = 2 when k is odd whereas k+1 p p j k j k ^ k−1 Lemma 5.