1

I read in an introduction to a paper that if $e$ is small enough and we were given secret key $d$ in RSA, then there is an efficient deterministic algorithm to factorize $n$. I've searched about that and I've found the probabilistic one: Algorithm to factorize $N$ given $N$, $e$, $d$

I guess, the fact that $e$ is small must play some role here. But I was able to come up with something. Do you know anything?

Ievgeni
  • 2,585
  • 1
  • 10
  • 32
tonythestark
  • 173
  • 6

1 Answers1

1

The May-Coron result for balanced RSA moduli can be seen as essentially an application of the Coppersmith theorem to the polynomial $$ f(x) = n - x \bmod (de-1)\,, $$ where we are looking for the root $p+q-1 \approx n^{1/2}$ modulo $\varphi(n) \approx n$—a divisor of $de-1$.

The Coppersmith theorem says that we can find a root of $f(x)$ smaller than $(de-1)^{\beta^2}$ modulo an unknown divisor $\varphi(n)$ of $de-1$ of size $(de-1)^{\beta}$. Translating this to our setting, suppose $de-1 = n^{k}$. Then $n \approx (de-1)^{1/k}$. Setting $\beta=1/k$ and taking logarithms, we have that $k\cdot (1/k)^2 \ge 1/2$ implies $k \le 2$, which means that the factorization can be found in polynomial time as long as $de-1 \le n^2$. As such, it is not strictly $e$ that needs to be sufficiently small, but the product $ed$.

Samuel Neves
  • 12,460
  • 43
  • 52