# Approximate Integer Common Divisors

- 84 Citations
- 1.5k Downloads

## Abstract

We show that recent results of Coppersmith, Boneh, Durfee and Howgrave-Graham actually apply in the more general setting of (partially) approximate common divisors. This leads us to consider the question of “fully” approximate common divisors, i.e. where both integers are only known by approximations. We explain the lattice techniques in both the partial and general cases. As an application of the partial approximate common divisor algorithm we show that a cryptosystem proposed by Okamoto actually leaks the private information directly from the public information in polynomial time. In contrast to the partial setting, our technique with respect to the general setting can only be considered heuristic, since we encounter the same “proof of algebraic independence” problem as a subset of the above authors have in previous papers. This problem is generally considered a (hard) problem in lattice *theory*, since in our case, as in previous cases, the method still works extremely reliably in practice; indeed no counter examples have been obtained. The results in both the partial and general settings are far stronger than might be supposed from a continued-fraction standpoint (the way in which the problems were attacked in the past), and the determinant calculations admit a reasonably neat analysis.

## Keywords

Greatest common divisor approximations Coppersmith’s method continued fractions lattice attacks## Preview

Unable to display preview. Download preview PDF.

## References

- 1.D. Coppersmith. Finding a small root of a bivariate integer equation
*Proc. of Eurocrypt’96*Lecture Notes in Computer Science, Vol. 1233, Springer-Verlag, 1996Google Scholar - 2.D. Boneh. Twenty years of attacks on the RSA cryptosystem.
*Notices of the American Mathematical Society (AMS)*Vol. 46, No. 2, pp. 203–213, 1999.zbMATHMathSciNetGoogle Scholar - 3.D. Boneh and G. Durfee. Cryptanalysis of RSA with private key
*d*less than N0.292*IEEE Transactions on Information Theory*, Vol 46, No. 4, pp. 1339–1349, July 2000.zbMATHMathSciNetCrossRefGoogle Scholar - 4.D. Boneh, G. Durfee and Y. Frankel. An attack on RSA given a small fraction of the private key bits.
*In proceedings AsiaCrypt’98*, Lecture Notes in Computer Science, Vol. 1514, Springer-Verlag, pp. 25–34, 1998.Google Scholar - 5.D. Boneh, G. Durfee and N. Howgrave-Graham Factoring
*N = p*^{r}*q*for large*r*.*In Proceedings Crypto’ 99*, Lecture Notes in Computer Science, Vol. 1666, Springer-Verlag, pp. 326–337, 1999.Google Scholar - 6.G.H. Hardy and E.M. Wright. An introduction to the theory of numbers, 5’th edition. Oxford University press, 1979.Google Scholar
- 7.N.A. Howgrave-Graham. Computational mathematics inspired by RSA. Ph.D. Thesis, Bath University, 1999.Google Scholar
- 8.A.K. Lenstra, H.W. Lenstra and L. Lovász. Factoring polynomials with integer coefficients
*Mathematische Annalen*, Vol. 261, pp. 513–534, 1982.CrossRefGoogle Scholar - 9.K.L. Manders and L.M. Adleman. NP-Complete decision problems for binary quadratics
*JCSS*Vol. 16(2), pp. 168–184, 1978.zbMATHMathSciNetGoogle Scholar - 10.P. Nguyen and J. Stern. Lattice reduction in cryptology: An update”,
*Algorithmic Number Theory-Proc. of ANTS-IV*, volume 1838 of LNCS. Springer-Verlag, 2000.CrossRefGoogle Scholar - 11.T. Okamoto. Fast public-key cryptosystem using congruent polynomial equations
*Electronic letters*, Vol. 22, No. 11, pp. 581–582, 1986.CrossRefGoogle Scholar - 12.C-P. Schnorr. A hierarchy of polynomial time lattice bases reduction algorithms
*Theoretical computer science*, Vol. 53, pp. 201–224, 1987.zbMATHMathSciNetCrossRefGoogle Scholar - 13.V. Shoup. NTL: A Library for doing Number Theory (version 4.2)
**http://www.shoup.net** - 14.B. Vallée, M. Girault and P. Toffin.
*Proceedings of Eurocrypt’ 88*LNCS vol. 330, pp. 281–291, 1988.Google Scholar - 15.M. Wiener. Cryptanalysis of short RSA secret exponents
*IEEE Transactions of Information Theory*volume 36, pages 553–558, 1990.zbMATHMathSciNetCrossRefGoogle Scholar