Approximate Integer Common Divisors

  • Nick Howgrave-Graham
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 2146)


We show that recent results of Coppersmith, Boneh, Durfee and Howgrave-Graham actually apply in the more general setting of (partially) approximate common divisors. This leads us to consider the question of “fully” approximate common divisors, i.e. where both integers are only known by approximations. We explain the lattice techniques in both the partial and general cases. As an application of the partial approximate common divisor algorithm we show that a cryptosystem proposed by Okamoto actually leaks the private information directly from the public information in polynomial time. In contrast to the partial setting, our technique with respect to the general setting can only be considered heuristic, since we encounter the same “proof of algebraic independence” problem as a subset of the above authors have in previous papers. This problem is generally considered a (hard) problem in lattice theory, since in our case, as in previous cases, the method still works extremely reliably in practice; indeed no counter examples have been obtained. The results in both the partial and general settings are far stronger than might be supposed from a continued-fraction standpoint (the way in which the problems were attacked in the past), and the determinant calculations admit a reasonably neat analysis.


Greatest common divisor approximations Coppersmith’s method continued fractions lattice attacks 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    D. Coppersmith. Finding a small root of a bivariate integer equation Proc. of Eurocrypt’96 Lecture Notes in Computer Science, Vol. 1233, Springer-Verlag, 1996Google Scholar
  2. 2.
    D. Boneh. Twenty years of attacks on the RSA cryptosystem. Notices of the American Mathematical Society (AMS) Vol. 46, No. 2, pp. 203–213, 1999.zbMATHMathSciNetGoogle Scholar
  3. 3.
    D. Boneh and G. Durfee. Cryptanalysis of RSA with private key d less than N0.292 IEEE Transactions on Information Theory, Vol 46, No. 4, pp. 1339–1349, July 2000.zbMATHMathSciNetCrossRefGoogle Scholar
  4. 4.
    D. Boneh, G. Durfee and Y. Frankel. An attack on RSA given a small fraction of the private key bits. In proceedings AsiaCrypt’98, Lecture Notes in Computer Science, Vol. 1514, Springer-Verlag, pp. 25–34, 1998.Google Scholar
  5. 5.
    D. Boneh, G. Durfee and N. Howgrave-Graham Factoring N = p r q for large r. In Proceedings Crypto’ 99, Lecture Notes in Computer Science, Vol. 1666, Springer-Verlag, pp. 326–337, 1999.Google Scholar
  6. 6.
    G.H. Hardy and E.M. Wright. An introduction to the theory of numbers, 5’th edition. Oxford University press, 1979.Google Scholar
  7. 7.
    N.A. Howgrave-Graham. Computational mathematics inspired by RSA. Ph.D. Thesis, Bath University, 1999.Google Scholar
  8. 8.
    A.K. Lenstra, H.W. Lenstra and L. Lovász. Factoring polynomials with integer coefficients Mathematische Annalen, Vol. 261, pp. 513–534, 1982.CrossRefGoogle Scholar
  9. 9.
    K.L. Manders and L.M. Adleman. NP-Complete decision problems for binary quadratics JCSS Vol. 16(2), pp. 168–184, 1978.zbMATHMathSciNetGoogle Scholar
  10. 10.
    P. Nguyen and J. Stern. Lattice reduction in cryptology: An update”, Algorithmic Number Theory-Proc. of ANTS-IV, volume 1838 of LNCS. Springer-Verlag, 2000.CrossRefGoogle Scholar
  11. 11.
    T. Okamoto. Fast public-key cryptosystem using congruent polynomial equations Electronic letters, Vol. 22, No. 11, pp. 581–582, 1986.CrossRefGoogle Scholar
  12. 12.
    C-P. Schnorr. A hierarchy of polynomial time lattice bases reduction algorithms Theoretical computer science, Vol. 53, pp. 201–224, 1987.zbMATHMathSciNetCrossRefGoogle Scholar
  13. 13.
    V. Shoup. NTL: A Library for doing Number Theory (version 4.2)
  14. 14.
    B. Vallée, M. Girault and P. Toffin. Proceedings of Eurocrypt’ 88 LNCS vol. 330, pp. 281–291, 1988.Google Scholar
  15. 15.
    M. Wiener. Cryptanalysis of short RSA secret exponents IEEE Transactions of Information Theory volume 36, pages 553–558, 1990.zbMATHMathSciNetCrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2001

Authors and Affiliations

  • Nick Howgrave-Graham
    • 1
  1. 1.IBM T.J.Watson Research CenterNew YorkUSA

Personalised recommendations