Then n can be factored in polynomial time.

Hence XY = X Y and since gcd(X, Y ) = 1, we get X = X and the lemma follows.

Chapter 1 Introduction

This document presents several results I obtained in cryptography, especially in the area of cryptanalysis of a few public key cryptosystems, mainly systems that are related to the RSA cryptosystem. The techniques used for the cryptanalytic attacks are based on adapting computational and algorithmic tools from Number Theory. The attacks concern the following cryptosystems and items

• The RSA cryptosystem.

• The CRT-RSA cryptosystem.

• The Prime Power RSA cryptosystem.

• The NTRU cryptosystem.

• The KMOV elliptic curve cryptosystem.

• The DGHV homomorphic cryptosystem.

• The Demytko elliptic curve cryptosystem.

• The RSA-type schemes based on singular cubic curves.

• The Dirichlet product for boolean functions.

I will describe the former systems and some of the most known cryptanalytic attacks on them. I will then describe my research results, mainly from the cryptanalytic point of view without proofs which can be found in the articles.

Notice that some attacks we conducted on RSA or on its variants are briefly presented in this work while they are included as appendices.

In my Ph.D. thesis, I studied many diophantine problems related to the abc conjecture and elliptic curves. The main tools used there were originated from algorithmic and computational number theory such as continued fractions, diophantine approximations, lattice reduction, diophantine equations and elliptic curves. Amazingly, the same techniques are used in cryptography and especially in cryptanalysis. Indeed, the main hard problems behind the security of most of the widely used public key cryptosystems are number theory problems, such as factorization, discrete logarithm and lattice problems. Often, to attack a public key cryptosystem, the starting point is to find a diophantine problem that can be transformed into a computational problem. In RSA, the diophantine problem is mainly the key equation ed -k(p -1)(q -1) = 1. In the key exchange protocol of Diffie-Hellman and in ElGamal cryptosystem, the diophantine problem is the discrete logarithm problem b ≡ g x (mod p). In the elliptic curve cryptography ECC, the diophantine problem is the elliptic discrete logarithm problem Q = nP . In NTRU, the diophantine problem is h = g f (mod q) where h, f and g are polynomials in the ring Z q [X]/(X N -1).

The RSA cryptosystem [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF], invented by Rivest, Shamir and Adleman in 1977 is the most widely used asymmetric cryptographic scheme. The RSA public-key cryptosystem is used for securing web traffic, e-mails, remote login sessions, and electronic credit card payment systems. The underlying oneway function in RSA is the integer factorization problem: Multiplying two large primes is computationally easy, but factoring the resulting product is very hard. Another hard problem in RSA is the difficulty of solving the so-called RSA problem: Given an RSA public key (e, N ) and a ciphertext c ≡ m e (mod N ), compute the plaintext m. Also, the security of RSA can be reduced to solving the key equation edk(p-1)(q -1) = 1 where N = pq is the modulus, e is the public exponent and d is the private exponent. The prominent attacks on small private exponents in RSA are Wiener's continued fraction based attack [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] and the lattice reduction attack of Boneh and Durfee [17].

There are many different ways to attack RSA by studying diophantine equations related to the encrypted message or the key equation. Many RSA variant equations, satisfied by the exponents, can potentially be used to factor the RSA modulus. This remark was used by many researchers such as Blömer and May [13]. In my research on RSA, I tried to exhibit variant key equations satisfied by the exponents and tried to solve them by number theoretical tools in order to factor the RSA modulus. For example, we studied in [START_REF] Nitaj | Another generalization of Wiener's attack on RSA[END_REF] the situation where the RSA public exponent satisfies an equation of the form eX -(p -u)(q -v)Y = 1,. We showed that if the parameters X, Y , u and v are suitably small, then one can solve the equation and break the system. The number of the exponents e satisfying the former equation is not negligible since this number can be lower bounded by N 1 2 -ε for a small positive constant ε. The method used for solving the equation combines the continued fraction algorithm and Coppersmith's technique. In [START_REF] Nitaj | Cryptanalysis of RSA using the ratio of the primes[END_REF], we studied another example of an RSA variant equation, namely eX -(N -(ap + bq))Y = Z with sufficiently small parameters X, Y and Z where a and b are unknown positive integers such that a b is close to q p . This equation is related to the requirement in section 4.1.2 of the ANSI X9.31:1998 standard for public key cryptography [1] to ovoid prime factors p and q in the RSA modulus N = pq with a ratio close to a rational number a b with small a and b. In some instances of RSA, using a system of diophantine equations ease the resolution and improve the bounds. For example, we considered in [START_REF] Nitaj | A new attack on RSA with two or three decryption exponents[END_REF] the situation with the presence of two or three public exponents e i , i = 1, 2, 3, satisfying the equations e i x i -(p-1)(q -1)y i = z i with small parameters. We showed that the bounds are better than the situation where only one exponent is available. Similarly, in the presence of several RSA instances N i = p i q i with the same decryption exponent d, we have a system of diophantine equations e i d -k i (p i -1)(q i -1) = 1. In [START_REF] Nitaj | New attacks on the RSA cryptosystem[END_REF], we generalized this situation with the equations e i x -y i (p i -1)(q i -1) = z i and solved them by applying lattice reduction techniques to the simultaneous diophantine approximations.

There is another kind of attacks on RSA, called partial key exposure attacks, in which a fraction of the bits of a private parameter, such as p, q or d is known. Such attacks have been intensively studied by many researchers (see e.g. [START_REF] Hinek | Cryptanalysis of RSA and its Variants[END_REF][START_REF] Jochemsz | Cryptanalysis of RSA variants using small roots of polynomials[END_REF][START_REF] May | New RSA Vulnerabilities Using Lattice Reduction Methods[END_REF]). Another example is when two RSA moduli N 1 = p 1 q 1 and N 2 = p 2 q 2 are such that the difference |p 1 -p 2 | is sufficiently small [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF]. In [START_REF] Nitaj | Implicit factorization of unbalanced RSA moduli[END_REF], we generalized this situation by considering the difference of multiples of the primes in the form |ap 1 -bp 2 |. When |ap 1 -bp 2 | is suitably small or in the form |ap 1 -bp 2 | = 2 m x for some positive integer m, we showed that one can apply the continued fraction algorithm and Coppersmith's method to factor both RSA moduli. Notice here that no known bits are involved. Moreover, the method can be generalized to k RSA moduli N i = p i q i such that the differences |a i p i -a i p j | are simultaneously small by applying lattice reduction techniques [START_REF] Nitaj | Implicit factorization of unbalanced RSA moduli[END_REF].

In addition to the standard RSA cryptosystem where the modulus is N = pq and the encryption of a message m is computed as m e (mod N ), there are some variants that are of interest for efficiency reasons such as the CRT-RSA cryptosystem and the prime power RSA cryptosystem.

In CRT-RSA, the public exponent e and the private CRT-exponents d p and d q satisfy ed p ≡ 1 (mod (p -1)) and ed q ≡ 1 (mod (q -1)). One can further reduce the decryption time by carefully choosing d so that both d p and d q are small. Many known attacks such as [12] on CRT-RSA work by combining the key equations of d p and d q . In [START_REF] Nitaj | A new attack on RSA and CRT-RSA[END_REF], we showed that applying the ideas of [START_REF] Herrmann | Solving linear equations modulo divisors: On factoring given any bits[END_REF], one can reduce the situation by using solely one of the equations, which leads to the factorization of the RSA modulus. This enables us to attack more CRT-instances when only one of the decryption exponents d p or d q is small.

In the prime power RSA variant, the modulus is in the form N = p r q with r ≥ 2. Such moduli are used in cryptography to speed up the decryption process in RSA [START_REF] Takagi | Fast RSA-Type Cryptosystem Modulo p k q[END_REF]. Similarly to the standard RSA, there are various attacks that can be launched on the prime power RSA variant. In 2014, Sarkar [START_REF] Sarkar | Small secret exponent attack on RSA variant with modulus N = p r q, Designs[END_REF] presented an attack using the key equation ed -kp r-1 (p -1)(q -1) = 1. The attack uses Coppersmith's technique and works for small values of d. In [START_REF] Nitaj | New attacks on RSA with moduli N = p r q. Codes[END_REF], we showed that the key equation can be generalized by using the more general equation ex -p r-1 (p -1)(q -1)y = z in which the unknown parameters are suitably small. Then, using Coppersmith's technique, especially the ideas of [START_REF] Lu | New Results on Solving Linear Equations Modulo Unknown Divisors and its Applications[END_REF], we showed that the prime power RSA modulus N = p r q can be factored in polynomial time.

RSA and many cryptographic schemes are vulnerable to quantum computers running Shor's algorithm. In the contrary, the NTRU cryptosystem [START_REF] Hoffstein | NTRU: A Ring Based Public Key Cryptosystem[END_REF], invented in 1996 by Hoffstein, Pipher, and Silverman, is still resistant to quantum attacks. This makes NTRU one of the post quantum candidates. In NTRU, the public key is a polynomial h ∈ Z q [X]/(X N -1) with h ≡ g f (mod q, X n -1) where f and g are polynomials with small and sparse coefficients. In 1998, Coppersmith and Shamir [START_REF] Coppersmith | Lattice attacks on NTRU[END_REF] transformed the key equation into a linear one f * h ≡ g (mod q) and exhibit a lattice L with dimension 2N . By studying the short vectors of the lattice, they showed that one can retrieve the private keys f and g if some condition is satisfied. In [START_REF] Nitaj | Cryptanalysis of NTRU with two Public Keys[END_REF], we extended the ideas of Coppersmith and Shamir in the presence of an instance of NTRU with two public keys, h ≡ g f (mod q, X n -1) and h ≡ G F (mod q, X n -1) which can be rewritten as h ≡ g f (mod q, X n -1) where g ≡ G * f F (mod q, X n -1). This means that any couple of public keys use the polynomial f . We combined the equations of h and h to build a lattice L. By studying the properties and short vectors of this lattice, we showed that the private polynomials f , g, g can be found by lattice reduction techniques under the condition that g and g share a certain amount of their coefficients.

Homomorphic encryption is a new research topic in cryptography. It aims to make cloud computing completely secure. Homomorphic encryption allows complex computation on encrypted data without decrypting it. By using properties of ideal lattices, Gentry [START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF] presented the first fully homomorphic scheme. Since then, several homomorphic schemes have been proposed, such as DGHV [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF]. In DGHV, m integers c i = pq i + r i , i = 1, • • • , m, are public while the integers p, q i and r i are secret. In [START_REF] Coron | Fully homomorphic encryption over the integers with shorter public keys[END_REF][START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF][START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF], the security of DGHV has been studied against several attacks. In [START_REF] Nitaj | Lattice Attacks on the Homomorphic DGHV Scheme[END_REF], we showed that the parameters in DGHV always satisfy a linear equation of the form a 2 c 2 + . . . + a m c m = a 1 q 1 . Then, using a result of Herrmann and May [START_REF] Herrmann | Solving linear equations modulo divisors: On factoring given any bits[END_REF] on solving multivariate linear equations, we launched an attack on DGHV to retrieve the secret parameters p, q i and r i simultaneously. This shows once again that Coppersmith's method can amazingly be applied in various situations.

In 1985, Koblitz [START_REF] Koblitz | Elliptic Curve Cryptosystems[END_REF] and Miller [START_REF] Miller | Uses of elliptic curves in cryptography[END_REF] independently proposed the idea of using elliptic curves for cryptographic applications. The security of the elliptic curve schemes are based on the difficulty of solving the elliptic discrete logarithm. Since then, many cryptosystems based on the same problem have been proposed, and some of them include the difficulty of factoring large numbers.

In 1991, Koyama, Maurer, Okamoto and Vanstone proposed a scheme, called KMOV [START_REF] Koyama | New public-key schemes based on elliptic curves over the ring Z n[END_REF] using an RSA modulus N = pq, an elliptic curve over Z/N Z with a public key e satisfying the key equation ed -k(p + 1)(q + 1) = 1. In [START_REF] Nitaj | A new attack on the KMOV cryptosystem[END_REF], we studied the more general equation ex -(p + 1)(q + 1)y = z and launched an attack on KMOV based on continued fractions and Coppersmith's technique to factor the modulus under some conditions on the size of the unknown parameters.

In 1994, Demytko [START_REF] Demytko | A new elliptic curve based analogue of RSA[END_REF] developed a cryptosystem using an elliptic curve E N (a, b) with equation y 2 = x 3 + ax + b over the ring Z/N Z where N = pq is an RSA modulus. In this system, the public parameters are N , a, b and e satisfying gcd e, p 2 -t 2 p q 2 -t 2 q = 1. The decryption exponent is an integer d satisfying an equation ed -k (p + 1 -t p ) (q + 1 -t q ) = 1 where t p = p + 1 -#E p (a, b) and t q = q + 1 -#E q (a, b). In [START_REF] Nitaj | A New Attack on RSA and Demytko's Elliptic Curve Cryptosystem[END_REF], we considered a more general equation, namely eu -(p -s)(q -r)v = w, and used lattice reduction methods to solve the equation which leads to the factorization of the modulus.

Similarly to KMOV and Demytko's scheme, a few cryptosystems have been proposed using an RSA modulus N = pq. The following systems are more or less variants of RSA and use a public exponent e satisfying the key equation ed -k p 2 -1 q 2 -1 = 1,

• LUC : proposed in 1993 by Smith and Lennon [START_REF] Smith | LUC: a new public-key cryptosystem[END_REF]. LUC is based on a Lucas functions,

• Castagnos cryptosystem : proposed in 2007 by Castagnos [START_REF] Castagnos | An efficient probabilistic public-key cryptosystem over quadratic field quotients[END_REF]. This system is directly related to LUC and RSA,

• RSA with Gaussian primes : proposed in 2002 by Elkamchouchi, Elshenawy and Shaban [START_REF] Elkamchouchi | Extended RSA cryptosystem and digital signature schemes in the domain of Gaussian integers[END_REF]. This scheme is the RSA variant for Gaussian primes,

• RSA type schemes based on singular cubic curves : proposed in 1995 by Kuwakado, Koyama, and Tsuruoka [START_REF] Kuwakado | A new RSA-type scheme based on singular cubic curves y 2 = x 3 + bx 2 (mod n)[END_REF]. The scheme uses the singular cubic curve E N (b) with equation y 2 = x 3 + bx 2 mod N .

In [START_REF] Bunder | A generalized attack on RSA type cryptosystems[END_REF], we launched an attack that factors the modulus N = pq in the former schemes by using the generalized equation ex -p 2 -1 q 2 -1 y = z and by combining the continued fraction algorithm and Coppersmith's method.

The Boolean functions play an important role in cryptography, especially in symmetric encryption algorithms, pseudorandom number generators and hash functions. Consequently, a lot of attention has been given to constructing Boolean functions satisfying good cryptographic criteria such as high algebraic degree, balancedness and high nonlinearity [START_REF] Carlet | Boolean Functions for Cryptography and Error Correcting Codes[END_REF]. A Boolean function with n variables is a map from the space GF (2) n = {0, 1} n into GF (2) = {0, 1}. It can be uniquely represented by a truth table or by an algebraic normal form (ANF). The theory of Boolean function is full of remarkable properties that can be used to construct Boolean functions with good cryptographic criteria [START_REF] Sarkar | Construction of Nonlinear Boolean Functions with Important Cryptographic Properties[END_REF]. In this direction, we introduced the notion of Dirichlet product for Boolean functions in [START_REF] Nitaj | Dirichlet Product for Boolean Functions[END_REF]. For two boolean functions f and g, we defined the concept of Dirichlet product by setting (f * g)(x) = u x f (u)g(x -u) for all x ∈ GF (2) n where, for u = (u 1 , . . . , u n ) ∈ GF (2) n and x = (x 1 , . . . , x n ) ∈ GF (2) n , u x if and only if for each i ∈ {1, . . . , n}, u i ≤ x i . Many properties of Boolean functions can be then reformulated in terms of the Dirichlet product.

Chapter 2

Cryptanalysis of RSA

Introduction

The RSA cryptosystem is the first and most widely used cryptosystem. It was developed by Rivest, Shamir and Adleman in 1978 [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF]. RSA is used in many industrial systems such as web servers, online payment systems and other systems requiring privacy and authenticity.

The main parameters of the RSA cryptosystem are p,q, N , φ(N ) and d where

• p and q are two private large prime numbers of the same bit-size,

• N = pq is the public modulus,

• φ(N ) = (p -1)(q -1) is the private Euler totient function,

• e is a public positive integer such that gcd(e, φ(N )) = 1,

• d ≡ e -1 (mod φ(N )) is the private exponent.

In textbook RSA, to encrypt a message m ∈ {2, N -1} with the public key (N, e), one computes c ≡ m e (mod N ) and to decrypt c with the private key (N, d) one simply computes m ≡ c d (mod N ). The complete way to encrypt and decrypt with RSA needs different technique as recommended in RSA OAEP [103] Since its invention, RSA has been analyzed for vulnerabilities by applying many kinds of attacks such as factorization, algebraic attacks and side channel attacks. Algebraic attacks are mainly based on diophantine approximations that could be solved using continued fractions or lattice reduction.

In 1990, Wiener came up with an attack on RSA based on the continued fraction algorithm. The starting point of the attack is the RSA key equation ed -kφ(N ) = 1 which leads to k d ≈ e φ(N ) .

When the prime factors p and q are of the same bit-size, φ(N ) ≈ N and

k d ≈ e N .
Using this approximation, Wiener showed that if d is small enough, namely d < 1 3 N 1 4 , then k d can be found among the convergents of the continued fraction expansion of e N which leads to the factorization of N . In 1996, Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] described two rigorous methods to find small modular roots of univariate polynomials and small integer roots of bivariate polynomials. As an application, Coppersmith showed how to factor an RSA modulus N = pq if half of the bits of p are known. Coppersmith's method is based on lattice reduction techniques and has many application in cryptanalysis, especially for attacking the RSA cryptosystem [15,[START_REF] Hinek | Cryptanalysis of RSA and its Variants[END_REF][START_REF] Jochemsz | Cryptanalysis of RSA variants using small roots of polynomials[END_REF][START_REF] May | New RSA Vulnerabilities Using Lattice Reduction Methods[END_REF][START_REF]Series: Information Security and Cryptography[END_REF].

In this chapter, we give an overview of the techniques used for the cryptanalysis of RSA using the key equation or variants of it. This includes the continued fraction algorithm, lattice reduction and Coppersmith's technique. Then we describe some of our attacks on specific variants of the key equation which lead to the factorization of the underlying RSA moduli.

Continued Fractions

The theory of diophantine approximations, named after Diophantus of Alexandria, deals with the approximation of real numbers by rational numbers. This can be achieved by continued fractions. Continued fractions have many properties and applications in Number Theory and cryptographic problems. They are used to find good diophantine approximations to rational and irrational numbers, to solve diophantine equations and to build attacks on some instances of RSA. In this section, we examine the basic properties of continued fractions. where a 0 is an integer and for n ≥ 1, a n is a positive integer. The integers a n are called the partial quotients of the continued fraction.

It is clear that every finite continued fraction defines a rational number. Conversely, every real number x = 0 can be expanded as a finite or infinite continued fraction by the continued fraction algorithm as follows.

Let x denote the greatest integer less than or equal to x. Let x 0 = x and a 0 = x 0 . Then, for i ≥ 0, define

x i+1 = 1 x i -a i , a i+1 = x i+1 .
The procedure terminates only if a i = x i for some i ≥ 0, that is if x is a rational number.

The continued fraction of a rational number x = a b with gcd(a, b) = 1 can be computed by the Euclidean Algorithm in time O(log b). Set r 0 = a and r 1 = b. For i ≥ 0, divide r i by r i+1 :

r i = a i r i+1 + r i+2 , 0 ≤ r i+2 < r i+1 .
This process stops when r m+2 = 0 for some m ≥ 0.

In 1990, Wiener [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] proposed an attack on RSA with modulus N and small private exponent d. The attack is based on the convergents of the continued fraction expansion of e N . Definition 2.2.2 (Convergent). For 0 ≤ n ≤ m, the nth convergent of the continued fraction [a 0 , a 1 ,

• • • , a m ] is [a 0 , a 1 , • • • , a n ].
For each n ≥ 0, we define p -2 = 0, p -1 = 1, p n = a n p n-1 + p n-2 , q -2 = 1, q -1 = 0, q n = a n q n-1 + q n-2 .

It is well known that the nth convergent of the continued fraction expansion satisfies [a 0 , a 1 , • • • , a n ] = p n q n . More generally, there are various results satisfied by the convergents of a continued fraction. We need only the following result on diophantine approximations (for more general information see [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF] and [START_REF] Cohen | A Course in Computational Algebraic Number Theory[END_REF]).

Theorem 2.2.3. Let x be a real positive number. If a and b are positive integers such that gcd(a, b) = 1 and

x - a b < 1 2b 2 ,
then a b is one of the convergents of the continued fraction expansion of x.

Lattice Reduction

The most powerful attacks on RSA are based on techniques that use lattice basis reduction algorithms, such as the LLL algorithm. Invented by Lenstra, Lenstra and Lovász [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] in 1982, LLL is a polynomial time algorithm for lattice basis reduction with many applications in cryptography [START_REF]Series: Information Security and Cryptography[END_REF]. A typical example of the powers of the LLL algorithm is the following problem.

Small roots of a modular polynomial problem: Given a composite N with unknown factorization and a polynomial f (x) of degree d, find all small solutions x 0 to the polynomial equation f (x) ≡ 0 (mod N ).

In his seminal work, Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] solved this problem in 1996 for solutions x 0 satisfying |x 0 | < N 1 d using the LLL algorithm. In this section, we give the mathematical background on lattices and the LLL algorithm for basis reduction. We start by giving a formal definition of a lattice.

L = n i=1 x i b i | x i ∈ Z .
The set b 1 . . . , b n is called a lattice basis for L. The lattice dimension is dim(L) = n.

In general, a basis for L is any set of independent vectors that generates L. Any two bases for a lattice L are related by a matrix having integer coefficients and determinant equal to ±1. Hence, all the bases have the same Gramian determinant det 1≤i,j≤n b i , b j where b i , b j denotes the scalar product of vectors b i , b j . The determinant of the lattice is then

det(L) = det 1≤i,j≤n b i , b j 1 2
.

Let v = n i=1 x i b i be a vector of L. We define the Euclidean norm of v as

v = n i=1
x 2 Note that b * 1 . . . , b * n is not a basis of the lattice L. Since every nontrivial lattice has infinitely many bases, some bases are better than others. The most important quality measure is the length of the basis vectors. For arbitrary lattices, the problem of computing a shortest vector is known to be NP-hard under randomized reductions [3]. However, in many applications, the LLL algorithm computes in polynomial time a reduced basis with nice properties. The basis B is said to be LLL reduced if it satisfies the following two conditions:

|µ i,j | ≤ 1 2
, for 1 ≤ j < i ≤ n,

3 4 b * i-1 2 ≤ b * i + µ i,i-1 b * i-1 2 for 1 < i ≤ n.
Below we give useful inequalities satisfied by an LLL reduced basis derived from the LLL reduction definition (for a proof see e.g. [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF], [START_REF] Cohen | A Course in Computational Algebraic Number Theory[END_REF], [START_REF] May | New RSA Vulnerabilities Using Lattice Reduction Methods[END_REF]). 4(n+1-i) (det(L))

1 n+1-i for 1 ≤ i ≤ n.

Coppersmith's Method

In 1988, Hastad [START_REF] Hastad | Solving simultaneous modular equations of low degree[END_REF] and Toffin, Girault and Vallée [START_REF] Girault | Computation of approximate L-th roots modulo n and application to cryptography[END_REF] used lattice reduction techniques to find very small solutions of modular polynomial equations of the form f (x) ≡ 0 (mod N ) where f (x) ∈ Z[x]. They showed that this technique can be applied for cryptanalytic purposes. In 1996, Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] further improved the former bounds and developed two rigorous methods for finding small solutions of polynomial equations, the first for the univariate modular case and the second one for the bivariate case.

For a polynomial f (x) ∈ Z[x] of degree δ and a known positive integer N , the univariate modular case is the equation f (x) ≡ 0 (mod N ). The bivariate case is the equation g(x, y) = 0 over the integers where g(x, y) = i,j g i,j x i y j ∈ Z[x, y].

Using lattice reduction techniques such as the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF], Coppersmith showed that one can find all solutions x 0 of the modular equation f (x) ≡ 0 (mod N ) with |x 0 | ≤ N δ and all solutions (x 0 , y 0 ) of the equation g(x, y) = 0 with |x 0 | < X and |y 0 | < Y with XY < W 2 3δ where W = max i,j |g i,j |X i Y j .

Since 1996, many cryptanalytic applications have been based on Coppersmith's method, for example the factorization of N = pq knowing a fraction of the most significant bits on each factor. Another well-known application of Coppersmith's method is the cryptanalysis of RSA with small private key. In 1999, based on the seminal work of Coppersmith, Boneh and Durfee [17] presented an attack on RSA which recovers the factors p and q of an RSA modulus N = pq if d < N 0.292 . This result improves the well known bound d < 1 3 N 1 4 of Wiener [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF]. To simplify Coppersmith's methods, Howgrave-Graham [START_REF] Howgrave-Graham | Finding small roots of univariate modular equations revisited[END_REF] and Coron [START_REF] Coron | Fully homomorphic encryption over the integers with shorter public keys[END_REF] revisited the problem of finding small solutions of polynomial equations. Later, the ideas of Coppersmith have been generalized to multivariate polynomials. The generalizations use the Euclidean norm of a multivariate polynomial and Howgrave-Graham's Theorem. Definition 2.4.1. Let f (x 1 , . . . , x n ) = i 1 ,...,i n a i 1 ,...,i n x i 1 • • • x i n be a polynomial and X 1 , . . . , X n be n real numbers. The Euclidean norm of the polynomial f (X 1 x 1 , . . . , X n x n ) is defined as

f (X 1 x 1 , . . . , X n x n ) = i 1 ,...,i n a i 1 ,...,i n X i 1 1 • • • X i n n 2 1 2
.

Theorem 2.4.2 (Howgrave-Graham). Let h(x 1 , . . . , x n ) ∈ Z[x 1 , . . . , x n ] be a polynomial with at most ω monomials. Suppose that h(x

(0) 1 , . . . , x (0) n ) ≡ 0 (mod B), |x (0) 1 | < X 1 , . . . , |x (0) n | < X n , h(X 1 x 1 , . . . , X n x n ) < B √ ω .
Then h(x

(0) 1 , . . . , x (0)
n ) = 0 holds over the integers.

Attacks on RSA Using a Variant of the Key Equation

This section concerns the cryptanalysis of RSA using a variant of the key equation. Many attacks on RSA exploit the RSA key equation ed -k(p -1)(q -1) = 1.

Indeed, the starting point in Wiener's attack [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] is based on the RSA key equation and uses the approximation (p -1)(q -1) ≈ N . Similarly, in the attack of Boneh and Durfee [17], the RSA key equation is transformed into a modular polynomial equation of the form

x N + 1 2 -y = 1 (mod e).
While Wiener's attack is based on the continued fraction algorithm, the attack of Boneh and Durfee is entirely based on Coppersmith's method.

Some attacks on RSA combine both techniques. Blömer and May [13] presented an attack on RSA using the RSA variant equation ex + y = k(p -1)(q -1) and combined the continued fraction algorithm and Coppersmith's method to solve it when x < 1 3 N 1/4 and |y| = O N -3/4 ex . Such variant of the key equation can be extended in various ways. In [START_REF] Nitaj | Cryptanalysis of RSA using the ratio of the primes[END_REF], we considered a typical example where the set of the public exponents e satisfy the equation

eX -(N -(ap + bq))Y = Z, (2.1)
with small parameters X, Y and Z where a b is an unknown convergent of q p with a ≥ 1. Here, p and q are of the same bit size and are ordered such that q < p < 2q. This situation is related to the requirement of the ANSI X9.31:1998 standard for public key cryptography [1] where it is advised to ovoid prime numbers p and q for RSA with a ratio close to a rational number a b with small a and b.

The study of equation (2.1) uses two techniques. First, we apply the continued fraction algorithm to determine Y X among the convergents of the continued fraction of e N . Second, we compute p and q by applying Coppersmith's method.

First we present the result based on continued fractions. Lemma 2.5.1. [START_REF] Nitaj | Cryptanalysis of RSA using the ratio of the primes[END_REF] Let N = pq be an RSA modulus with q < p < 2q. Let a, b be coprime positive integers such that ap + bq = N 1 2 +α with α < 1 2 . Let e be a public exponent satisfying the equation eX -(N -(ap + bq))Y = Z with gcd(X, Y ) = 1.

If |Z| < N 1 2 +α X and 1 ≤ Y ≤ X < 1 2 N 1 4 -α 2 , then Y X is a convergent of e N .
The proof of Lemma 2.5.1 is entirely based on Legendre's Theorem 2.2.3. Once X and Y are found, we set M = N -eX Y and then we compute

|ap + bq -M | = |Z| Y .
To study the equation (2.1), we will consider three cases according to the size of the difference |ap -bq|:

1. case 1 : |ap -bq| is small, i.e. |ap -bq| < (abN )

1 4 , which corresponds approximately to b > 2

1 2 N 1 6
2. case 2 : |ap -bq| is medium, i.e. (abN ) 1 4 < |ap -bq| < aN 1 4 , which corresponds approximately to 2 In the three cases, we will use the following results. The first result shows that one can find ab if an approximation of ap + bq is known. Here the integer closest to x is denoted [x].

Lemma 2.5.2. [START_REF] Nitaj | Cryptanalysis of RSA using the ratio of the primes[END_REF] Let N = pq be an RSA modulus with q < p < 2q and a b a convergent of the continued fraction expansion of q p with a ≥ 1. Let ap

+ bq = N 1 2 +α with α < 1 2 . If |ap + bq -M | < 1 2 N 1 2 -α , then ab = M 2 4N .
The second result is related to the seminal work of Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF].

Theorem 2.5.3. Let n = pq be the product of two unknown integers such that q < p < 2q. Given an approximation of p with additive error at most n 1 4 , one can find p and q in polynomial time.

An Attack for Small Difference |ap -bq|

The small difference corresponds to case 1.

Theorem 2.5.4. [START_REF] Nitaj | Cryptanalysis of RSA using the ratio of the primes[END_REF] Let N = pq be an RSA modulus with unknown factors p, q such that q < p < 2q. Let a b be an unknown convergent of the continued fraction expansion of q p with a ≥ 1 and |ap -bq| < (abN ) 1 4 . Let e be a public exponent satisfying an equation eX -(N -ap-bq)Y = Z with gcd(X, Y ) = 1.

Set ap + bq = N 1 2 +α with 0 < α < 1 2 . If 1 ≤ Y ≤ X < 1 2 N 1 4 -α
2 and |Z| < inf (abN ) 1 4 , 1 2 N 1 2 -α Y , then N can be factored in polynomial time.

To prove this result, one first use the continued fraction algorithm to find Y X among the convergents of e N . If we set M = N -eX Y , then one find that M is an approximation of ap + bq with error term less than (abN ) 1 4 . Using Lemma 2.5.2, this allows us to find the exact value of the product ab as

ab = M 2 4N .
If we assume that |Z| < inf (abN )

1 4 , 1 2 N 1 2 -α Y,
then one finds that the term M 2 is an approximation of the factor ap of n = abN with additive error at most n 1 4 . Hence, using Theorem 2.5.3 with n and M 2 , we find ap, and since a < q, we get p = gcd(N, ap).

An Attack for Medium Difference |ap -bq|

The case with medium difference |ap -bq| corresponds to the case when 2

1 2 N 1 6 > b > 2 1 4 N 1 8
. The method here uses the Elliptic Curve Method (ECM) [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] which can find factors of about 52-digits. Assuming the efficiency of ECM, every step in this attack can be done in polynomial time and the number of convergents is bounded by O(log N ).

Theorem 2.5.5. [START_REF] Nitaj | Cryptanalysis of RSA using the ratio of the primes[END_REF] Let N = pq be an RSA modulus with unknown factors p, q such that q < p < 2q. Let a b be an unknown convergent of the continued fraction expansion of q p such that a ≥ 1, (abN )

1 4 < |ap -bq| < aN
(N -ap - bq)Y = Z with gcd(X, Y ) = 1. Set M = N -eX Y and ap + bq = N 1 2 +α with 0 < α < 1 2 . If 1 ≤ Y ≤ X < 1 2 N 1 4 -α 2 and |Z| < min aN 1 4 , 1 2 N 1 2
-α Y , then, under ECM, N can be factored efficiently.

First, using the conditions of the theorem, one can apply Lemma 2.5.1 to find Y X among the convergents of e N . Using X and Y , we compute M = N -eX Y , and, using Lemma 2.5.2, we find ab = M 2 4N . If moreover, b ≤ 10 52 , then, applying the Elliptic Curve Method with M 2 4N , we can efficiently find a and b. Then, using the assumption |ap -bq| < aN 1 4 , we find that M 2a is an approximation of p with error term at most N 1 4 . Then, using Theorem 2.5.3, one can find p and then q.

An Attack for Large Difference |ap -bq|

In the case 3, we assume that the difference |ap -bq| is large, which corresponds to b < 2

1 4 N 1 8 .
Theorem 2.5.6. [START_REF] Nitaj | Cryptanalysis of RSA using the ratio of the primes[END_REF] Let N = pq be an RSA modulus with unknown factors p, q such that q < p < 2q. Let a b be an unknown convergent of the continued fraction expansion of q p such that a ≥ 1 and b ≤ 10 52 . Let e be a public exponent satisfying an equation eX -

(N -(ap+bq))Y = Z with gcd(X, Y ) = 1. Let M = N -eX Y . Set D = |M 2 -4abN | and ap + bq = N 1 2 +α with 0 < α < 1 2 . If 1 ≤ Y ≤ X < 1 2 N 1 4 -α 2 and |Z| < 1 3 a|ap -bq|N -1 4 -α Y then, under ECM, N can be factored efficiently.
Similarly to case 1 and case 2, we find eX Y among the convergents of e N , and by setting M = N -eX Y , we find that M is an approximation ap + bq with an error term of at most aN 1 4 and that ab = M 2 4N . Then, if b ≤ 10 52 , then applying the Elliptic Curve Method with M 2 4N , we can find a and b.

Next, let D = |M 2 -4abN |.
Then ±D is an approximation of ap -bq with an error term of at most aN 1 4 . Combining the approximations of ap + bq and ap -bq, we find the approximation M ±D 2a is an approximation of p with additive error at most N 1 4 . We can then apply Theorem 2.5.3 to the values

M ±D 2a .
The correct term will lead to the factorization of N . For a given RSA modulus N = pq, the number of exponents e satisfying the equation eX -(N -(ap + bq))Y = Z with suitably small parameters and e < φ(N ) = (p -1)(q -1) is at least N 3 4 -ε where ε is arbitrarily small for suitably large N . This is much larger than the number (≈ N 1 4 -ε ) of exponents that are weak for Wiener's attack [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF]. It is also much larger than the number (≈ N 0.292-ε ) of exponents that are weak for the attack of Boneh and Durfee [17].

We note that the attack described in this section answers positively the requirement of the ANSI X9.31:1998 standard for public key cryptography [1] where it is advised to choose the prime numbers p and q for RSA with a ratio not too close to a rational number a b with small a and b.

An Attack on RSA Unbalanced Moduli

In PKC 2009, May and Ritzenhofen [START_REF] May | Implicit factoring: On polynomial time factoring given only an implicit hint[END_REF] presented a method for factoring two RSA moduli N 1 = p 1 q 1 and N 2 = p 2 q 2 of the same bit-size such that q 1 and q 2 are α-bit primes and p 1 and p 2 share at least t least significant bits (LSBs).

The method is a lattice based method that allows to find the factorization of N 1 and N 2 when t ≥ 2α+3. The method can be heuristically generalized to a lattice based method to factor k RSA moduli N 1 = p 1 q 1 , . . . , N k = p k q k when the p i 's share t ≥ k k-1 α many LSBs. The method of May and Ritzenhofen was reconsidered in [START_REF] Sarkar | Further results on implicit factoring in polynomial time[END_REF] by Sarkar and Maitra. Their method works when N 1 = p 1 q 1 and N 2 = p 2 q 2 are such that p 1 and p 2 share their least significant bits (LSBs) or most significant bits (MSBs) as well as a contiguous portion of bits at the middle. In PKC 2010, Faugère, Marinier and Renault [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF] presented a new and rigorous lattice-based method that addresses the implicit factoring problem when p 1 and p 2 share t ≥ 2α + 3 MSBs where the prime numbers q i are α-bit primes. The method heuristically generalizes to k RSA moduli N 1 = p 1 q 1 , . . . , N k = p k q k when the prime numbers p i share t ≥ k k-1 α + 6 of MSBs. For two RSA moduli N 1 = p 1 q 1 and N 2 = p 2 q 2 of the same bit size, Kurosawa and Ueda [START_REF] Kurosawa | Low exponent attack against elliptic curve RSA, Low exponent attack against elliptic curve RSA[END_REF] presented a lattice-based method to factor the two moduli when p 1 and p 2 share t LSBs with t ≥ 2α + 1 where q 1 ≈ q 2 ≈ 2 α .

In the rest of this section, we show that it is possible to factor k RSA moduli N 1 = p 1 q 1 , . . . , N k = p k q k when some unknown multiples a i p i of the prime factors p i share an amount of MSBs or of LSBs. This method generalizes all the former attacks. This is a brief description of the the attack presented in [START_REF] Nitaj | Factoring RSA moduli with weak prime factors[END_REF].

Implicit factorization of two RSA Moduli

We study here the problem of factoring two RSA moduli N 1 = p 1 q 1 and N 2 = p 2 q 2 where some unknown multiples a 1 p 1 and a 2 p 2 coincide on the t most significant bits (MSBs), that is when |a 2 p 2 -a 1 p 1 | is sufficiently small. Theorem 2.6.1. [START_REF] Nitaj | Factoring RSA moduli with weak prime factors[END_REF] Let N 1 = p 1 q 1 , N 2 = p 2 q 2 be two RSA moduli. If there exist two integers a 1 , a 2 such that a 1 < p 2 , a 2 < p 1 and |a 1 p 1 -a 2 p 2 | < p 1 2a 2 q 1 q 2 , then one can factor N 1 and N 2 in polynomial time.

The proof is based in the continued fraction algorithm. Indeed, if a 1 < p 2 , a 2 < p 1 and |a 1 p 1 -a 2 p 2 | < p 1 2a 2 q 1 q 2 , then we have

N 2 N 1 - a 1 q 2 a 2 q 1 = |a 1 p 1 -a 2 p 2 |q 2 a 2 p 1 q 1 < p 1 2a 2 q 1 q 2 × q 2 a 2 p 1 q 1 = 1 2(a 2 q 1 ) 2 .
This implies by Theorem 2.2.3 that a 1 q 2 a 2 q 1 , in lowest term is one of the convergents in the continued fraction expansion of N 2 N 1 . If we assume a 1 < p 2 , a 2 < p 1 , then using a 1 q 2 a 2 q 1 , we get q 1 = gcd(N 1 , a 2 q 1 ) and therefore p 1 = N 1 q 1 . Similarly, we get q 2 = gcd(N 2 , a 1 q 2 ) and p 2 = N 2 q 2 . Notice that the result of Theorem 2.6.1 is valid even when the RSA moduli are not of the same size. Comparatively, the attacks presented by Sarkar and Maitra in [START_REF] Sarkar | Further results on implicit factoring in polynomial time[END_REF] and Faugère et al. in [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF] are valid only if

N 1 ≈ N 2 and q 1 ≈ q 2 .
As an application of Theorem 2.6.1 to factor two unbalanced RSA moduli of the same size, we have the following result Corollary 2.6.2. Let N 1 = p 1 q 1 , N 2 = p 2 q 2 be two unbalanced RSA moduli of the same bit-size n. Suppose that q i ≈ 2 α , p i ≈ 2 n-α for i = 1, 2. Let a 1 , a 2 be two integers such that a i ≤ 2 β , i = 1, 2. If a 1 p 1 and a 2 p 2 share t most significant bits with t ≥ 2α + 2β + 1, then one can factor N 1 and N 2 in polynomial time.

Notice that, with β = 0 in Corollary 2.6.2, that is, if a 1 = a 2 = 1, a sufficient condition to factor the two RSA moduli is t ≥ 2α + 1 which slightly improves the bound t ≥ 2α + 3 found by Faugère et al. in [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF]. This shows that the bound found by Faugère et al. with lattice reduction techniques can be achieved using the continued fraction algorithm instead.

Implicit factorization of k RSA Moduli

Let N i = p i q i , i = 1 . . . , k, be k ≥ 3 RSA moduli of the same bit size. We show that if k multiples a i p i , i = 1 . . . , k share t most significant bits, then one can factor the k moduli. The method here is based on lattice reduction, especially the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF].

Theorem 2.6.3. [START_REF] Nitaj | Factoring RSA moduli with weak prime factors[END_REF] Let N i = p i q i , i = 1 . . . , k, be k ≥ 3 n-bit RSA moduli where the q i 's are α-bit primes. Suppose that there exist k integers a 1 , . . . , a k with a i ≤ 2 β , i = 1, . . . , k, such that the a i p i 's share all t most significant bits. If

t > k k -1 α + k 2 k -1 β + k 2(k -1) (1 + log 2 (πe)) ,
then, under the Gaussian Heuristic assumption, one can factor the k RSA moduli

N 1 , • • • , N k in polynomial time.
The idea to prove Theorem 2.6.3 is to transform the k differences x i = a i p i -a 1 p 1 into k simultaneous equations

aq 1 N i - aa 1 q i a i N 1 = aq 1 q i x i a i , where a = a 1 a 2 • • • a k .
To solve the equations, we apply the LLL algorithm to the lattice L spanned by the rows of the matrix

M =             C N 2 N 3 . . . N k-1 N k 0 -N 1 0 . . . 0 0 0 0 -N 1 . . . 0 0 . . . . . . . . . . . . . . . . . . 0 0 0 . . . -N 1 0 0 0 0 . . . 0 -N 1            
, where C is a positive integer to be optimized later. Consider the vector

v = Caq 1 , aq 1 q 2 x 2 a 2 , . . . , aq 1 q k x k a k ∈ Z k . Since v = aq 1 , aa 1 q 2 a 2 . . . , aa 1 q k a k × M,
then, by reducing the lattice L, one can find v among the smallest vectors. Indeed, the Gaussian Heuristic for L asserts that the length of its shortest non-zero vector is usually σ(L) where

σ(L) ≈ dim(L) 2πe det(L) 1 dim(L) = k 2πe C 1 k N k-1 k 1 .
If we choose C such that σ(L) > v , then v can be found among the shortest non-zero vectors of the lattice L. This leads to the factorization of the k RSA moduli by computing q 1 = gcd(N 1 , aq 1 ) and for i ≥ 2, q i = gcd N i , aa 1 q i a i

.

Any value for C with C ≥ 2 n-t will be optimal for the reduction and will lead to the condition

t > k k -1 α + k 2 k -1 β + k 2(k -1) (1 + log 2 (πe)) ,
where q i ≈ 2 α and a i ≤ 2 β for i = 1, . . . , k.

It is also possible to consider the same situation as before where the least significant bits (LSBs) are shared instead of the most significant bits (MSBs). The techniques and the result are similar.

Chapter 3

Cryptanalysis of Variants of RSA

In this chapter, we consider three variants of the RSA cryptosystem and show how to adapt the cryptanalytic attacks on standard RSA to break the underlying systems. The variant RSA cryptosystems studied in this chapter are KMOV, Demytko's scheme and four variants of the RSA cryptosystem with the same key equations, namely the Kuwakado-Koyama-Tsuruoka cryptosystem, a cryptosystem of Castagnos, a cryptosystem based on Gaussian integers and LUC cryptosystem.

Cryptanalysis of KMOV

In this section, we describe the attack presented in [START_REF] Nitaj | A new attack on the KMOV cryptosystem[END_REF] on the KMOV cryptosystem.

In 1991, Koyama, Maurer, Okamoto and Vanstone [START_REF] Koyama | New public-key schemes based on elliptic curves over the ring Z n[END_REF] introduced a new public key cryptosystem, called KMOV. The KMOV cryptosystem is based on elliptic curves over the ring Z n where n = pq is an RSA modulus, that is, the product of two large unknown primes of equal bit-size. The KMOV public key is denoted by (n, e) where n = pq and e is an integer satisfying gcd(e, (p + 1)(q + 1)) = 1. The corresponding private exponent d is an integer satisfying ed ≡ 1 (mod (p + 1)(q + 1)) which can be reformulated as an equation ed -k(p + 1)(q + 1) = 1.

In this section, we consider KMOV with a public exponent e satisfying the 25 generalized equation ex -(p + 1)(q + 1)y = z, where x and y are co-prime positive integers.

In 1995, Pinch [128] extended Wiener's attack [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] to KMOV using similar techniques applied with the key equation ed -k(p + 1)(q + 1) = 1, that is when z = 1 in our generalization. Similarly, Ibrahimpašić [START_REF] Ibrahimpasic | Cryptanalysis of KMOV cryptosystem with short secret exponent[END_REF], studied the security of KMOV with short secret exponents using the equation ed -k(p + 1)(q + 1) = 1.

The KMOV cryptosystem uses the arithmetic of elliptic curves over the ring Z n = Z/nZ where n = pq is the product of two large distinct primes p and q. An elliptic curve

E n (a, b) over Z n is the set of points (x, y) ∈ Z 2 n satisfying y 2 = x 3 + ax + b (mod n)
together with the point at infinity O. The addition law can be extended for points in a curve E n (a, b) over Z n using the same rules than the addition over a finite field. E n (a, b)(Z n ) is not a group. By the Chinese Remainder Theorem, the mapping

E n (a, b) → E p (a, b) × E q (a, b)
defined by the natural projections is a bijection. Thus, a point (x, y) of the elliptic curve E n (a, b) is associated to the point ((x (mod p), y (mod p)), (x (mod q), y

(mod q)) ∈ E p (a, b) × E q (a, b).
The points (O, P ) and (P, O) can not be represented like this. Finding such a point is, however, very unlikely and would lead to the factorization of n (see [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF]).

Let #E p (a, b) denote the number of distinct points of the elliptic curve E p (a, b). We have the following result which is a consequence of the Chinese Remainder Theorem . Lemma 3.1.1. Let n = pq be an RSA modulus and E n (a, b) an elliptic curve over Z n with gcd 4a 3 + 27b 2 , n = 1. Then for any P ∈ E n (a, b) and any integer k, we have

(1 + k#E p (a, b)#E q (a, b))P = P.
The algorithms in KMOV work as follows.

• Key Generation

INPUT: The bit-length k of the RSA modulus. OUTPUT: The public key (n, e) and the private key (n, d).

1. Find two primes, p and q, of length k/2 bits satisfying p ≡ q ≡ 2 (mod 3). 2. Compute the RSA modulus n = pq. 3. Choose a public key e co-prime to (p + 1)(q + 1). 4. Compute the inverse d of e mod ((p + 1)(q + 1)). 5. Return the public key (n, e) and the private key (n, d).

• KMOV Encryption

INPUT: The public key (n, e) and the plaintext message m.

OUTPUT: The cyphertext (c 1 , c 2 ). 1. Represent the message m as a couple (m 1 , m 2 ) ∈ Z 2 n . 2. Compute b = m 2 2 -m 3 1 (mod n). 3. Compute the point (c 1 , c 2 ) = e(m 1 , m 2 ) on the elliptic curve y 2 = x 3 + b (mod n). 4. Return (c 1 , c 2 ).

• KMOV Decryption

INPUT: The private key (n, d) and the cyphertext (c 1 , c 2 ). OUTPUT: The plaintext message (m 1 , m 2 ).

1. Compute b = c 2 2 -c 3 1 (mod n).
Note that the receiver of a message never need to compute b, but he can compute it.

Compute the point

(m 1 , m 2 ) = d(c 1 , c 2 ) on the elliptic curve y 2 = x 3 + b (mod n). 3. Return (m 1 , m 2 ).
The choice of the prime numbers p and q with p ≡ q ≡ 2 (mod 3) is motivated by the following lemma. The starting point for our attack on KMOV is the equation ex -(p + 1)(q + 1)y = z.

When the unknown parameters x, y and z are suitably small, then by applying the continued fraction algorithm and Coppersmith's method, one can solve the equation and then factor the RSA modulus n = pq.

Theorem 3.1.3. [START_REF] Nitaj | A new attack on the KMOV cryptosystem[END_REF] Let n = pq be an RSA modulus with q < p < 2q. Suppose that the public exponent e satisfies an equation ex-(p+1)(q+1)y = z where x and y are positive integers with gcd(x, y) = 1 and

|z| < n 1 4 y, xy < √ 2 √ n 12 .
Then y x is one of the convergents of the continued fraction expansion of e n .

The proof begins by transforming the equation ex -(p + 1)(q + 1)y = z into ex -ny = (p + q + 1)y + z. Using some properties on the size of p and q, namely p + q < 3 √ 2 2

√

n and assuming that |z| < n

= |(p + q + 1)y + z| nx < 3 √ 2 √ ny nx < 1 2x 2 .
This implies, by Theorem 2.2.3, that y x is a convergent of the continued fraction expansion of e n . Moreover, under an extra condition, one can use the fraction y

x to factor the modulus n = pq. Theorem 3.1.4. [START_REF] Nitaj | A new attack on the KMOV cryptosystem[END_REF] Let n = pq be an RSA modulus with q < p < 2q. Suppose that e is an exponent satisfying an equation ex -(p + 1)(q + 1)y = z with gcd(x, y) = 1 and

|z| < (p -q)n If we set U = ex y -n -1, V = |U 2 -4n|,
then using the equation ex -(p + 1)(q + 1)y = z, we get

|U -p -q| = ex y -n -1 -p -q = |z| y < (p -q)n 1 4 3(p + q) . Hence, if |z| < (p-q)n 1 4 y 3(p+q) , then |U -p -q| < n 1 4
. This leads to |p -q -V | < n 1 4 . Then, combining the approximations of p+q and p-q, we get p -U +V 2 < n 1 4 . Hence, using Coppersmith's Theorem 2.5.3, we get p and then the factorization of n.

Cryptanalysis of Demytko's cryptosystem

In this section, we describe the attack presented in [START_REF] Nitaj | A New Attack on RSA and Demytko's Elliptic Curve Cryptosystem[END_REF] on the Demytko cryptosystem.

Let p be a prime number and a and b be two positive integers such that gcd(4a 3 + 27b 2 , p) = 1. Consider the elliptic curve E p (a, b) over the field F p . It is the set of points P = (x, y) ∈ F 2 p such that y 2 ≡ x 3 + ax + b (mod p) together with the point at infinity. The number of such points is denoted #E p (a, b) and satisfies #E p (a, b) = p + 1 -t p where, according to Hasse Theorem [START_REF] Silverman | The Arithmetic of Elliptic Curves[END_REF]

satisfies |t p | ≤ 2 √ p.
Let N = pq be an RSA modulus and let a and b be two integers such that gcd(4a

3 + 27b 2 , N ) = 1. An elliptic curve E N (a, b) is the set of points (x, y) such that y 2 ≡ x 3 + ax + b (mod N ),
together with the point at infinity O. It is well known that chord-and-tangent method in the case of elliptic curves E p (a, b) defined over the finite filed F p still hold for E N (a, b) unless the inversion of a non-zero number Q does not exist modulo N . This case would lead to find a factor of N by computing gcd(Q, N ). When the prime factors p, q in N = pq are large, then with overwhelming probability the inversion of a non-zero number will exist modulo N .

In 1994, Demytko [START_REF] Demytko | A new elliptic curve based analogue of RSA[END_REF] developed a cryptosystem using an elliptic curve E N (a, b) over the ring Z/N Z where N = pq is an RSA modulus which can be summarized as follows.

1. Key Generation:

• Choose two distinct prime numbers p and q of similar bit-length.

• Compute N = pq.

• Select two integers a, b < p such that gcd N, 4a 3 + 27b 2 = 1.

• Choose e such that gcd e, p 2 -t 2 p q 2 -t 2 q = 1.

• Keep p, q secret and publish N, e, a, b.

Encryption:

• Transform the message m as the x-coordinate of a point P = (m x , m y ) on the elliptic curve E N (a, b).

• Compute the ciphertext point C = eP = (c x , c y ) = e(m x , m y ) on the elliptic curve y 2 = x 3 + ax + b (mod N ).

Decryption:

• Compute u = c 3 x + ac x + b (mod N ). • Compute the Legendre symbols u p = u p and u q = u q . • If (u p , u q ) = (1, 1), then compute d ≡ e -1 (mod lcm(p + 1 -t p , q + 1 -t q )).

• If (u p , u q ) = (1, -1), then compute d ≡ e -1 (mod lcm(p + 1 -t p , q + 1 + t q )).

• If (u p , u q ) = (-1, 1), then compute d ≡ e -1 (mod lcm(p + 1 + t p , q + 1 -t q )).

• If (u p , u q ) = (-1, -1), then compute d ≡ e -1 (mod lcm(p+1+t p , q + 1 + t q )).

• Compute m as the x-coordinate of dC = deP = P = (m x , m y ) on the elliptic curve y 2 = x 3 + ax + b (mod N ).

In the following, we consider d ≡ e -1 (mod (p + 1 ± t p , q + 1 ± t q )) instead of modulo lcm(p + 1 ± t p , q + 1 ± t q ). This implies that e and d satisfy an equation of the form

ed -k (p -s) (q -r) = 1, s = ∓t p -1, r = ∓t q -1.
Then, a generalization of this equation is of the form eu-(p-s)(q -r)v = w.

Under some conditions on the size of the unknown parameters, one can apply Coppersmith's technique [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] and the elliptic curve method for factoring [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] to solve the equation and then find p and q which factors N and breaks the system. This will be achieved in two steps. The first step enables us to find the product (p -s)(q -r). Theorem 3.2.1 ( [121], Theorem 3.1). Let N = pq be an RSA modulus and e = N β be a public exponent. Suppose that e satisfies the equation eu

-(p -s)(q -r)v = w with |r|, |s| < N α , u < N δ and |w| < N γ . If δ < 7 6 + 1 3 α -γ - 1 3 (2α + 1)(2α + 6β -6γ + 1) -ε,
then one can find the product (p -s)(q -r) in polynomial time.

The general idea in the proof is to use Coppersmith's technique combined with Jochemz-May strategy [START_REF] Jochemsz | A strategy for finding roots of multivariate polynomials with new applications in attacking RSA variants[END_REF], Howgrave-Graham's Theorem [START_REF] Howgrave-Graham | Finding small roots of univariate modular equations revisited[END_REF] and lattice reduction.

Next, assume that (p -s)(q -r) is computed and that one of the factors p -s or q -r is B-smooth, that is all prime factors of (p -s)(q -r) are less than B where B is a parameter bound for the elliptic curve method for factoring ECM. Then, one can use ECM to factor (p -s)(q -r) and to find all divisors. As p -s is one of these factors and assuming s < N 1 4 , then one can apply Coppersmith's Theorem 2.5.3 to find p and then q. Theorem 3.2.2 ( [121], Theorem 3.2). Let N = pq be an RSA modulus and e = N β be a public exponent. Suppose that e satisfies the equation eu

-(p -s)(q -r)v = w with |r|, |s| < N α < N 1 4 , u < N δ and |w| < N γ . Let B be an ECM-efficiency bound for the Elliptic Curve Method. If (p -s) or (q -r) is B-smooth and δ < 7 6 + 1 3 α -γ - 1 3 (2α + 1)(2α + 6β -6γ + 1),
then one can find p and q in polynomial time.

We can now apply the former result to Demytko's scheme. In this scheme, the RSA modulus is N = pq and the elliptic curve E N (a, b) is such that #E p (a, b) = p + 1 -t p and #E q (a, b) = q + 1 -t q where, according to Hasse Theorem, |t p | < 2 √ p and |t q | < 2 √ q. The public exponent e and the private exponent d satisfy one of the four equations

eu -(p + 1 ± t p )(q + 1 ± t q )v = w.
These equations can be transformed into one of the form eu-(p-s)(q-r)v = w where s = ∓t p -1 and t = ∓t q -1. Consequently, when t p and t q are suitably small and satisfy some specific conditions, then one can solve the equation, find p and q and then break the system.

Cryptanalysis of Some RSA Type cryptosystems

In this section, we describe the attack presented in [START_REF] Bunder | A generalized attack on RSA type cryptosystems[END_REF] on the Demytko cryptosystem.

RSA is the first and widely most used public key cryptosystem. In order to improve the implementation of the RSA cryptosystem, many schemes have been presented giving rise to some RSA type cryptosystems. A way to extend RSA is to consider the modulus N = pq and the exponent e with specific arithmetical operations such as elliptic curves [START_REF] Koyama | New public-key schemes based on elliptic curves over the ring Z n[END_REF][START_REF] Kuwakado | A new RSA-type scheme based on singular cubic curves y 2 = x 3 + bx 2 (mod n)[END_REF] and Gaussian domains [START_REF] Elkamchouchi | Extended RSA cryptosystem and digital signature schemes in the domain of Gaussian integers[END_REF].

In 1993, Smith and Lennon presented a cryptosystem called LUC [START_REF] Smith | LUC: a new public-key cryptosystem[END_REF]. LUC is based on Lucas sequences. The public exponent e and the private exponent d are integers such that ed ≡ 1 (mod p 2 -1 q 2 -1 ) which can be transformed into the equation ed -k p 2 -1 q 2 -1 = 1.

In 1995, Kuwakado, Koyama and Tsuruoka [START_REF] Kuwakado | A new RSA-type scheme based on singular cubic curves y 2 = x 3 + bx 2 (mod n)[END_REF] presented a scheme with an RSA modulus N = pq and a singular cubic curve with equation y 2 = x 3 + bx 2 mod N . The addition of two points in the singular cubic curve is similar than the addition for elliptic curves. In some cases, the addition is not possible if the inversion modulo N is not possible. In this situation, one can certainly find a factor of N . When N is an RSA modulus with large prime factors, this will happen very rarely. Note that the elliptic curve method factoring method of Lenstra [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] is based on this idea. In the scheme of Kuwakado-Koyama-Tsuruoka, a message is then transformed into a point M = (m x , m y ) on the singular cubic equation. In the scheme, the public exponent e and the private exponent d satisfy an equation of the form edk p 2 -1 q 2 -1 = 1.

In 2002, Elkamchouchi, Elshenawy and Shaban [START_REF] Elkamchouchi | Extended RSA cryptosystem and digital signature schemes in the domain of Gaussian integers[END_REF] presented an extension of RSA to the Gaussian domain. The modulus is of the form N = P Q where P and Q are two Gaussian primes. The public exponent e and the private exponent d are two positif integers satisfying ed ≡ 1 (mod (|P | -1) (|Q| -1)). When P = p and Q = q are integer prime numbers, the modular equations can be transformed into the equation ed -k p 2 -1 q 2 -1 = 1.

In 2007 Castagnos [START_REF] Castagnos | An efficient probabilistic public-key cryptosystem over quadratic field quotients[END_REF] presented a scheme with an RSA modulus N = pq and a public exponent e such that gcd e, p 2 -1 q 2 -1 = 1. This condition is equivalent to the equation ed -k p 2 -1 q 2 -1 = 1 where d and k are positive integers.

As we can see, the moduli and the public exponents of the former schemes satisfy the same equation, namely ed -k p 2 -1 q 2 -1 = 1. In the rest of this section, we show how to apply the continued fraction algorithm and Coppersmith's method to solve the generalized equation ex-p 2 -1 q 2 -1 y = z. We consider that the prime factors in N = pq are of the same bit size and ordered such that q < p < 2q. Then, we can find some useful results on the size of the primes. Lemma 3.3.1. Let N = pq be an RSA modulus with q < p < 2q. Then

2 √ N < p + q < 3 √ 2 2 √ N and 2N < p 2 + q 2 < 5 2 N.
The proof of the lemma starts by applying the increasing function f (x) = x + 1

x on 1 < p q < 2. This leads to 2N < p 2 + q 2 < 5 2 N . Similarly, applying the function f on 1

< p q < √ 2, we get 2 √ N < p + q < 3 √ 2 2

√

N .

To solve the equation ex -p 2 -1 q 2 -1 y = z, we need some extra conditions as in the following result. Theorem 3.3.2 ( [25], Theorem 3). Let N = pq be an RSA modulus with q < p < 2q. Let e be a public exponent satisfying an equation ex-p 2 -1 q 2 -1 y = z with coprime positive integers x and y. If

xy < 2N -4 √ 2N 3 4
and |z| < (p -q)N 1 4 y, then one can find p and q in polynomial time in log(N ).

The proof transforms the equation ex -

p 2 -1 q 2 -1 y = z into ex -N 2 + 1 - 9 4 N y = z -p 2 + q 2 - 9 4 N y.
Using various assumptions and proved results, we find the inequality

e N 2 + 1 -9 4 N - y x < 1 2x 2 .
It follows that y x is a convergent of the continued fraction expansion of e N 2 +1-9 4 N . Then using x and y, we compute an approximation p of p with an error term of at most N 1 4 , with

p = 1 2 (N + 1) 2 - ex y + (N -1) 2 - ex y .
Then applying Coppersmith's Theorem 2.5.3, we find p in a polynomial time which leads to the factorization of N .

We note that the attacks on the equation ed -k p 2 -1 q 2 -1 = 1 are very rare and a lot of the attacks on RSA can be adapted to solve the equation.

Chapter 4

Cryptanalysis of NTRU

Introduction

The NTRU public key cryptosystem was proposed by J. Hoffstein, J. Pipher and J. H. Silverman [START_REF] Hoffstein | NTRU: A Ring Based Public Key Cryptosystem[END_REF] in 1996. It is one of the fastest known public key cryptosystems. It offers both encryption (NTRUencrypt) and digital signature (NTRUSign). In comparison with RSA [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] and ECC [START_REF] Koblitz | Elliptic Curve Cryptosystems[END_REF][START_REF] Miller | Uses of elliptic curves in cryptography[END_REF], NTRU is faster and has smaller keys. Moreover, NTRU is still resistant to quantum attacks because its security is conjectured to rely on the hardness of certain lattice problems. Since its presentation, NTRU has been scrutinized for weaknesses and was standardized in 2009 by IEEE Std 1363. 1-2008 [70] and in 2010 by ANSI X9.98-2010 [2].

In 1998, Coppersmith and Shamir [START_REF] Coppersmith | Lattice attacks on NTRU[END_REF] presented a lattice based attack on NTRU. This attack exploits the structure of the public key in NTRU. Using the key equation, the method builds a lattice and applies lattice reduction techniques to find short vectors in the lattice that could exhibit the private key. However, the method is not practicable in large dimensions. The updated parameters in [START_REF] Hoffstein | Choosing parameters for NTRUEncrypt[END_REF] make NTRU secure against lattice attacks.

Other types of attacks on NTRU have been considered in the last decade. In 2007, Howgrave-Graham [START_REF] Howgrave-Graham | A Hybrid Lattice-Reduction and Meet-in-the-Middle Attack Against NTRU[END_REF] presented a hybrid attack of lattice reduction and meet-in-the-middle attack on NTRU. In 2015, Kirchner and Fouque [START_REF] Kirchner | An improved BKW algorithm for LWE with applications to cryptography and lattices[END_REF][START_REF] Kirchner | Comparison between subfield and straightforward attacks on NTRU[END_REF] presented a heuristic subexponential-time algorithm on NTRU and in 2016, independently, Cheon, Jeong and Lee [START_REF] Cheon | An Algorithm for NTRU Problems and Cryptanalysis of the GGH Multilinear Map without an encoding of zero[END_REF] and Albrecht, Bai and Ducas [4] described similar attacks on NTRU. The two attacks are based on the fact that for any cyclotomic number field, there exists a subfield that allows to reduce the dimension of the lattice. To avoid the attacks that exploit special structures of the rings used in NTRU, Bernstein et al. [11] presented recently a variant of NTRU, called NTRU Prime where the underlying ring is in the form Z q [X]/(X p -X -1) where Z q = Z/qZ and p is a prime number.

In this chapter, we show that the attack of Coppersmith and Shamir can be improved for NTRU with two public keys if the private keys share an amount of the coefficients.

Description of NTRU

The main objects in NTRU are polynomials from the ring of truncated polynomials R = Z q [X]/ X N -1 where Z q = Z/qZ. NTRU uses four public parameter sets, L f , L g , L m and L r . These sets and the other parameters can be categorized as follows where, for a positive integers d, B(d)) is the set of polynomials of R with d coefficients equal to 1 and all the other coefficients equal to 0:

• N is a public prime and is sufficiently large.

• p is a small public modulus, typically p = 3.

• q is a large public modulus with gcd(p, q) = 1.

• L f = B(d f
) is a set of small polynomials from which the private keys are selected.

• L g = B(d g ) is a similar set of small polynomials from which other private keys are selected.

• L m = Z p [X]/ X N -1 is the plaintext space. It is a set of polynomials m ∈ Z p [X]/(X N -1
) that represent encryptable messages.

• L r = B(d r ) is a set of polynomials from which the blinding value used during encryption is selected.

The key generation, encryption and decryption primitives are as follows:

1. Key generation

• Randomly choose a polynomial f ∈ L f such that f is invertible in R modulo p and modulo q. • Compute f p ≡ f -1 (mod p) and f q ≡ f -1 (mod q). • Randomly choose a polynomial g ∈ L g . • Compute h ≡ g * f q (mod q).
• Publish the public key (N, h) and the set of parameters p, q, L f , L g , L r and L m . • Keep the private key (f, f p ).

Encryption

• Represent the message as a polynomial m ∈ L m .

• Randomly choose a polynomial r ∈ L r .

• Encrypt m with the public key (N, h) using the rule e ≡ p * r * h + m (mod q).

Decryption

• The receiver computes a ≡ f * e (mod q).

• Using a centering procedure, transform a to a polynomial with coefficients in the interval -q 2 , q 2 . • Compute m ≡ f p * a (mod p).

If one of the coefficients of the polynomial p * r * g + f * m do not lie in the interval -q 2 , q 2 , then the original message m can not be recovered. This situation is called decryption failure and when the parameters are suitably chosen, the decryption is always correct [START_REF] Hoffstein | An Introduction to Mathematical Cryptography[END_REF].

The attack of Coppersmith and Shamir on NTRU

The recovery of the NTRU private key f from public key h ≡ g * f q (mod q) can be transformed into as a lattice problem as was presented by Coppersmith and Shamir [START_REF] Coppersmith | Lattice attacks on NTRU[END_REF]. Let λ be a positive value to be optimized later. The equation h ≡ g * f q (mod q) is equivalent to h * f -q * u = g where u ∈ R and can be rewritten as

λ 0 h q f -u = λf g .
Using the coordinates of f and

g f = (f 0 , f 1 , . . . , f N -1 ), g = (g 0 , g 1 , . . . , g N -1 ), h = (h 0 , h 1 , . . . , h N -1 ), u = (u 0 , u 1 , . . . , u N -1 ), we get               λ 0 • • • 0 0 0 • • • 0 0 λ • • • 0 0 0 • • • 0 . . . . . . . . . . . . . . . . . . . . . . . . 0 0 • • • λ 0 0 • • • 0 h 0 h N -1 • • • h 1 q 0 • • • 0 h 1 h 0 • • • h 2 0 q • • • 0 . . . . . . . . . . . . . . . . . . . . . . . . h N -1 h N -2 • • • h 0 0 0 • • • q               *               f 0 f 1 . . . f N -1 -u 0 -u 1 . . . -u N -1               =               λf 0 λf 1 . . . λf N -1 g 0 g 1 . . . g N -1              
.

Consider the lattice L spanned by the rows of the underlying matrix. Then (λf, g) ∈ L and L ⊂ Z 2N is a lattice with dimension 2N and determinant det(L) = λ N q N . The Euclidean norm of the vector (λf, g) is

λ 2 d f + d g .
The Gaussian heuristic asserts that (λf, g) is the shortest vectors of the lattice overwhelming probability and so lattice reduction might be used to find it. More precisely, the Gaussian heuristic says that the length of the shortest non-zero vector is usually approximately σ(L) where

σ(L) = dim(L) 2πe (det L) 1/ dim(L) = 2N 2πe (λq) N 2N = λqN πe .
We need σ(L) ≈ (λf, g) . This can be achieved by taking λ = g / f which leads to a ratio

c = (λf, g) σ(L) = 2πe g f qN .
When the ratio c is small, then lattice reduction is expected to find the vector (λf, g) and then the private key f .

An attack of NTRU with two public keys: Case 1

In this section, we describe the attack presented in [START_REF] Nitaj | Cryptanalysis of NTRU with two Public Keys[END_REF] on the Demytko cryptosystem.

Consider NTRU with two public keys h and h defined by the same parameters (N, p, q) and

h = f -1 q * g (mod q), h = F -1 q * G (mod q).
We can rewrite h using f -1 q and f as

h = f -1 q f * F -1 q * G = f -1
q * g (mod q), where g = f * F -1 q * G (mod q). This means that all the public keys in NTRU can be expressed with the same polynomials f ∈ R and f -1 q . Combining h and h , we get (h -h ) * f = g -g (mod q).

Consider the lattice L spanned by the rows of the matrix

M (h, h ) = λI N H -H 0 qI N ,
where

H -H is the circulant matrix      h 0 -h 0 h 1 -h 1 • • • h N -1 -h N -1 h N -1 -h N -1 h 0 -h 0 • • • h N -2 -h N -2 . . . . . . . . . . . . h 1 -h 1 h 2 -h 2 • • • h 0 -h 0      .
Then one can observe that (λf, g -g ) is in the lattice L. Using the Gaussian heuristic, one can expect to find (λf, g -g ) as the shortest vector of the lattice. The Gaussian heuristic says that the length of the shortest non-zero vector is approximately

σ(L) = dim(L) 2πe det L 1/ dim(L) = λN q πe .
On the other hand, the Euclidean norm of (λf, g -g ) is (λf, g -g ) = λ 2 f 2 + g -g 2 and the ratio

c 1 = (λf, g -g ) σ(L(h, h )) , is minimized for λ = g -g f ,
which gives

c 1 = 2πe g -g f qN .
Recall that in the attack of Coppersmith and Shamir, the ratio is

c = 2πe g f qN .
The new attack is more efficient when c 1 < c which is satisfied when

g -g < min( g , g ).
This means that, whenever g and g share many coefficients, then the new attack is more efficient to find the private key f than the attack of Coppersmith and Shamir.

An attack of NTRU with two public keys: Case 2

In this section, we describe the second attack on NTRU with two public keys as presented in [START_REF] Nitaj | Cryptanalysis of NTRU with two Public Keys[END_REF].

Let h and h be two public keys with the same parameters

h = f -1 q * g (mod q), h = F -1 q * G (mod q).
We suppose that g and G are invertible modulo q. We set h q = h -1 (mod q) and h q = h -1 (mod q). Then

h q = g -1 * f (mod q), h q = G -1 * F = g -1 * g * G -1 * F = g -1 * f (mod q).
where f = g * G -1 * F . Then, we get

g * h q = f (mod q), g * h q = f (mod q). Let h q (X) = N -1 i=0 h q,i X i , h q (X) = N -1 i=0 h q,i X i .
For a positive constant λ, we define the 2N -dimension lattice L L = (λv, w) ∈ R 2 : w = v * h q -h q (mod q) .

We can see that the lattice is generated by the row vectors of the matrix M with

M = λI N H q -H q 0 qI N ,
where H q -H q is the circulant matrix

     h q,0 -h q,0 • • • h q,N -1 -h q,N -1 h q,N -1 -h q,N -1 • • • h q,N -2 -h q,N -2 . . . . . . . . . h q,1 -h q,1 • • • h q,0 -h q,0      .
Assume that g * h q = f + qv and g * h q = f + qv . Then (g, -v + v ) * M = (λg, f -f ), and (λg, f -f ) is a vector of L . Hence, by reducing the lattice, one can find (λg, f -f ) among the shortest vectors if a certain condition is satisfied. Indeed, by the Gaussian heuristic, the shortest non-zero vector is approximately

σ(L ) = dim(L ) 2πe det L 1/ dim(L ) = λN q πe .
To compare σ(L ) and the length (λg, f -f ) = λ 2 g 2 + f -f 2 of the target vector (λg, f -f ), we introduce the ratio

c 2 = (λg, f -f ) σ(L ) .
To increase the chances of lattice reductions to find the vector (λg, f -f ), the ratio c 2 should be as small as possible. This is achieved by taking

λ = f -f g ,
which leads to

c 2 = 2πe f -f g qN .
In comparison, in the attack of Coppersmith and Shamir, the ratio is

c = 2πe g f qN .
Then, when c 2 < c, the new method is be more efficient. A sufficient condition for this is about the shortness of the length of the difference f -f :

f -f < min ( f , f ) .
Hence, if f and f share a certain amount of their coefficients, the new method will find the private keys f and f more efficiently than the attack of Coppersmith and Shamir.

Chapter 5

Cryptanalysis of the DGHV Cryptosystem

Introduction

The purpose of homomorphic encryption is to allow computation on encrypted data without decrypting it. The idea of computing on encrypted data was first proposed by Rivest, Adleman and Dertouzos [START_REF] Rivest | On data banks and privacy homomorphisms[END_REF] in 1978.

In 1991, Feigenbaum and Merritt [START_REF] Feigenbaum | Open Questions, Talk Abstracts, and Summary of Discussions[END_REF] posed the problem if it is possible to design an encryption function E such that both E(x + y) and E(x.y) are easy to compute from E(x) and E(y). In 2009, Gentry [START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF] proposed a positive answer and theoretically demonstrated the possibility of construction such an encryption function. In the last few years, homomorphic encryption schemes have become of great interest in many different cryptographic protocols such as Medical Applications [9], cloud computing, multiparty computation, election and voting protocols (see [6,[START_REF] Naehrig | Can homomorphic encryption be practical?[END_REF] for more applications). For this reason, homomorphic encryption schemes have been studied extensively to improve implementations and applications. Many classical systems are partially homomorphic. For example, RSA [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] is multiplicatively homomorphic while the Goldwasser-Micali scheme [START_REF] Goldwasser | Probabilistic Encryption[END_REF] and ElGamal [START_REF] Gamal | A public key cryptosystem and signature scheme based on discrete logarithms[END_REF] are additively homomorphic. Boneh, Goh and Nissim [19] were the first to construct a scheme capable of performing an arbitrary number of additions but one multiplication. In 2009, Gentry [START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF] constructed a fully homomorphic encryption scheme (FHE) with the possibility of evaluating an arbitrary number of additions and multiplications. The security of Gentry's proposal relies on hard assumptions in lattices such as the Sparse Subset Sum Problem (SSSP).

In 2010, van Dijk, Gentry, Halevi and Vaikuntanathan [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF] presented an efficient and simple scheme, called DGHV. In DGHV, the private key is an odd integer p. A bit m is then encrypted as c = pq + 2r + m where q and r are secret random integers. To decrypt from c, one just computes m = (c (mod p)) (mod 2). The security of DGHV relies on the hardness of SSSP as well as that of the Approximate Greatest Common Divisor problem (AGCD) as introduced by Howgrave-Graham [START_REF] Howgrave-Graham | Approximate integer common divisors[END_REF]. The AGCD problem is to recover a prime number p when many approximate multiples q i p + r i of p are given with small r i .

Many attacks on DGHV have been proposed [START_REF] Chen | Faster algorithms for approximate common divisors: Breaking fully-homomorphic-encryption challenges over the integers[END_REF][START_REF] Coron | Fully homomorphic encryption over the integers with shorter public keys[END_REF][START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF][START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF] and served to fix the parameters. In this chapter, we describe two new attacks. The first attack concerns the instance where c 1 = pq 1 and c i = pq i + r i with r i = 0. We apply Coppersmith's method to solve the equation a 2 c 2 + . . . + a m c m = a 1 q 1 under suitable conditions. The second attack works for the general instance c i = pq i +r i for i = 1, . . . , m. We study the linear equation a 1 q 1 +. . .+a m q m = 0 and apply lattice reduction techniques to solve it under some conditions. In both attacks, we retrieve the secret parameters p and q i .

Description of the Parameters in DGHV

DGHV is described in [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF] as a somewhat homomorphic scheme with a single private key p, which is a prime number. To encrypt m ∈ {0, 1}, one compute c = pq + 2r + m where q is a large random integer and r is a small random integer. To decrypt c, one computes (c mod p) mod 2=m. If c 1 = pq 1 + 2r 1 + m 1 and c 2 = pq 2 + 2r 2 + m 2 are two ciphertexts, then

c 1 + c 2 = p(q 1 + q 2 ) + 2(r 1 + r 2 ) + m 1 + m 2 , c 1 c 2 = p(pq 1 q 2 + 2q 1 r 2 + q 1 m 2 + 2q 2 r 1 + q 2 m 1 ) + 2(2r 1 r 2 + r 1 m 2 + m 1 r 2 ) + m 1 m 2 ,
which implies that DGHV is a homomorphic scheme.

To ease the notation, the ciphertext c = pq + 2r + m can be rewritten as c = pq + r. In DGHV, the public parameters are the integers c i = pq i + r i where the parameters p, q i and r i are as follows.

• For i = 1, . . . , m, c i is a public integer of bit-length γ.

• p is a private prime number of bit-length η.

• For i = 1, . . . , m, q i is a private integer of bit-length γ -η.

• For i = 1, . . . , m, r i is a private random integer with

|r i | < 2 ρ .
In [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF], it is shown that the scheme is semantically secure under the Approximate-GCD assumption which states the following: Definition 5.2.1 (Approximate-GCD assumption). Let γ, η, ρ be positive integers. For any η-bit prime number p, given m many positive integers c i = pq i + r i with m many (γ -η)-bit integers q i and m many integers r i satisfying |r i | < 2 ρ , it is hard to find p.

There exists a variant of DGHV with c 1 = pq 1 where q 1 is a large integer such that it is hard to find any prime factor that divides c 1 .

In [START_REF] Coron | Fully homomorphic encryption over the integers with shorter public keys[END_REF][START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF][START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF], the security of DGHV has been studied against several attacks. These attacks served to propose optimal parameters for η, ρ, and γ in order to improve the security of DGHV. These attacks can be categorized according to their underling techniques:

• Brute force search [START_REF] Chen | Faster algorithms for approximate common divisors: Breaking fully-homomorphic-encryption challenges over the integers[END_REF][START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF]: When c 1 = pq 1 , this technique consists in removing the noise, say r 2 from c 2 by trying all possibilities for r 2 ∈ (-2 ρ , 2 ρ ) and computing gcd(c 1 , c 2 -r 2 ) which gives p with overwhelming probability.

• Continued fractions [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF][START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF]: This consists on recovering q i /q j from c i /c j using continued fractions, which yields immediate calculation of p = c i /q i .

• Attacks on the Approximate-GCD assumption [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF][START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF]: The recovery of p through the recovery of r i or q i , i = 1, . . . , m, using a combination of lattice reduction and other techniques. These attacks include Coppersmith's technique [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF], the method for solving simultaneous diophantine equations [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] and the orthogonal lattice attacks [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF][START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF].

In the case c 1 = pq 1 , the parameters in DGHV are chosen such that direct factorization is not possible [START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF].

The First Proposed attack on DGHV

In this section, we briefly describe the attack on DGHV as presented in [START_REF] Nitaj | Lattice Attacks on the Homomorphic DGHV Scheme[END_REF].

In this section, we assume that c 1 = pq 1 and c i = pq i + r i for i = 2, . . . , m. Then one can show that there exist infinitely many solutions of the linear equation a 2 c 2 + . . . + a m c m = a 1 q 1 , in integers a 1 , . . . , a m . We derive a condition on the size of each |a i | under which the above equation can be solved leading to the cryptanalysis of the scheme. To solve the linear equation, we use Coppersmith's technique for linear equations with unknown modulus, as presented by Herrmann and May in [START_REF] Herrmann | Solving linear equations modulo divisors: On factoring given any bits[END_REF].

Theorem 5.3.1 (Herrmann-May). Let N be a composite integer of unknown factorization with a divisor p ≥ N β . Let f (x 1 , . . . , x n ) ∈ Z[x 1 , . . . , x n ] be a linear polynomial in n variables. One can find in polynomial time all solutions x (0) 1 , . . . , x (0) n of the equation f (x 1 , . . . , x n ) ≡ 0 (mod p) with

x (0) 1 < N λ 1 , . . . , x (0) n < N λ n if n i=1 λ i < 1 -(1 -β) n+1 n -(n + 1) 1 -n 1 -β (1 -β).
Since q 1 is an unknown factor of c 1 , we apply the former result and get the following result.

Theorem 5.3.2 ( [122], Theorem 4.1.). Let c 1 = pq 1 and c i = pq i + r i , i = 2, . . . , m, be m positive integers with 2 η-1 < p < 2 η , 2 γ-1 < c i < 2 γ and |r i | < p for i = 2, . . . , m. Let a 1 , . . . , a m be m integers satisfying

|a i | < 2 α i for i = 2, . . . , m and a 2 c 2 + . . . + a m c m = a 1 q 1 . Define β = γ-η-1 γ . If m i=2 α i < 1 -(1 -β) m m-1 -m 1 -m-1 1 -β (1 -β) (γ -1),
then, one can find p, q 1 , . . . , q m , r 2 , . . . , r m in polynomial time.

The proof of this result is a straightforward application of Herrmann-May's Theorem with the linear modular equation a 2 c 2 + . . . + a m c m ≡ 0 (mod q 1 ) with the specific bounds of the unknown parameters. Once a solution (a 2 , . . . , a m ) is found, we compute

q 1 = gcd(c 1 , a 2 c 2 + . . . + a m c m ), p = c 1 q 1 .
Then for i = 2, . . . , m, we get r i ≡ c i (mod p) and q i = c i -r i p . In [START_REF] Nitaj | Lattice Attacks on the Homomorphic DGHV Scheme[END_REF], a comparison with the former attacks shows that the new attack is significantly more efficient.

The Second Proposed attack on DGHV

Next, we describe the second attack on DGHV as presented in [START_REF] Nitaj | Lattice Attacks on the Homomorphic DGHV Scheme[END_REF].

In this section, we consider the situation where the DGHV public values are of the general form c i = pq i + r i , i = 1, . . . , m. Since there are infinitely many linear integer relations between the q i of the form a 1 q 1 +. . .+a m q m = 0, we show that one can find such unknown integers under some conditions.

+ . . . + a m q m = 0. If α < 1 m log 2 (c m ) + log 2 √ m m + 1 -ρ,
then, one can find p, q 1 , . . . , q m , r 1 , . . . , r m in polynomial time.

The proof of this theorem is based on the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] for lattice reduction. Using c i = pq i + r i and the relation a 1 q 1 + . . . + a m q m = 0, we get a 1 c 1 + . . . + a m c m = a 1 r 1 + . . . + a m r m . The idea is that, if a 1 r 1 + . . . + a m r m is close to 0, then so is a 1 c 1 + . . . + a m c m . Lattice reduction are then used to solve this equation to find a 1 , . . . , a m . Then using these values, we need a 1 r 1 + . . . + a m r m to be close to 0. Again, a second lattice reduction will find the values r 1 , . . . , r m . Hence, p = gcd(c 1 -r 1 , c 2 -r 2 ) and for i = 1, . . . , m, we get q i = c i -r i p .

In this paper, we consider two or three instances of RSA with the same modulus N = pq and two or three different public exponents e i satisfying equations of the form e i x i -(p -1)(q -1)y i = z i . We show how, under some specific conditions, one can solve the system of equations and then factor the RSA modulus.

Appendix D:

An Attack on RSA Using LSBs of Multiples of the Prime Factors AFRICACRYPT 2013 One of the recommendations of the ANSI Standard X9.31-1998 is to choose an RSA modulus N = pq such that the ratio of the prime factors is not too close to a rational fraction with small integers. In this paper, we consider an instance of RSA where the public exponent satisfies an equation of the form ed -k(N + 1 -ap -bq) = 1 where a b is an unknown approximation of q p . We show that such instance is insecure when the integers d, a and b are suitably small.

Appendix E:

Implicit Factorization of Unbalanced RSA Moduli with Muhammad Rezal Kamel Ariffin Journal of Applied Mathematics and Computing 2015 In this paper, we consider k ≥ 2 RSA muduli N i = p i q i such that some unknown multiples a i p i share an amount of least or most significant bits. We show that using continued fraction and lattice reduction techniques, one can factor the moduli under some suitable conditions. This paper generalizes many results on the problem of implicit factorization.

Appendix F:

Factoring RSA Moduli with Weak Prime Factors with Tajjeeddine Rachidi C2SI 2015

The paper presents an attack to factor a RSA modulus N = pq with k constants M i if the factor p satisfies a linear equation u 0 +M 1 u 1 +. . .+M k u k = ap where the unknown parameters u i and a are small for given constants M i . The method is based on Coppersmith's technique and lattice reduction.

Appendix G: New attacks on RSA with Moduli N = p r q with Tajjeeddine Rachidi C2SI 2015 In this paper, we consider the prime power RSA variant of RSA with modulus N = p r q. We study the generalized equation ex -φ(N )y = z where φ(N ) = p r-1 (p -1)(q -1) and show that Coppersmith's method can be applied to solve it under suitable conditions on the unknown parameters. The attack of this paper generalizes the former attacks on the prime power RSA with the key equation es -φ(N )k = 1.

Appendix H:

A New Attack on the KMOV Cryptosystem Bulletin of the Korean Mathematical Society 2014 KMOV is a cryptosystem introduced by Koyama, Maurer, Okamoto and Vanstone in 1991. It is based on an elliptic curve with equation y 2 = x 3 + b (mod n) where n = pq is an RSA modulus. The public key is an integer e satisfying an equation ed -k(p + 1)(q + 1) = 1. In this paper, we show how to attack KMOV by solving the general equation ex -(p + 1)(q + 1)y = z by applying lattice reduction techniques.

Appendix I:

A Generalized Attack on RSA Type Cryptosystems with Martin Bunder, Willy Susilo and Joseph Tonien Theoretical Computer Science 2016 In this paper, we consider three RSA variants of the RSA cryptosystem, one based on singular cubic curves, one based in Lucas sequences and one based on Gaussian integers. The three schemes use an RSA modulus N = pq and a public key e satisfying an equation ed -k p 2 -1 q 2 -1 = 1. We apply continued fractions and Coppersmith's technique to solve the general equation ex -p 2 -1 q 2 -1 y = z with suitably small parameters. Any solution of the equation will be used to break the scheme.

New Attack on RSA and Demytko's Elliptic Curve Cryptosystem with Emmanuel Fouotsa Submitted to Mathematics in Computer Science

In this paper, we study the elliptic curve scheme of Demytko. This system uses an RSA modulus N and an elliptic curve on the ring Z/N Z. The public key satisfies a variant equation of the RSA equation. We show that, under some conditions on the unknown parameters of the equation, on can solve the equation and break the system. The attack is based on Coppersmith's method and the elliptic method for factoring ECM.

Appendix M: Lattice Attacks on the DGHV Homomorphic Encryption Scheme with Tajjeeddine Rachidi Submitted to Discrete Applied Mathematics In this paper, we study the somewhat homomorphic encryption scheme of van Dijk, Gentry, Halevi, and Vaikuntanathan. We consider a set of m public ciphers c i = pq i + r i , i = 1, • • • , m where p is a private prime number and q i , r i are private integers. We propose two lattice based attacks to retrieve all the parameters when some suitable conditions are fulfilled.

A.1 Introduction

The RSA cryptosystem invented by Rivest, Shamir and Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] in 1978 is today's most important public-key cryptosystem. The security of RSA depends on mainly two primes p, q of the same bit-size and two integers e, d satisfying ed ≡ 1 (mod (p -1)(q -1)). Throughout this paper, we label the primes so that q < p < 2q. The RSA modulus is given by N = pq and Euler's totient function is φ(N ) = (p -1)(q -1). The integer e is called the public (or encrypting) exponent and d is called the private (or decrypting) exponent.

To reduce the decryption time or the signature-generation time, one may wish to use a short secret exponent d. This was cryptanalysed by Wiener [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] in 1990 who showed that RSA is insecure if d < 1 3 N 0.25 . Wiener's method is based on continued fractions. These results were extended by Boneh and Durfee [17] in 1999 to d < N 0.292 . The method of Boneh and Durfee is based on Coppersmith's results for finding small solutions of modular polynomial equations [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF]. In 2004, Blömer and May [13] presented a generalization of Wiener's attack by combining continued fractions and Coppersmith's method. They showed that RSA is insecure for every (N, e) satisfying ex + y ≡ 0 (mod φ(N )) with x < 1 3 N 1/4 and |y| = O N -3/4 ex . In this paper, we present another generalization of Wiener's attack. Our method combines continued fractions, integer partial factorization, integer relation detection algorithms and Coppersmith's method. Let us introduce the polynomial

ψ(u, v) = (p -u)(q -v).
Observe that ψ(1, 1) = (p -1)(q -1) = φ(N ), so ψ could be seen as a generalization of Euler's function. We describe an attack on RSA that works for all public exponents e satisfying

eX -ψ(u, v)Y = 1, (A.1) with integers X, Y , u, v such that 1 ≤ Y < X < 2 -1 4 N 1 4 , |u| < N 1 4 , v = - qu p -u ,
with the extra condition that all prime factors of p-u or q-v are less than the Elliptic Curve Method of Factoring smoothness bound B ecm = 10 50 . Here and throughout this paper, we let [x] and x denote the nearest integer to the real number x and the fractional part of x.

Observe that when u = 1, we get v = -1 and rewriting (A.1) as

eX -(p -1)(q + 1)Y = 1,
a variant of Wiener's attack enables us to compute p and q without assuming any additional condition on the prime divisors of p -1 nor q + 1.

Our new method works as follows: We use the Continued Fraction Algorithm (see e.g. [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF], p. 134) to find the unknowns X and Y among the convergents of e N . Then we use Lenstra's Elliptic Curve Factorization Method (ECM) [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] to partially factor eX-1 Y . Afterwards, we use an integer relation detection algorithm (notably LLL [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] or PSLQ [START_REF] Ferguson | A polynomial time, numerically stable integer relation algorithm[END_REF]) to find the divisors of the B ecm -smooth part of eX-1 Y in a short interval. Finally, we show that a method due to Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] can be applied. Moreover, we show that the number of keys (N, e) for which our method works is at least N 1 2 -ε . Organization of the paper. Section 2 presents well known results from number theory that we use. After presenting some useful lemmas in Section 3, and some properties of ψ in Section 4, we present our attack in Section 5 and in Section 6, we show that the number of keys (N, e) for which our method works is lower bounded by N 1 2 -ε . We briefly conclude the paper in Section 7.

A.2 Preliminaries

A.2.1 Continued fractions and Wiener's attack

The continued fraction expansion of a real number ξ is an expression of the form ξ = a 0 + 1

a 1 + 1 a 2 + 1 a 3 + • • •
where a 0 ∈ Z and a i ∈ N-{0} for i ≥ 1. The numbers a 0 , a 1 , a 2 , • • • are called the partial quotients. As usual, we adopt the notation ξ = [a 0 , a 1 , a 2 , • • • ]. For i ≥ 0, the rationals r i s i = [a 0 , a 1 , a 2 , • • • , a i ] are called the convergents of the continued fraction expansion of ξ. If ξ = a b is rational with gcd(a, b) = 1, then the continued fraction expansion is finite and the Continued Fraction Algorithm (see [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF], p. 134) finds the convergents in time O((log b) 2 ). We recall a result on diophantine approximations (see Theorem 184 of [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]).

Theorem A.2.1. Suppose gcd(a, b) = gcd(x, y) = 1 and a b - x y < 1 2y 2 .
Then x y is one of the convergents of the continued fraction expansion of a b .

Let us recall Wiener's famous attack on RSA with N = pq and q < p < 2q. The idea behind Wiener's attack on RSA [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] with small secret exponent d is that for d < 1 3 N 1/4 , the fraction e/N is an approximation to k/d and hence, using Theorem A.2.1, k/d can be found from the convergents of the continued fraction expansion of e/N . Wiener's attack works as follows. Since ed -kφ(N ) = 1 with φ(N ) = N -(p + q -1) and p + q -1 < 3 √ N then kN -ed = k(p + q -1) -1. Therefore,

k d - e N = |k(p + q -1) -1| N d < 3k √ N N d . Now, assume that d < 1 3 N 1/4 . Since kφ(N ) = ed -1 < ed and e < φ(N ), then k < d < 1 3 N 1/4 . Hence k d - e N < N 3/4 N d = 1 dN 1/4 < 1 2d 2 .
From Theorem A.2.1, we know that k/d is one of the convergents of the continued fraction expansion of e/N .

A.2.2 Coppersmith's method

The problem of finding small modular roots of a univariate polynomial has been extensively studied by Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF], Howgrave-Graham [START_REF] Howgrave-Graham | Finding small roots of univariate modular equations revisited[END_REF], May [START_REF] May | New RSA Vulnerabilities Using Lattice Reduction Methods[END_REF] and others. Let f (x) be a monic univariate polynomial with integer coefficients of degree δ. Let N be an integer of unknown factorization and B = N 1/δ . The problem is to find all integers x 0 such that |x 0 | < B and f (x 0 ) ≡ 0 (mod N ). In 1997, Coppersmith presented a deterministic algorithm using 2 δ log N O (1) bit operations to solve this problem. The algorithm uses lattice reduction techniques, and as an application, the following theorem was proved (see also [START_REF] May | New RSA Vulnerabilities Using Lattice Reduction Methods[END_REF], Theorem 11).

Theorem A.2.2. Let N = pq be an RSA modulus with q < p < 2q. Given an approximation p of p with |p -p| < N 1 4 , N can be factored in time polynomial in log N .

A.2.3 Smooth numbers

A few words about notation: let f and g be functions of x. The notation f g denotes that f (x)/g(x) is bounded above and below by positive numbers for large values of x. The notation f = O(g) denotes that ∃c such that f (x) ≤ cg(x). The notation f ∼ g denotes that lim x→∞ f (x)

g(x) = 1.
Let y be a positive constant. A positive number n is y-smooth if all prime factors of n are less than y. As usual, we use the notation Ψ(x, y) for the counting function of the y-smooth numbers in the interval [1, x], that is,

Ψ(x, y) = # {n : 1 ≤ n ≤ x, n is y-smooth} .
The ratio Ψ(x, y)/[x] may be interpreted as the probability that a randomly chosen number n in the interval [1, x] has all its prime factors less than y. The function Ψ(x, y) plays a central role in the running times of many integer factoring and discrete logarithm algorithms, including the Elliptic Curve Method (ECM) [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] and the number field sieve method (NFS) [START_REF] Lenstra | The number field sieve[END_REF]. Let ρ(u) be the Dickman-de Bruijn function (see [START_REF] Granville | Smooth numbers: computational number theory and beyond[END_REF]). In 1986, Hildebrand [START_REF] Hildebrand | On the number of positive integers ≤ x and free of prime factors >[END_REF] showed that

Ψ(x, y) = xρ(u) 1 + O log(u + 1) log y where x = y u (A.2)
holds uniformly in the range y > exp (log log x) 5/3+ε . Studying the distribution in short intervals of integers without large prime factors, Friedlander and Granville [START_REF] Friedlander | Smoothing "Smooth" Numbers[END_REF] showed that

Ψ(x + z, y) -Ψ(x, y) ≥ c z x Ψ(x, y), (A.3)
in the range x ≥ z ≥ x 1 2 +δ , x ≥ y ≥ x 1/γ and x is sufficiently large where δ and γ are positive constants and c = c(δ, γ) > 0.

In order to study the distribution of divisors of a positive integer n, Hall and Tenenbaum [START_REF] Hall | Divisors. Cambridge Tracts in Mathematics[END_REF] studied the counting function

U (n, α) = # (d, d ) : d|n, d |n, gcd(d, d ) = 1, log d d < (log n) α , (A.4)
where α is a real number. They proved that for any fixed α < 1 and almost all n,

U (n, α) ≤ (log n) log 3-1+α+o(1) , (A.5)
where the o(1) term tends to 0 as n tends to +∞.

A.2.4 ECM

The Elliptic Curve Method (ECM) was originally proposed by Lenstra [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] in 1984 and then extended by Brent [START_REF] Brent | Some integer factorization algorithms using elliptic curves[END_REF] and Montgomery [START_REF] Montgomery | Speeding the Pollard and elliptic curve methods of factorization[END_REF]. It is suited to find small prime factors of large numbers. [START_REF] Zimmermann | 50 largest factors found by ECM[END_REF]). According to Brent's formula [START_REF] Brent | Recent progress and prospects for integer factorisation algorithms[END_REF] √ D = (Y -1932.3)/9.3 where D is the number of decimal digits in the largest factor found by ECM up to a given date Y , a 70-digit factor could be found by ECM around 2010.

In Table 1, we give the running times obtained on a Intel(R) Pentium(R) 4 CPU 3.00 GHz to factor an RSA modulus N = pq of size 2n bits with q < p < 2q with ECM, using the algebra system Pari-GP [125].

Extrapolating Table 1

A.3 Useful lemmas

In this section we prove three useful lemmas. We begin with a simple lemma fixing the sizes of the prime factors of the RSA modulus.

Lemma A.3.1. Let N = pq be an RSA modulus with q < p < 2q. Then

2 -1 2 N 1 2 < q < N 1 2 < p < √ 2N 1 2 .
Proof. Assume q < p < 2q. Multiplying by p, we get N < p 2 < 2N or equivalently N

1 2 < p < √ 2N 1 2 . Since q = N p , we obtain 2 -1 2 N 1 2 < q < N 1 2
and the lemma follows.

Our second lemma is a consequence of Theorem A.2.2 and Lemma A.3.1.

Lemma A.3.2. Let N = pq be an RSA modulus with q < p < 2q. Suppose |u| < N

1 4 . If p -u < N 1 2 or p -u > √ 2N 1 2
, then the factorization of N can be found in polynomial time.

Proof. Assume q < p < 2q and |u| < N It follows that p = N 1 2 is an approximation of p with 0 < p -p < N 1 4 . By Theorem A.2.2, we deduce that the factorization of N can be found in polynomial time.

Similarly, if p -u > √ 2N 1 2 , then p > √ 2N 1 2 + u > √ 2N 1 2 -N 1 4 and using Lemma A.3.1, we get √ 2N 1 2 > p > √ 2N 1 2 -N 1 4
. 4 . Again, by Theorem A.2.2, we conclude that the factorization of N can be found in polynomial time.

It follows that p = √ 2N 1 2 satisfies 0 > p -p > -N 1
Our third lemma is a consequence of the Fermat Factoring Method (see e.g. [START_REF] Weger | Cryptanalysis of RSA with small prime difference[END_REF]). We show here that it is an easy consequence of Theorem A.2.2 and Lemma A.3.1.

Lemma A.3.3. Let N = pq be an RSA modulus with q < p < 2q. If p -q < N 1 4 , then the factorization of N can be found in polynomial time.

Proof. Assume q < p < 2q and p -q < N 1 4 . Combining with Lemma A.3.1, we get

N 1 2 < p < q + N 1 4 < N 1 2 + N 1 4 .
It follows that p = N 1 2 is an approximation of p with 0 < p -p < N 1 4 . By Theorem A.2.2, we conclude that the factorization of N can be found in polynomial time.

A.4 Properties of ψ(u, v)

Let N = pq be an RSA modulus with q < p < 2q. The principal object of investigation of this section is the polynomial ψ(u, v) = (p -u)(q -v) when p and q are fixed.

Lemma A.4.1. Let u be an integer with |u| < N

1 4 . Put v = -qu p-u . Then |ψ(u, v) -N | < 2 -1 2 N 1 2 .
Proof. Since v is the nearest integral value to -qu p-u , then

- 1 2 ≤ - qu p -u -v < 1 2 . Hence q + qu p -u - 1 2 ≤ q -v < q + qu p -u + 1 2 .
Multiplying by p -u, we get

N - 1 2 (p -u) ≤ (p -u)(q -v) < N + 1 2 (p -u). It follows that |(p -u)(q -v) -N | ≤ 1 2 (p -u). Since |u| < N 1 4 , then by Lemma A.3.2, we can assume p -u < √ 2N 1 2 and we obtain |(p -u)(q -v) -N | ≤ 2 -1 2 N 1 2 .
This completes the proof.

Lemma A.4.2. Let u be an integer with |u| < N

1 4 . Set v = -qu p-u . Then |v| ≤ |u|.
Proof. Assume q < p < 2q and |u| < N 1 4 . By Lemma A.3.3, we can assume that p -q > N 1 4 . Then u < N 1 4 < p -q, and q < p -u. Hence

|v| = q|u| p -u ≤ q|u| p -u + 1 2 < |u| + 1 2 .
Since u and v are integers, then |v| ≤ |u| and the lemma follows.

Lemma A.4.3. Let u, u , be integers with |u|, |u | < N

1 4 . Define v = - qu p -u and v = - qu p -u . If v = v , then |u -u| ≤ 1.
Proof. Suppose v = v. Then, from the definitions of v and v , we obtain

qu p -u - qu p -u < 1,
Transforming this, we get

|u -u| < (p -u)(p -u ) N . By Lemma A.3.3 we can assume that p -u < √ 2N 1 2 and p -u < √ 2N 1 2 . Then |u -u| < √ 2N 1 2 2 N = 2.
Since u and u are integers, the lemma follows.

Lemma A.4.4. Let u, u , be integers with |u|, |u | < N 1 4 . Define v = - qu p -u and v = - qu p -u . If ψ(u, v) = ψ(u , v ), then u = u . Proof. Assume that ψ(u, v) = ψ(u , v ), that is (p-u)(q -v) = (p-u )(q -v ). If v = v , then p -u = p -u and u = u . Next, assume for contradiction that v = v . Without loss of generality, assume that u > u . Put ψ = ψ(u, v) = ψ(u , v
) and let U (ψ, α) as defined by (A.4), i.e.

U (ψ, α) = # (d, d ) : d|ψ, d |ψ, gcd(d, d ) = 1, log d d < (log ψ) α . Let g = gcd(p -u, p -u ), d = p-u g and d = p-u g . Hence gcd(d, d ) = 1. We have d d = p -u p -u = 1 - u -u p -u . By Lemma A.3.2, we can assume that p -u > N 1 4 . For N > 2 8 we have 0 < u -u p -u < 2N 1 4 N 1 2 = 2N -1 4 < 1 2 . Using that | log(1 -x)| < 2x holds for 0 < x < 1 2 this yields log d d = log 1 - u -u p -u < 2 × u -u p -u < 2 √ 2N -1 4 = (log ψ) α , where α = log 2 √ 2N -1 4 log(log(ψ)) .
It follows that U (ψ, α) ≥ 1. On the other hand, we have

α = log 2 √ 2N -1 4 log(log(ψ)) ≤ log 2 √ 2N -1 4 log log N -2 -1 2 N 1 2 < 1 -log 3,
where we used Lemma A.4.1 in the medium step and N > 2 7 in the final step. Using the bound (A.5), we have actually 1) , where δ = log 3 -1 + α < 0 and we deduce U (ψ, α) = 0, a contradiction. Hence v = v , u = u and the lemma follows.

U (ψ, α) ≤ (log ψ) log 3-1+α+o(1) ≤ (log N ) δ+o(
Lemma A.4.5. Let u, u be integers with |u|, |u | < N

1 4 . Define v = - qu p -u and v = - qu p -u . Assume that ψ(u, v) < ψ(u , v ). Let [a 0 , a 1 , a 2 , • • • ] be the continued fraction expansion of ψ(u,v) ψ(u ,v ) . Then a 0 = 0, a 1 = 1 and a 2 > 2 -1 2 N 1 2 -1 2 .
Proof. Let us apply the continued fraction algorithm (see e.g. of [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF], p. 134). Assuming ψ(u, u) < ψ(u , v ), we get

a 0 = ψ(u, v) ψ(u , v ) = 0.
Next, we have

a 1 = 1 ψ(u,v) ψ(u ,v ) -a 0 = ψ(u , v ) ψ(u, v) . By Lemma A.4.1, we have 0 < ψ(u , v ) -ψ(u, v) ≤ |ψ(u, v) -N | + |ψ(u , v ) -N | < √ 2N 1 2 . (A.6)
Combining this with Lemma A.4.1, we get

0 < ψ(u , v ) ψ(u, v) -1 = ψ(u , v ) -ψ(u, v) ψ(u, v) < √ 2N 1 2 ψ(u, v) < √ 2N 1 2 N -2 -1 2 N 1 2 < 1.
From this, we deduce a 1 = 1. Finally, combining (A.6) and Lemma A.4.1, we get

a 2 = 1 ψ(u ,v ) ψ(u,v) -a 1 = ψ(u, v) ψ(u , v ) -ψ(u, v) > N -2 -1 2 N 1 2 √ 2N 1 2 = 2 -1 2 N 1 2 - 1 2 .
This completes the proof.

A.5 The new attack

In this section we state our new attack. Let N = pq be an RSA modulus with q < p < 2p. Let e be a public exponent satisfying an equation eX -

ψ(u, v)Y = 1 with integers X, Y , u, v such that 1 ≤ Y < X < 2 -1 4 N 1 4 , |u| < N 1 4 , v = - qu p -u ,
and with the condition that all prime factors of p -u or q -v are ≤ B ecm = 10 50 . Our goal is to solve this equation. As in Wiener's approach, we use the continued fraction algorithm to recover the unknown values X and Y .

Theorem A.5.1. Let N = pq be an RSA modulus with q < p < 2p. Suppose that the public exponent e satisfies an equation eX -

ψ(u, v)Y = 1 with |u| < N 1 4 , v = - qu p -u , 1 ≤ Y < X < 2 -1 4 N 1 4 .
Then Y X is one of the convergents of the continued fraction expansion of e N .

Proof. Starting with the equation eX -

ψ(u, v)Y = 1, we get eX -N Y = 1 -(N -ψ(u, v))Y. Together with Lemma A.4.1, this implies e N - Y X = |1 -(N -ψ(u, v))Y | N X ≤ 1 + |(N -ψ(u, v))| Y N X ≤ 1 + 2 -1 2 N 1 2 Y N X ≤ 2 + √ 2N 1 2 (X -1) 2N X .
Suppose we can upperbound the right-hand side term by 1 2X 2 , that is

2 + √ 2N 1 2 (X -1) 2N X < 1 2X 2 ,
then, applying Theorem A.2.1 the claim follows. Rearranging to isolate X, this leaves us with the condition

√ 2N 1 2 X 2 - √ 2N 1 2 -2 X -N < 0. It is not hard to see that the condition is satisfied if X < 2 -1 4 N 1 4
. This gives us the theorem.

Afterwards, we combine ECM, integer relation detection algorithms and

Coppersmith's method to factor N = pq.

Theorem A.5.2. Let N = pq be an RSA modulus with q < p < 2p. Let B ecm be the ECM-bound. Suppose that the public exponent e < N satisfies an equation eX -

ψ(u, v)Y = 1 with |u| < N 1 4 , v = - qu p -u , 1 ≤ Y < X < 2 -1 4 N 1 4 .
If p -u or q -v is B ecm -smooth, then we can efficiently factor N .

Proof. By Theorem A.5.1 we know that X and Y can be found among the convergents of the continued expansion of e N . From X and Y , we get

ψ(u, v) = (p -u)(q -v) = eX -1 Y . Without loss of generality, suppose that p -u is B ecm -smooth. Using ECM, write eX-1 Y = M 1 M 2 where M 1 is B ecm -smooth. Let ω(M 1
) denote the number of distinct prime factors of M 1 . Then the prime factorization of M 1 is of the form

M 1 = ω(M 1 ) i=1 p a i i ,
where the a i ≥ 1 are integers and the p i are distinct primes ≤ B ecm . Since

p -u is B ecm -smooth, then p -u a divisor of M 1 , so that p -u = ω(M 1 ) i=1 p x i i , (A.7)
where the x i are integers satisfying 0 ≤ x i ≤ a 1 . By Lemma A.3.2, we can assume that N

1 2 < p -u < √ 2N 1 2
. Combining this with (A.7) and taking logarithms, we get

0 < ω(M 1 ) i=1 x i log p i - 1 2 log N < 1 2 log 2. (A.8)
These inequalities are related to Baker's famous theory of linear forms in logarithms [7] and can be formulated as a nearly closest lattice problem in the 1-norm. They can be solved using the LLL [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] or the PSLQ algorithm [START_REF] Ferguson | A polynomial time, numerically stable integer relation algorithm[END_REF].

The complexity of LLL and PSLQ depends on ω(M 1 ). Since Hardy and Ramanujan (see e.g.Theorem 431 of [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]), we know that, in average,

ω(M 1 ) ∼ log log M 1 if M 1 is uniformly distributed. Since X < 2 -1 4 N 1 4 , we have for e < N M 1 ≤ eX -1 Y < eX Y ≤ eX < N 5 4 ,
This implies that the number of primes dividing M 1 satisfies

ω(M 1 ) ∼ log log M 1 ∼ log log N.
Next, let us investigate the number of solutions of (A.8) which is related to the number of divisors of M 1 . Let τ (M 1 ) denote the number of positive divisors of M 1 . The prime decomposition of M 1 gives the exact value

τ (M 1 ) = ω(M 1 ) i=1 (1 + a i ).
By Dirichlet's Theorem, we know that if M 1 is uniformly distributed, then the average order of τ (M 1 ) is log M 1 (see Theorem 319 of [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]). It follows that the average number of divisors of M 1 is

τ (M 1 ) ∼ log(M 1 ) ∼ log(N ).
This gives in average the number of solutions to the inequalities (A.8).

Next, let D be a divisor of M 1 satisfying (A.8). If D is a good candidate for p -u with |u| < N 1 4 , then applying Theorem A.2.2, we get the desired factor p. This concludes the theorem.

Notice that the running time is dominated by ECM since every step in our attack can be done in polynomial time and the number of convergents and divisors are bounded by O(log N ).

Next, we deal with the situation when an exponent e is defined by different tuples (u, X) and (u , X ) with u = u and v = v . Lemma A.6.2. Let N = pq be an RSA modulus with q < p < 2p. Let u, u be integers with |u|, |u | < N

1 4 . Let X, X be integers with 1 ≤ X, X < 2 -1 4 N 1 4 , gcd(X, ψ(u, v)) = 1, gcd(X , ψ(u , v )) = 1 where v = -qu p-u and v = -qu p-u . Define e ≡ X -1 (mod ψ(u, v)
) and e ≡ X -1 (mod ψ(u , v )).

If v = v and e = e , then X = X and u = u .

Proof. As in the proof of Lemma A.6.1, rewrite e and e as

e = 1 + ψ(u, v)Y X and e = 1 + ψ(u , v )Y X .
Suppose e = e . Then

|ψ(u , v )XY -ψ(u, v)X Y | = |X -X|. (A.10) Assuming v = v and using ψ(u, v) = (p -u)(q -v), ψ(u , v ) = (p -u )(q -v) in (A.10), we get (q -v) |(p -u )XY -(p -u)X Y | = |X -X|. By Lemma A.2.2, we have q -v > 2 -1 2 N 1 2 -N 1 4 > N 1 4 and since |X -X| < 2 -1 4 N 1 4 , we get X -X = 0, (p -u )XY -(p -u)X Y = 0. Hence X = X and (p -u )Y = (p -u)Y . Suppose for contradiction that u = u. Put g = gcd(p -u , p -u). Then g divides (p -u) -(p -u ) = u -u. Since v = v , by Lemma A.4.3 we have |u -u| ≤ 1, so g = 1. Hence gcd(p -u , p -u) = 1 and p -u divides Y . Since p -u > N 1 2 and Y < X < 2 -1 4 N 1 4
, this leads to a contradiction, so we deduce that u = u. This terminates the proof.

Using the methods used to prove Lemma A.6.1 and Lemma A.6.2 plus some additional arguments, we shall prove the following stronger result.

Theorem A.6.3. Let N = pq be an RSA modulus with q < p < 2p. Let u, u be integers with |u|, |u | < N

1 4 . Let X, X be integers with 1 ≤ X, X < 2 -1 4 N 1 4 , gcd(X, ψ(u, v)) = 1, gcd(X , ψ(u , v )) = 1 where v = -qu p-u and v = -qu p-u . Define e ≡ X -1 (mod ψ(u, v)) and e ≡ X -1 (mod ψ(u , v ))
.

If e = e , then u = u , v = v and X = X .
Proof. Assume that e = e . Then, as in the proof of Lemma A.6.2, e and e satisfy (A.10). We first take care of some easy cases.

If u = u , then v = v and by Lemma A.6.1, we get X = X .

If v = v , then by Lemma A.6.2, we get u = u and X = X .

Without loss of generality, suppose that ψ(u, v) < ψ(u , v ). Transforming (A.10), we get

XY X Y - ψ(u, v) ψ(u , v ) = |X -X| X Y ψ(u , v ) ≤ max(X , X) X Y ψ(u , v ) < 1 2(X Y ) 2 ,
where the final step is trivial since, for

N ≥ 2 10 2 max(X , X)X Y < 2 × 2 -1 4 N 1 4 3 < N -2 -1 2 N 1 2 < ψ(u , v ).
Combined with Theorem A.2.1, this implies that XY X Y is one of the convergents of the continued fraction expansion of ψ(u,v) ψ(u ,v ) . By Lemma A.4.5, the first non trivial convergents are 1 1 and a 2 a 2 +1 where a

2 > 2 -1 2 N 1 2 -1 2 . Observe that a 2 + 1 > 2 -1 2 N 1 2 - 1 2 + 1 = 2 -1 2 N 1 2 + 1 2 > 2 -1 2 N 1 2 = 2 -1 4 N 1 4 2 > X Y.
This implies that the only possibility for XY X Y to be a convergent of

ψ(u,v) ψ(u ,v ) is 1 1 . This gives XY = X Y . Since gcd(X, Y ) = gcd(X , Y ) = 1 then X = X and Y = Y .
Replacing in (A.10), we get ψ(u , v ) = ψ(u, v) and by Lemma A.4.4, we deduce u = u . This completes the proof.

We now determine the order of the cardinality of the set H(N ). Recall that the elements of H(N ) are uniquely defined by the congruence e ≡ X -1 (mod ψ(u, v)),

where |u| < N 1 4 , v = -qu p-u , 1 ≤ X < 2 -1 4 N 1 4
and gcd(X, ψ(u, v)) = 1. In addition, p -u is B ecm -smooth.

Theorem A.6.4. Let N = pq be an RSA modulus with q < p < 2p. We have

#H(N ) ≥ N 1 2 -ε ,
where ε is a small positive constant.

Proof. Assume B ecm < p -p 1 2 . Let us consider the set V (p) as defined by (A.9). Put

x = p -p 1 2 , z = 2p 1 2 and y = B ecm . Define δ > 0 and γ > 0 such that x 1 2 +δ ≤ z, y = x 1/γ . Then x ≥ z ≥ x 1 2 +δ , x ≥ y ≥ x 1/γ
and the conditions to apply (A.3) are fulfilled. On the other hand, we have y > exp (log log x) 5/3+ε for x < exp 10 7-ε and the condition to apply (A.2) is fulfilled. Combining (A.3) and (A.2), we get

#V (p) = Ψ(x+z, y)-Ψ(x, y) ≥ c z x Ψ(x, y) = czρ (γ) 1 + O log (γ + 1) log(y) ,
where c = c(δ, γ) > 0 and ρ (γ) is the Dickman-de Bruijn ρ-function (see Table 2). Hence #

V (p) ≥ cρ (γ) z = 2cρ (γ) p 1 2 . Since trivially #V (p) < z = 2p 1 2 , we get #V (p) p 1 2 . Combining this with Table 2, we conclude that #V (p) is lower bounded as follows #V (p) ≥ p 1 2 -ε = N 1 4 -ε 1 ,
with small constants ε > 0 and ε 1 > 0.

Next, for every integer u with |u| < N where µ(.) is the Möbius function and φ(.) is the Euler totient function. We shall need the well known result (see Theorem 328 of [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]),

1 4 put W (u) = X : 1 ≤ X < 2 -1 4 N 1 4 , (X, ψ(u, v)) = 1 , where v = -qu p-u . Setting m = 2 -1 4 N 1 4 , we have #W (u) = m X=1 (X,ψ(u,v))=1 1 = d|ψ(u,v) µ(d) m d ≥ m d|ψ(u,v) µ(d) d = mφ(ψ(u, v)) ψ(u, v)
φ(n) n ≥ C log log n ,
where C is a positive constant. Applying this with n = ψ(u, v) and using Lemma A.4.1, we get

#W (u) ≥ Cm log log ψ(u, v) ≥ 2 -1 4 CN 1 4 log log N + 2 -1 2 N 1 2 = N 1 4 -ε 2 ,
with a small constant ε 2 > 0.

It remains to show that #H(n) ≥ N 1 4 -ε where ε is a positive constant. Indeed, for every u ∈ V (p) there are at least N

1 4 -ε 2 integers X ∈ W (u). Hence #H(n) ≥ #V (p)#W (u) ≥ N 1 2 -ε 1 -ε 2 . Setting ε = ε 1 + ε 2 ,
this completes the proof of the theorem.

A.7 Conclusion

Wiener's famous attack on RSA with d < 1 3 N 0.25 shows that using the equation ed -k(p -1)(q -1) = 1 and a small d makes RSA insecure. In this paper, we performed a generalization of this attack. We showed that we can find any X and Y with 1 ≤ Y < X < 2 -0.25 N 0.25 from the continued fraction expansion of e/N when they satisfy an equation

eX -Y (p -u) q + qu p -u = 1,
and if p -u or q + [qu/(p -u]) is smooth enough to factor, then p and q can be found from X and Y . Our results illustrate that one should be very cautious when choosing some class of RSA exponent. Note that our attack, as well as all the attacks based on continued fractions do not apply to RSA with modulus N and small public exponents as the popular values e = 3 or e = 2 16 + 1 because the non-trivial convergents of e N are large enough to use diophantine approximation techniques, namely Theorem A.2.1.

B.1 Introduction

The RSA public-key cryptosystem [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] was invented by Rivest, Shamir, and Adleman in 1978. Since then, the RSA system has been the most widely accepted public key cryptosystem. In the RSA cryptosystem, the modulus N = pq is a product of two primes of equal bit-size. Let e be an integer coprime with φ(N ) = (p -1)(q -1), the Euler function of N . Let d be the integer solution of the equation ed ≡ 1 (mod φ(N )) with d < φ(N ). We call e the public exponent and d the private exponent. The pair (N, e) is called the public key and the pair (N, d) is the corresponding private key.

RSA is computationally expensive as it requires exponentiations modulo the large RSA modulus N . For efficient modular exponentiation in the decryption/signing phase, one may be tempted to choose a small d. Unfortunately, Wiener [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] showed in 1990 that using continued fractions, one can efficiently recover the secret exponent d from the public key (N, e) as long as d < 1 3 N 1 4 . Wiener's attack is based on solving the equation ex -φ(N )y = 1 where x < 1 3 N 1 4 . Since then, attacking RSA using information encoded in the public key (N, e) has been a stimulating area of research.

Based on the lattice basis reduction, Boneh and Durfee [17] proposed in 1999 a new attack on the use of short secret exponent d, namely, they improved the bound to d < N 0.292 .

In 2004, Blömer and May [13] showed that N can be factored in polynomial time for every public key (N, e) satisfying an equation ex -

(N + 1 - (p + q))k = y, with x < 1 3 N 1 4
and |y| < N -3 4 ex. Another attack using information encoded in (N, e) was recently proposed by Nitaj in [START_REF] Nitaj | Another generalization of Wiener's attack on RSA[END_REF]. The idea of [START_REF] Nitaj | Another generalization of Wiener's attack on RSA[END_REF] is based on solving the equation satisfied by the public exponent e. Suppose e satisfies an equation eX

-(p -u)(q -v)Y = 1 with 1 ≤ Y ≤ X < 2 -1 4 N 1 4 , |u| < N 1 4 and v = -qu p-u .
If the prime factors of p -u or q -v are less than 10 50 , then N can be factored efficiently.

In this paper, we propose new attacks on RSA. Let N = pq be an RSA modulus with q < p < 2q. Let a b be an unknown convergent of the continued fraction expansion of q p . Define α such that ap + bq = N 1 2 +α with 0 < α < 1 2 . We focus on the class of the public exponents satisfying an equation

eX -(N -(ap + bq))Y = Z, with small parameters X, Y , Z satisfying 1 ≤ Y ≤ X < 1 2 N 1 4 -α 2 , gcd(X, Y ) = 1,
and Z depends on the size of |ap -bq|. We present three attacks according to the size of the difference |ap -bq|. The first attack concerns small difference, i.e. |ap-bq| < (abN )

1 4 , the second attack will work for medium difference, i.e. (abN )

1 4 < |ap -bq| < aN 1 4
, and the third attack concerns large difference, i.e. |ap -bq| > aN 1 4 . The first attack always lead to the factorization of N . The second and the third attacks work if, in addition, b ≤ 10 52 . This corresponds to the current limit of the Elliptic Curve Method [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] to find large factors of integers.

The attacks combine techniques from the theory of continued fractions, Coppersmith's method [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] for finding small roots of bivariate polynomial equations and the Elliptic Curve Method [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] for Integer Factorization. We also show that the set of exponents e for which our approach works is at least N 3 4 -ε where ε is a small positive constant depending only on N .

Our approach is more efficient if q p is close to a b with small integers a and b. This is a step in the direction of the recommendations of the X9.31-1997 standard for public key cryptography (Section 4.1.2) which requires that the ratio of the primes shall not be close to the ratio of small integers. It is important to notice that, since q < p < 2q, then 0 1 and 1 1 are among the convergents of the continued fraction expansion of q p (see Section 2). For

a = 0, b = 1, the equation eX -(N -(ap + bq))Y = Z becomes eX -q(p -1)Y = Z.
and was studied by Nitaj [START_REF] Nitaj | Another generalization of Wiener's attack on RSA[END_REF] with suitably small parameters X, Y , Z. Consequently, in this paper, we focus on the convergents a b with a ≥ 1. For a = b = 1, our third attack applies and matches the attack of Blömer and May [13].

The rest of the paper is organized as follows. In Section 2 we give a brief introduction to continued fractions, Coppersmith's lattice-based method for finding small roots of polynomials [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] and the Elliptic Curve Method of Factorization. In Section 3 we study the properties of the convergents of the continued fraction expansion of the ratio of the primes of N = pq. In Section 4 we present the new attacks. In Section 5, we give an estimate for the size of the set of the public exponents for which our attacks work. Section 6 concludes the paper.

B.2 Preliminaries on Continued Fractions, Coppersmith's Method and The Elliptic Curve Method (ECM)

We first introduce some notation. The integer closest to x is denoted [x] and the largest integer less than or equal to x is denoted x .

B.2.1 Continued Fractions and the Euclidean Algorithm

We briefly recall some basic definitions and facts that we use about continued fractions and the Euclidean algorithm, which can be found in [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF].

The process of finding the continued fraction expansion of a rational number q p involves the same series of long divisions that are used in the application of the Euclidean algorithm to the pair of integers (q, p). Starting with r -2 = q and r -1 = p, define the recursions

a i = r i-2 r i-1 , r i = r i-2 -a i r i-1 , i ≥ 0, (B.1)
where a i is the integer quotient r i-2 /r i-1 and r i is the integer remainder that satisfies 0 ≤ r i < r i-1 . The Euclidean algorithm terminates with a series of remainders satisfying

0 = r m < r m-1 < • • • < r 2 < r 1 < r 0 < r -1 = p.

B.2. PRELIMINARIES ON CONTINUED FRACTIONS, COPPERSMITH'S METHOD AND THE ELLIPTIC C

The continued fraction expansion of q p is then q p = a 0 + 1

a 1 + 1 a 2 + 1 • • • + 1 a m , or alternatively, q p = [a 0 , a 1 , • • • , a m ]. The rational number [a 0 , a 1 , • • • , a i ] with 0 ≤ i ≤ m is called the i-th convergent of q p and satisfies [a 0 , a 1 , • • • , a i ] = p i q i ,
where the integers p i and q i are coprime positive integers. Note that the integers p i and q i are also defined by the double recursions

p -2 = 0, p -1 = 1, p i = a i p i-1 + p i-2 , i ≥ 0, (B.2) q -2 = 1, q -1 = 0, q i = a i q i-1 + q i-2 , i ≥ 0. (B.3)
Since q < p < 2q, we have q p < 1 and taking i = 0 in (B.1), (B.2) and (B.3), we get

a 0 = r -2 r -1 = q p = 0, r 0 = q, p 0 = 0, q 0 = 1.
Similarly, we have 1 < p q < 2 and taking i = 1 in (B.1), (B.2) and (B.3), we get

a 1 = r -1 r 0 = p q = 1, p 1 = 1, q 1 = 1.
From this we deduce that the first convergents of the continued fraction expansion of q p are 0 1 and

1 1 . Proposition B.2.1. Let q p = [a 0 , a 1 , • • • , a m ] be a continued fraction. For 0 ≤ i < m, we have q p - p i q i < 1 q 2 i .
We terminate with a famous result on good rational approximations.

Theorem B.2.2. Let q p = [a 0 , a 1 , • • • , a m ].
If a and b are coprime positive integers such that b < p and

q p - a b < 1 2b 2 ,
then a = p i and b = q i for some i with 0 ≤ i ≤ m.

B.2.2 Coppersmith's Method

At Eurocrypt'96, Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] Let n = xy be the product of two unknown integers such that x < y < 2x. Given an approximation of y with additive error at most n 1 4 , then x and y can be found in polynomial time.

B.2.3 The Elliptic Curve Method of Factorization

The difficulty of factoring a large number is an element of the security of the RSA system. In the recent years, the limits of the best factorization algorithms have been extended greatly. There are two classes of algorithms for finding a nontrivial factor p of a composite integer n. The algorithms in which the run time depends on the size of n: Lehman's algorithm [START_REF] Lehman | Factoring large integers[END_REF], the Continued Fraction algorithm [START_REF] Morrison | A method of factoring and the factorization of F7[END_REF], the Multiple Polynomial Quadratic Sieve algorithm [START_REF] Silverman | The multiple polynomial quadratic sieve[END_REF], the Number Field Sieve [START_REF] Lenstra | The number field sieve[END_REF]. And the algorithms in which the run time depends on the size of p: Trial Division, Pollard's "rho" algorithm [START_REF] Pollard | A Monte Carlo method for factorization[END_REF], Lenstra's Elliptic Curve Method [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF].

The Elliptic Curve Method (ECM for short) was originally proposed by H.W. Lenstra [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] and subsequently extended by Brent [START_REF] Brent | Some integer factorization algorithms using elliptic curves[END_REF], [START_REF] Brent | Recent progress and prospects for integer factorisation algorithms[END_REF], and Montgomery [START_REF] Montgomery | Speeding the Pollard and elliptic curve methods of factorization[END_REF]. The original part of the algorithm proposed by Lenstra is typically referred to as Phase 1, and the extension by Brent and Montgomery is called Phase 2. ECM is suited to find small factors p of large numbers n and has complexity

O exp c log p log log p M (n) ,
where c > 0 and M (n) denotes the cost of multiplication (mod n). R. Brent [START_REF] Brent | Recent progress and prospects for integer factorisation algorithms[END_REF] extrapolated that the Elliptic Curve Method record will be a Ddigit factor in year Y (D) = 9.3 √ D + 1932.3. According to this formula, Y (50) ≈ 1998 and Y (67) ≈ 2008. A table of the largest factors found using the ECM is maintained by Zimmermann [START_REF] Zimmermann | 50 largest factors found by ECM[END_REF]. The largest prime factor found using the ECM had 67 decimal digits and was found by B. Dodson on August 24, 2006.

B.3 Useful Lemmas and Properties

First we recall a very useful lemma (see [START_REF] Nitaj | Another generalization of Wiener's attack on RSA[END_REF]).

Lemma B.3.1. Let N = pq be an RSA modulus with q < p < 2q. Then

2 -1 2 N 1 2 < q < N 1 2 < p < 2 1 2 N 1 2 .
The following lemma shows that a and b are of the same bit-size.

Lemma B.3.2. Let N = pq be an RSA modulus with q < p < 2q.

If a b is a convergent of q p with a ≥ 1, then a ≤ b ≤ 2a. Proof. If b = 1, then a = 1 and the inequalities a ≤ b ≤ 2a are satisfied. Next, suppose b ≥ 2. Observe that if a b is a convergent of q p then by Proposition B.2.1 we have |ap -bq| ≤ p b ≤ p 2 .
Isolating bq and dividing by q, we get

a p q - p 2q ≤ b ≤ a p q + p 2q .
Combining this with 1 < p q < 2, we get

a - p 2q < a p q - p 2q ≤ b ≤ a p q + p 2q < 2a + p 2q .
Since p < 2q, then 0 < p 2q < 1. Hence a ≤ b ≤ 2a which completes the proof.

The following lemma plays an important role in this paper. Recall that the integer closest to x is denoted [x].

Lemma B.3.3. Let N = pq be an RSA modulus with q < p < 2q and a b a convergent of the continued fraction expansion of q p with a ≥ 1.

Let ap + bq = N 1 2 +α with α < 1 2 . If |ap + bq -M | < 1 2 N 1 2 -α , then ab = M 2 4N .
Proof. Set M = ap + bq + x. Using (ap -bq) 2 = (ap + bq) 2 -4abN , we get, after rearrangement,

M 2 -4abN = (ap + bq + x) 2 -4abN = (ap -bq) 2 + 2(ap + bq)x + x 2 . (B.4)
Consider the term (ap -bq) 2 on the right side of (B.4

). If b = 1, then by Lemma B.3.2, a = 1. Hence, since q < p < 2q, we have |ap -bq| = |p -q| = p -q < p 2 . If b ≥ 2,
(ap -bq) 2 < p 2 2 < 2 1 2 N 1 2 2 2 = N 2 .
Hence, using |x|

< 1 2 N 1 2 -α , the right side of (B.4) becomes (ap -bq) 2 + 2(ap + bq)x + x 2 ≤ (ap -bq) 2 + 2(ap + bq)|x| + x 2 < N 2 + 2N 1 2 +α • 1 2 N 1 2 -α + 1 4 N 1-2α = 1 2 + 1 + 1 4 N -2α N < 2N,
where we used α > 0. Plugging this in (B.4) and dividing by 4N , we get

M 2 4N -ab = M 2 -4abN 4N = (ap -bq) 2 + 2(ap + bq)x + x 2 4N < 2N 4N = 1 2 .
It follows that ab = M 2 4N which terminates the proof.

The following lemma indicates that ap and bq are of the same bit-size.

Lemma B.3.4. Let N = pq be an RSA modulus with q < p < 2q and a b a convergent of the continued fraction expansion of q p with a ≥ 1. Then ap < bq < 2ap or bq < ap < 2bq

Proof. First, assume ap < bq. By Lemma B.3.2, we have b ≤ 2a. Combining this with q < p, we get bq < 2ap, and consequently ap < bq < 2ap.

Next, assume bq < ap. By Lemma B.3.2, we have a ≤ b. Combining this with p < 2q, we get ap < 2bq and finally bq < ap < 2bq. This terminates the proof.

B.4 The New Attacks on RSA

In this section, we show how to factor the RSA modulus N if (N, e) is a public key satisfying an equation eX -(N -(ap + bq))Y = Z with small parameters X, Y and Z where a b is an unknown convergent of q p with a ≥ 1. We shall consider separately the cases when the difference |ap -bq| is small, i.e. |ap -bq| < (abN ) . Let e be a public exponent satisfying the equation eX -

(N -(ap + bq))Y = Z with gcd(X, Y ) = 1. If |Z| < N 1 2 +α X and 1 ≤ Y ≤ X < 1 2 N 1 4 -α 2 , then Y X is a convergent of e N .
Proof.

Set ap + bq = N 1 2 +α with α < 1 2 . Rewrite eX -(N -ap -bq)Y = Z as eX -N Y = Z -(ap + bq)Y . Now suppose |Z| < N 1 2 +α X, 1 ≤ Y ≤ X and gcd(X, Y ) = 1. Then e N - Y X = |eX -N Y | N X = |Z -(ap + bq)Y | N X ≤ |Z| N X + (ap + bq)Y N X < N 1 2 +α N + N 1 2 +α N = 2N -1 2 +α . Since X < 1 2 N 1 4 -α 2 , then 2N -1 2 +α < 1 2X 2 . Hence, by Theorem B.2.2, Y
X is one of the convergents of the continued fraction expansion of e N .

B.4.1 An Attack for Small Difference |ap -bq|

We now present the first attack.

Theorem B.4.2. Let N = pq be an RSA modulus with unknown factors p, q such that q < p < 2q. Let a b be an unknown convergent of the continued fraction expansion of q p with a ≥ 1 and |ap -bq| < (abN ) 1 4 . Let e be a public exponent satisfying an equation eX -

(N -ap-bq)Y = Z with gcd(X, Y ) = 1. Set ap + bq = N 1 2 +α with 0 < α < 1 2 . If 1 ≤ Y ≤ X < 1 2 N 1 4 -α 2 and |Z| < inf (abN ) 1 4 , 1 2 N 1 2 -α Y , then N can be factored in polynomial time. Proof. Assume |Z| < inf (abN ) 1 4 , 1 2 N 1 2 -α Y , 1 ≤ Y ≤ X with gcd(X, Y ) = 1. Then |Z| < inf (abN ) 1 4 , 1 2 N 1 2 -α X ≤ 1 2 N 1 2 -α X < N
|ap + bq -M | = |Z| Y < inf (abN ) 1 4 , 1 2 N 1 2 -α < 1 2 N 1 2 -α .
Hence, by Lemma B.3.3, we find ab = M 2 4N . On the other hand, we have

|ap + bq -M | < inf (abN ) 1 4 , 1 2 N 1 2 -α < (abN ) 1 4 .
Moreover, if |ap -bq| < (abN )

1 4 , then ap - M 2 ≤ 1 2 |ap + bq -M | + 1 2 |ap -bq| < 1 2 (abN ) 1 4 + 1 2 (abN ) 1 4 = (abN ) 1 4
.

It follows that the term M 2 is an approximation of the factor ap of n = abN with additive error at most n 1 4 . In addition, by Lemma B.3.4, the factors ap and bq of n are of the same bit-size. Hence, using Theorem B.2.3 with n and M 2 , we find ap, and since a < q, we get p = gcd(N, ap) which terminates the proof.

Let us summarize the first factorization algorithm.

Algorithm 1 Small |ap -bq| Require: a public key (N, e) satisfying N = pq, q < p < 2q and eX -(N -(ap + bq))Y = Z for small parameters X, Y , Z where a b is an unknown convergent of q p with a ≥ 1. Ensure: the prime factors p and q.

1: Compute the continued fraction expansion of e N . 2: For every convergent Y X of e N with X < 1 2 N 1 4 :

3: Compute M = N -eX Y and N 0 = M 2 4N . 4: Apply Coppersmith's algorithm (Theorem B.2.3) with n = N 0 N and M
2 as an approximation of y. 5: Compute g = gcd(y, N ). If 1 < g < N , then stop.

B.4.2 An Attack for Medium Difference |ap -bq|

Here we present the second attack. It is based on the Elliptic Curve Method (ECM) which can find factors of about 52-digits. Assuming the efficiency of ECM, every step in this attack can be done in polynomial time and the number of convergents is bounded by O(log N ). To express this fact, the term efficient is used.

Theorem B.4.3. Let N = pq be an RSA modulus with unknown factors p, q such that q < p < 2q. Let a b be an unknown convergent of the continued fraction expansion of q p such that a ≥ 1, (abN )

1 4 < |ap -bq| < aN
(N -ap - bq)Y = Z with gcd(X, Y ) = 1. Set M = N -eX Y and ap + bq = N 1 2 +α with 0 < α < 1 2 . If 1 ≤ Y ≤ X < 1 2 N 1 4 -α 2 and |Z| < min aN 1 4 , 1 2 N 1 2 -α Y , then, under ECM, N can be factored efficiently. Proof. Assume |Z| < min aN 1 4 , 1 2 N 1 2 -α Y , 1 ≤ Y ≤ X and gcd(X, Y ) = 1. Then |Z| < min aN 1 4 , 1 2 N 1 2 -α X ≤ 1 2 N 1 2 -α X < N
p - M 2a = 1 2 p + bq a - M a + 1 2 p - bq a ≤ 1 2 p + bq a - M a + 1 2 p - bq a < 1 2 N 1 4 + 1 2 N 1 4 = N 1 4 .
This implies that M 2a is an approximation of p with additive error at most N 1 4 . Then, using Theorem B.2.3, this gives p which terminates the proof.

Here we summarize the second factorization algorithm.

Algorithm 2 Medium |ap -bq| Require: a public key (N, e) satisfying N = pq, q < p < 2q and eX -(N -(ap + bq))Y = Z for small parameters X, Y , Z where a b is an unknown convergent of q p with a ≥ 1. Ensure: the prime factors p and q.

1: Compute the continued fraction expansion of e N . 2: For every convergent Y X of e N with X < 1 2 N 1 4 : Here we present the last attack. We suppose |ap -bq| > aN 1 4 so that the Small and the Medium difference attacks should not succeed. This attack depends on the efficiency of the Elliptic Curve Method (ECM) to find factors up to 10 52 . Assuming the efficiency of ECM, the term efficient is also used to express the fact that every step in this attack can be done in polynomial time.

3: Compute M = N -eX Y and N 0 = M 2 4N . 4: if N 0 < 10 104
Theorem B.4.4. Let N = pq be an RSA modulus with unknown factors p, q such that q < p < 2q. Let a b be an unknown convergent of the continued fraction expansion of q p such that a ≥ 1 and b ≤ 10 52 . Let e be a public exponent satisfying an equation eX - Hence, since a ≤ b, this gives

(N -(ap+bq))Y = Z with gcd(X, Y ) = 1. Let M = N -eX Y . Set D = |M 2 -4abN | and ap + bq = N 1 2 +α with 0 < α < 1 2 . If 1 ≤ Y ≤ X < 1 2 N 1 4 -α
1 3 a|ap -bq|N -1 4 -α < 1 3 a • 2 1 2 N 1 2 b • N -1 4 -α ≤ 2 1 2 3 N 1 4 -α . (B.6) Now, suppose |Z| < 1 3 a|ap -bq|N -1 4 -α Y , 1 ≤ Y ≤ X and gcd(X, Y ) = 1. Then using (B.6), we get |Z| < 2 1 2 3 N 1 4 -α X < N
|ap + bq -M | = |Z| Y < 1 3 a|ap -bq|N -1 4 -α . (B.7)
Then using (B.6), we get

|ap + bq -M | < 2 1 2 3 N 1 4 -α < 1 2 N 1 2 -α .
Hence, by Lemma B.

|ap + bq -M | < 1 3 a • 2N 1 2 • N -1 4 -α = 2 3 aN 1 4 -α < aN 1 4 . (B.8) Now, let D = |M 2 -4abN |. Then |ap -bq| 2 -D 2 = |ap -bq| 2 -M 2 -4abN ≤ (ap -bq) 2 -M 2 + 4abN = (ap + bq) 2 -M 2 .
From this we deduce

|ap -bq| -D ≤ |ap + bq -M ||ap + bq + M | |ap -bq| + D .
Next, by (B.8), we have |ap + bq -M | < aN Combining with (B.7), this leads to

|ap -bq| -D < 3 • 1 3 a|ap -bq|N -1 4 -α N 1 2 +α |ap -bq| = aN 1 4 .
If ap -bq > 0, then combining with (B.8), we get

|2ap -M -D| = ap + bq -M + |ap -bq| -D ≤ ap + bq -M + |ap -bq| -D < 2aN 1 4 .
Dividing by 2a, we find that M +D 2a is an approximation of p with additive error at most N 1 4 . If ap -bq < 0, then combining with (B.8), we get

|2ap -M + D| = |ap + bq -M -(bq -ap -D)| < |ap + bq -M | + |ap -bq| -D < 2aN 1 4 .
Dividing again by 2a, we find that M -D 2a is an approximation of p with additive error at most N 1 4 . We can then apply Theorem B.2.3 to the values M ±D 2a . The correct term will lead to the factorization of N . Now we summarize the third factorization algorithm.

Algorithm 3 Large |ap -bq|

Require: a public key (N, e) satisfying N = pq, q < p < 2q and eX -(N -(ap + bq))Y = Z for small parameters X, Y , Z where a b is an unknown convergent of q p with a ≥ 1. Ensure: the prime factors p and q.

1: Compute the continued fraction expansion of e N . 2: For every convergent Y X of e N with X < 1 2 N 1 4 : Apply ECM to find a and b such that N 0 = ab and a ≤ b ≤ 2a.

3: Compute M = N -eX Y and N 0 = M 2 4N . 4: if N 0 < 10 104

6:

Compute D = |M 2 -4N 0 N |.

7:

Compute m 1 = M +D 2a and m 2 = M -D 2a .

8:

Apply Coppersmith's algorithm (Theorem B.2.3) with n = N and m 1 and m 2 as approximations of y. If Coppersmith's algorithm outputs the factors p and q, then stop. 9: end if

B.5 Estimation of the Public Exponents for which the Attacks Apply

In this Section, we will study the size of the class of the public keys for which our attacks can be applied. Let a b be a convergent of q p with a ≥ 1. Define α by ap + bq = N 1 2 +α with 0 < α < 1 2 and let

P(a, b) = (X, Y, z) 1 ≤ Y ≤ X < 1 2 N 1 4 -α 2 , gcd(X, Y ) = 1, |z| < N 1 4 -α 2 ,
be the set of the parameters and

E(a, b) = e e = (N -(ap + bq)) Y X + z, (X, Y, z) ∈ P(a, b) ,
the set of the exponents. We will show that much of these exponents are vulnerable to our attacks. To find a lower bound for the size of the sets E(a, b), we show that different convergents a b of q p and different parameters in the set P(a, b) define different exponents in the sets E(a, b). Corollary B.5.1. Let N = pq be an RSA modulus with q < p < 2q. Let a b be an unknown convergent of q p with a ≥ 1 and |ap -bq| < (abN )

1 4 . Let X, Y be unknown coprime positive integers with 1 ≤ Y ≤ X < 1 2 N 1 4 -α 2 where ap + bq = N 1 2 +α and 0 < α < 1 2 . If e = (N -(ap + bq)) Y X + z is a public exponent with |z| < inf (abN ) 1 4 Y X , N 1
1 4 Y X , N 1 4 -α 2 . Then, since (N -(ap + bq)) Y X -e 0 < 1,
we get

|Z| = |eX -(N -(ap + bq))Y | = |(e 0 + z)X -(N -(ap + bq))Y | ≤ |e 0 X -(N -(ap + bq))Y | + |z|X < (1 + |z|)X.
Observe that (1 + |z|)X < (abN )

1 4 Y and, assuming X < 1 2 N 1 4 -α 2 , we find (1 + |z|)X < N 1 4 -α 2 • 1 2 N 1 4 -α 2 ≤ 1 2 N 1 2 -α Y.
From this, we deduce |Z| < inf (abN ) Next, we give a result for medium difference |ap -bq|.

Corollary B.5.2. Let N = pq be an RSA modulus with q < p < 2q. Let a b be an unknown convergent of q p with a ≥ 1, b ≤ 10 52 and (abN )

1 4 < |ap -bq| < aN 1 4 . Let X, Y be unknown coprime positive integers with 1 ≤ Y ≤ X < 1 2 N 1 4 -α 2 where ap + bq = N 1 2 +α and 0 < α < 1 2 . If e = (N -(ap + bq)) Y X + z is a public exponent with |z| < inf aN 1 4 Y X , N 1 4 -α 2 ,
then, under ECM, N can be factored efficiently.

Proof. The proof is similar to that of Corollary B.5.1 and the parameters satisfy the condition of Theorem B.4.3.

Finally, we give a result which concerns large difference |ap -bq|.

Corollary B.5.3. Let N = pq be an RSA modulus with q < p < 2q. Let a b be an unknown convergent of q p with a ≥ 1, b ≤ 10 52 and |ap -bq| > aN 1 4 . Let X, Y be unknown coprime positive integers with

1 ≤ Y ≤ X < 1 2 N 1 4 -α 2
where ap

+ bq = N 1 2 +α and 0 < α < 1 2 . If e = (N -(ap + bq)) Y X + z is a public exponent with |z| < min 1 3 a|ap -bq|N -1 4 -α Y X , N 1 4 -α 2 ,
then, under ECM, N can be factored efficiently.

Proof. Let Z = eX -(N -(ap + bq))Y , e = (N -(ap + bq)) Y X + z with |z| < min 1 3 a|ap -bq|N -1 4 -α Y X , N 1 4 -α 2 and 1 ≤ Y ≤ X < 1 2 N 1 4 -α 2 .
Using the same arguments as in the proof of Corollary B.5.1, we get

|Z| < (1 + |z|)X < 1 3 a|ap -bq|N -1 4 -α Y.
It follows that all the conditions of Theorem B.4.4 are fulfilled which leads to the factorization of N .

The following result shows that distinct parameters from P(a, b) define different exponents in E(a, b). Lemma B.5.4. Let N = pq be an RSA modulus with q < p < 2q. Let a b be a convergent of q p with a ≥ 1 and ap + bq = N

(N -(ap + bq)) Y X - Y X -e + e ≤ (N -(ap + bq)) Y X -e 0 -z + (N -(ap + bq)) Y X -e 0 -z ≤ (N -(ap + bq)) Y X -e 0 + |z | + (N -(ap + bq)) Y X -e 0 + |z| < 2 + |z| + |z |.
Suppose e = e . Then, multiplying by XX , we get

(N -(ap + bq)) |Y X -Y X | < (2 + |z| + |z |)XX . (B.9)
We want to compare the sides of (B.9). Assume that X, X <

1 2 N 1 4 -α 2 and |z|, |z | < N 1 4 -α 2 . Then (2 + |z| + |z |)XX < 2N 1 4 -α 2 • 1 4 N 1 2 -α = 1 2 N 3 4 -3α 2 .
On the other hand, we have

N -(ap + bq) = N -N 1 2 +α = N 3 4 -3α 2 N 1 4 + 3α 2 -N -1 4 + 5α 2 . Since 0 < α < 1 2 , then 1 4 + 3α 2 > -1 4 + 5α 2 and N 1 4 + 3α 2 > N -1 4 + 5α 2 + 1. Hence N -(ap + bq) > N 3 4 -3α 2 .
From our comparison of the sides of (B.9), we conclude that Y X -Y X = 0. Since gcd(X, Y ) = 1 and gcd(X , Y ) = 1, we find X = X and Y = Y and consequently z = z . This terminates the proof.

Finally, the following result shows that different convergents of q p lead to different exponents in E(a, b). Lemma B.5.5. Let N = pq be an RSA modulus with q < p < 2q. Let a b and a b be convergents of q p with a ≥ 1, a ≥ 1, ap + bq = N

N -(ap + bq) -(N -(a p + b q)) = (a -a)p + (b -b)q > p + q > p > N
| < N 1 4 -α 2 < N 1 4 -α 2 , we get (N -(a p + b q)) Y X -(N -(ap + bq)) Y X < 2 + |z| + |z | < 2N 1 4 -α 2 . (B.11)
On the other hand, we know that Y X and Y X are convergents of the continued fraction expansion of e N . Hence Y X ≈ Y X and, combining (B.10) with X < Let us now prove a lower bound for the size of the number of the exponents e that are vulnerable to our approach. Note that we do not require gcd(e, φ(N )) = 1 as usual.

1 2 N 1 4 -α 2 , we get (N -(ap + bq)) Y X > (N -(a p + b q)) Y X + N 1 2 Y X > (N -(a p + b q)) Y X + N 1 2 • 1 1 2 N 1 4 -α 2 ≈ (N -(a p + b q)) Y X + 2N 1 4 + α 2 It follows that (N -(a p + b q)) Y X -(N -(ap + bq)) Y X > 2N 1 4 + α
Theorem B.5.6. Let N = pq be an RSA modulus with q < p < 2q. Then the number of the exponents e ∈ E(a, b) that are vulnerable to the attacks for some convergent a b = 0 1 of q p is at least N 3 4 -ε where ε is arbitrarily small for suitably large N .

Proof. We focus on E(1, 1) since the total number of exponents is much higher. Let α 0 such that p + q = N 1 2 +α 0 . Since q < p, then 2q < p + q < 2p and by Lemma B.3.1, we get 2

1 2 N 1 2 < N 1 2 +α 0 < 2 3 2 N 1 2
. From this we deduce α 0 ≈ 0. On the other hand, by Corollary B.5.3, we need

|z| < min 1 3 |p -q|N -1 4 -α 0 Y X , N 1 4 - α 0 2 , where 1 ≤ Y ≤ X < 1 2 N 1 4 - α 0 2
and gcd(X, Y ) = 1. Observe that for the normal RSA, we have p -q > cN 1 2 with a constant c > 0. So let

|z| < min c 3 N 1 4 -α 0 Y X , N 1 4 - α 0 2
, and put

X 0 = 1 2 N 1 4 - α 0 2
.

We want to estimate

#E(1, 1) = X 0 X=1 X-1 Y =1 gcd(X,Y )=1 |z|. Taking |z| < c 3 N 1 4 -α 0 Y X , we get #E(1, 1) = c 3 N 1 4 -α 0 X 0 X=1 X-1 Y =1 gcd(X,Y )=1 Y X = c 6 N 1 4 -α 0 X 0 X=1 φ(X), (B.12)
where we used the well known identity

X-1 Y =1 gcd(X,Y )=1 Y = 1 2 Xφ(X). Similarly, taking |z| < N 1 4 - α 0 2 , we get #E(1, 1) = N 1 4 - α 0 2 X 0 X=1 X-1 Y =1 gcd(X,Y )=1 1 = N 1 4 - α 0 2 X 0 X=1 φ(X). (B.13)
We can rewrite (B.12) and (B.13) in a single expression

#E(1, 1) = N 1 4 -ε 0 X 0 X=1 φ(X),
for a suitable ε 0 > 0. It is well known (see Theorem 328 of [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]), that

φ(X) > CX log log X ,
where C is a positive constant. Since X < N , then φ(X) > XN -ε 1 for a small positive constant ε 1 . From this, we deduce

#E(1, 1) > N 1 4 -ε 0 -ε 1 X 0 X=1 X > N 1 4 -ε 0 -ε 1 X 2 0 2 > 1 8 N 3 4 -α 0 -ε 0 -ε 1 ,
where we used

X 0 ≈ 1 2 N 1 4 - α 0
2 . We get finally #E(1, 1) > N 3 4 -ε , with a constant ε ≈ α 0 +ε 0 +ε 1 depending only on N . This terminates the proof.

B.6 Conclusion

In this paper, we showed how to perform three attacks on RSA using the ratio of the primes. The attacks apply when the public key (N, e) satisfies an equation eX -(N -(ap + bq))Y = Z with suitably small parameters X, Y and Z where a b is an unknown convergent of q p with a ≥ 1. The attacks combine a variety of techniques, including continued fractions, Coppersmith's lattice based method and H.W. Lenstra's Elliptic Curve Method for Factoring (ECM). Our results illustrate once again the fact that we should be very cautious when using RSA with specific exponents. Moreover, we showed that the number of such exponents is at least N

C.1 Introduction

The RSA public-key cryptosystem was invented by Rivest, Shamir, and Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] in 1978. Since then, the RSA system has been the best known and most widely accepted public key cryptosystem. Encryption and decryption in RSA each requires an exponentiation modulo a large modulus N which is the product of two large primes, p and q. The exponents in the exponentiations are the public exponent e for encryption and the private exponent d for decryption. The exponents e and d are related by the equation ed -kφ(N ) = 1 for some positive integer k where φ(N ) = (p -1)(q -1) is the Euler totient function of N . To reduce the decryption time or signature generation, it may be tempting to use a small private exponent d. Unfortunately, based on the convergents of the continued fraction expansion of e N , Wiener [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] showed that the RSA system can be totally broken if d < 1 3 N 1 4 . Then, in 1999, based on lattice basis reduction, Boneh and Durfee [17] proposed a new attack on the use of short secret exponents. They showed that the RSA system can be totally broken if d < N 0.292 . In 1994, Blömer and May [13] proposed a different attack on RSA with a public exponent e satisfying the equation ex + y = kφ(N ) with x < 1 3 N 1 4 and |y| < O N -3 4 ex . This attack combines the convergents of the continued fraction expansion of e N and the seminal work of Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] for solving bivariate polynomial equations.

In 1999, Guo (see [START_REF] Howgrave-Graham | Extending Wiener's attack in the presence of many decrypting exponents[END_REF]) proposed an attack on RSA when there are two or more instances of RSA, having the same modulus, with public exponents e i , i = 1, 2, . . .. The attack is based on the continued fraction algorithm and can be used to factor the modulus if the private exponents d i are each less than N 1 3 -ε for some ε > 0. In 1999, Howgrave-Graham and Seifert [START_REF] Howgrave-Graham | Extending Wiener's attack in the presence of many decrypting exponents[END_REF] proposed an extension of Guo's attack that allows the RSA system to be broken in the presence of two decryption exponents (d 1 , d 2 ) with d 1 , d 2 < N 5 14 . In the presence of three decryption exponents, Howgrave-Graham and Seifert improved the bound to N 2 5 . The attack of Howgrave-Graham and Seifert is based on lattice reduction methods. Very recently, Sarkar and Maitra [START_REF] Sarkar | Cryptanalysis of RSA with two decryption exponents[END_REF] used a different lattice based technique and improved the bound N 5 14 for the case of two decryption exponents up to N 0.416 . In [START_REF] Sarkar | Cryptanalysis of RSA with two decryption exponents[END_REF], Sarkar and Maitra proposed a generalized attack when n ≥ 2 many decryption exponents d i are used with the same RSA modulus N and

d i < N 3n-1 4n+4 for each i, 1 ≤ i ≤ n.
In this paper, we combine the attack of Guo and the attack of Blömer and May to mount a new attack on RSA with two or three decryption exponents and a common modulus. Let N = pq be an RSA modulus with q < p < 2q and e i , i = 1, 2, . . ., be two or three public exponents. Assume that each exponent satisfies an equation e i x i -φ(N )y i = z i . We show, that, depending on certain inequalities verified by the parameters x i , y i , z i , one can find the factorization of the RSA modulus N . The new approach still uses the continued fraction algorithm and the lattice-reduction basis technique of Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF].

The rest of this paper is organized as follows. In Section 2 we present the attack of Guo as well as the attack of Blömer and May. In Section 3, we prove three lemmas to be used in our new approach. We present the new approach for two exponents in Section 4 and for three exponents in Section 5. We conclude the paper in Section 6.

C.2 Former Attacks

Since the motivation for our new attack originates from Guo's continued fraction attack and the Blömer and May lattice attack, we revisit these attacks in this section.

C.2.1 Guo's attack for two exponents

Guo's attack was described in [START_REF] Howgrave-Graham | Extending Wiener's attack in the presence of many decrypting exponents[END_REF] by Howgrave-Graham and Seifert (see also [START_REF] Hinek | Common modulus attacks on small private exponent RSA and some fast variants (in Practice)[END_REF]). It is based on the continued fraction algorithm and makes use of the following result (see [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF], Theorem 184).

Theorem C.2.1 (Legendre). Let ξ be a real number. If a and b are coprime integers such that

ξ - a b < 1 2b 2 , then a
b is a convergent of the continued fraction expansion of ξ.

Guo's attack concerns at least two public exponents e 1 , e 2 such that e 1 d 1 -k 1 φ(N ) = 1 and e 2 d 2 -k 2 φ(N ) = 1, where φ(N ) = (p -1)(q -1). Eliminating φ(N ), we find the equation e

1 d 1 k 2 -e 2 d 2 k 1 = k 2 -k 1 . Dividing by e 2 d 1 k 2 , we get e 1 e 2 - d 2 k 1 d 1 k 2 = |k 2 -k 1 | e 2 d 1 k 2 . Hence, if 2|k 2 -k 1 |d 1 k 2 < e 2 , then |k 2 -k 1 | e 2 d 1 k 2 < 1 2(d 1 k 2 ) 2 .
Thus, by Theorem C.2.1,

d 2 k 1 d 1 k 2 must
k i = e i d i -1 φ(N ) < e i d i φ(N ) < d i .
It follows that the condition 2|k 2 -k 1 |d 1 k 2 < e 2 reduces to 2N 3δ < N , or equivalently δ < 1 3 -ε, where ε is a small positive constant. In practice, Guo's attack is effective if one can find d 1 or d 2 using the convergent

d 2 k 1 d 1 k 2 . This means that the quantities d i , k i , i = 1, 2, must satisfy gcd(d 1 k 2 , d 2 k 1 ) = 1. Moreover, it is necessary to factor d 1 k 2 or d 2 k 1 . Since k i < d i < N δ , i = 1, 2, then max (d 1 k 2 , d 2 k 1 ) < N 2δ < N 2 3
. Depending on the structure of the quantities d i and k i , i = 1, 2, the numbers d 1 k 2 and d 2 k 1 are not expected to be of a difficult factorization shape and can be factored easily. Using the exact values of d 1 and k 1 in e 1 d 1 -k 1 φ(N ) = 1, this gives the factorization of N .

Later, using lattice based techniques, Howgrave-Graham and Seifert [START_REF] Howgrave-Graham | Extending Wiener's attack in the presence of many decrypting exponents[END_REF] increased the bound up to d 1 , d 2 < N 5 14 . This bound was recently improved to d 1 , d 2 < N 0.416 by Sarkar and Maitra [START_REF] Sarkar | Cryptanalysis of RSA with two decryption exponents[END_REF].

C.2.2 Guo's attack for three exponents

To avoid the factorization problem, Guo proposed to use three exponents. Consider that three public exponents e 1 , e 2 , e 3 satisfying the key equations

e 1 d 1 -k 1 φ(N ) = 1, e 2 d 2 -k 2 φ(N ) = 1, e 3 d 3 -k 3 φ(N ) = 1, satisfy also the inequalities 2|k 2 -k 1 |d 1 k 2 < e 2 and 2|k 3 -k 1 |d 1 k 3 < e 3 .
Combining the key equations, we get

e 1 d 1 k 2 -e 2 d 2 k 1 = k 2 -k 1 , e 1 d 1 k 3 -e 3 d 3 k 1 = k 3 -k 1 .
Proceeding as in Guo's first attack, we find the inequalities

e 1 e 2 - d 2 k 1 d 1 k 2 = |k 2 -k 1 | e 2 d 1 k 2 < 1 2(d 1 k 2 ) 2 , e 1 e 3 - d 3 k 1 d 1 k 3 = |k 3 -k 1 | e 3 d 1 k 3 < 1 2(d 1 k 3 ) 2 .
Using Theorem C.2.1, we see that d 2 k 1 d 1 k 2 is one of the convergents of the continued fraction of e 1 e 2 and similarly, d 3 k 1 d 1 k 3 is one of the convergents of the continued fraction of e 1 e 3 . Suppose in addition that gcd(d

2 k 1 , d 1 k 2 ) = 1, gcd(d 3 k 1 , d 1 k 3 ) = 1, gcd(d 2 , d 3 ) = 1 and gcd(k 2 , k 3 ) = 1, then d 2 k 1 d 1 k 2 and d 3 k 1 d 1 k 3 are in lowest terms and gcd(d 1 k 2 , d 1 k 3 ) = d 1 , gcd(d 2 k 1 , d 3 k 1 ) = k 1 .
With d 1 and k 1 known, the factorization of N becomes trivial using the equation e

1 d 1 -k 1 φ(N ) = 1.
In 1999, it was shown by Howgrave-Graham and Seifert [START_REF] Howgrave-Graham | Extending Wiener's attack in the presence of many decrypting exponents[END_REF] that the bound d i < N 1 3 with i = 1, 2, 3 can be improved using lattice reduction techniques and very recently, Sarkar and Maitra [START_REF] Sarkar | Cryptanalysis of RSA with more than one decryption exponent[END_REF] increased this bound up to d i < N

C.2.3 The Blömer and May attack

In 2004, Blömer and May [13] proposed an attack on RSA with a modulus N = pq with q < p < 2q and a public exponent e satisfying an equation ex + y = kφ(N ). The attack is based on a combination of the continued fraction algorithm and Coppersmith's lattice-based technique for finding small roots of bivariate polynomial equation [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF].

Theorem C.2.2 (Coppersmith). Let N = pq be the product of two unknown primes such that q < p < 2q. Suppose we know an approximation P of p such that p -P < 2N 1 4 . Then N can be factored in polynomial time.

Suppose that e satisfies an equation ex + y = kφ(N ). Under the conditions

0 < x < 1 3 N 1 4 and |y| = |ex -kφ(N )| ≤ O N -3 4 ex , (C.1)
the fraction k x satisfies k x -e N < 1 2x 2 . By Theorem C.2.1, this shows that k x can be found among the convergents of the continued fraction expansion of e N . Using φ(N ) = (p -1)(q -1) = N + 1 -p -q in the equation ex + y = kφ(N ), Blömer and May showed that N +1-ex k is an approximation of p+q satisfying

p + q -N + 1 - ex k = |y| k < 4 3 cN 1 4 ,
where c < 1 is a positive constant satisfying p -q > cN

1 2 . Next, they derived that N + 1 -ex k 2 -
4N is an approximation of p -q up to an error term at most 9N 1 4 . Finally, combining the approximations of p + q and p -q, they found an approximation of p up to an error term of at most 6N 1 4 which leads to the exact value of p using Coppersmith's Theorem C.2.2.

C.3 Useful Lemmas

In this section we state and prove three lemmas needed for the new attack. The first is the following result.

Lemma C.3.1. Let N = pq be an RSA modulus with q < p < 2q. Suppose that S is an approximation of p + q satisfying S > 2 √ N and

|p + q -S| < D S N 1 4 , (C.2)
where D = √ S 2 -4N . Then P = 1 2 (S + D) is an approximation of p with p -P < 2N Proof. Suppose that S > 2 √ N is a positive integer satisfying (C.2) where

D = √ S 2 -4N . We have D 2 -(p -q) 2 = S 2 -4N -(p -q) 2 ≤ S 2 -4N -(p -q) 2 = S 2 -(p + q) 2 = (p + q + S) |p + q -S| ≤ (p + q + S) × DN 1 4
S .

Dividing by p -q + D, we get

|p -q -D| ≤ p + q + S p -q + D × DN 1 4 S . (C.3)
Let us find a bound for p+q+S p-q+D . Since D < S, then from (C.2), we derive

p + q + S < 2S + DN 1 4 S < 2S + N 1 4 < 3S.
On the other hand, we have p -q + D > D. Hence

p + q + S p -q + D < 3S D Plugging in (C.3), we deduce |p -q -D| ≤ 3S D × DN 1 4 S = 3N 1 4 . (C.4)
Now, using (C.2) and (C.4), we get

|2p -S -D| = |p + q -S + (p -q -D)| ≤ |p + q -S| + |p -q -D| < DN 1 4 S + 3N 1 4
< 4N Dividing by 2, we find

p - S + D 2 = p -P < 2N 1 4 ,
which terminates the proof. Notice that when the primes p and q satisfy q < p < 2q, then p + q > 2 √

N and if S is an approximation of p + q, then S also satisfies S > 2 √ N .

The second lemma is the following.

Lemma C.3.2. Let N = pq be an RSA modulus with q < p < 2q. Let e 1 , e 2 be integers satisfying the equations

e 1 x 1 -φ(N )y 1 = z 1 , e 2 x 2 -φ(N )y 2 = z 2 . If 2x 1 y 2 |z 1 y 2 -z 2 y 1 | < e 2 then x 2 y 1 x 1 y 2 is a convergent of e 1 e 2 .
Proof. Suppose that e 1 , e 2 satisfy the equations e 1 x 1 -φ(N )y 1 = z 1 and e 2 x 2 -φ(N )y 2 = z 2 . Then eliminating φ(N ), we get

e 1 x 1 y 2 -e 2 x 2 y 1 = z 1 y 2 -z 2 y 1 .
Dividing both sides by e 2 x 1 y 2 , we get

e 1 e 2 - x 2 y 1 x 1 y 2 = |z 1 y 2 -z 2 y 1 | e 2 x 1 y 2 . (C.5)
Suppose that the parameters satisfy the inequality 2x

1 y 2 |z 1 y 2 -z 2 y 1 | < e 2 . Then (C.5) yields e 1 e 2 - x 2 y 1 x 1 y 2 < 1 2(x 1 y 2 ) 2 .
Combining with Theorem C.2.1, we see that

x 2 y 1 x 1 y 2 is a convergent of e 1 e 2 .
Finally, we will use the following result.

Lemma C.3.3. Let N = pq be an RSA modulus with q < p < 2q. Let e 1 be an integer satisfying the equation e 1 x 1 -φ(N )y 1 = z 1 , with known positive parameters x 1 , y 1 . Let

S = N + 1 - e 1 x 1 y 1 and D = |S 2 -4N |.
Then, under the conditions S > 2 √ N and

|z 1 | < D S N 1 4 y 1 ,
N can be factored in polynomial time.

Proof. Suppose that e 1 satisfies the conditions of the theorem where x 1 , y 1 are known positive integers. Using φ(N ) = N + 1 -p -q in the equation e 1 x 1 -φ(N )y 1 = z 1 , we get

p + q -N + 1 - e 1 x 1 y 1 = |z 1 | y 1 < D S N 1 4 .
This implies that S = N + 1 -e 1 x 1 y 1 is an approximation of p + q up to an error term satisfying the condition of Lemma C.3.1. Hence P = 1 2 S + |S 2 -4N | is an approximation of p up to an error term at most 2N 1 4 . Thus, using Coppersmith's Theorem C.2.2, one can find p in polynomial time.

C.4 The New Attack on RSA with Two Exponents

In this section, we investigate RSA with the same modulus and two public exponents e 1 and e 2 satisfying the equations e 1 x 1 -φ(N )y 1 = z 1 , and e 2 x 2φ(N )y 2 = z 2 , where the parameters satisfy gcd(x 2 y 1 , x 1 y 2 ) = 1, (C.6)

x 1 y 2 |z 1 y 2 -z 2 y 1 | < e 2 2 . (C.7)
This means that the conditions of Lemma C.3.2 are satisfied which implies that x 2 y 1 x 1 y 2 can be found in the continued fraction expansion of e 1 e 2 . The condition (C.6) implies that the convergent x 2 y 1

x 1 y 2 is in lowest terms which gives x 2 y 1 and x 1 y 2 . Now, we wish to recover the values of the parameters x 1 , y 1 , x 2 , y 2 . Using the assumptions that x 1 , y 2 , |z 1 y 2 -z 2 y 1 | are at most N δ and that e 2 ≈ N , the condition (C.7) is satisfied whenever N 3δ < 1 2 N, that is δ = 1 3 -ε, for some small ε > 0. Moreover, if x 2 y 1 and x 1 y 2 are not of a difficult factorization shape, then their factorization is feasible for instances of RSA with a 1024-bit modulus. Thus, factoring x 2 y 1 and x 1 y 2 will reveal the parameters x 1 , y 1 . To find the prime factors p and q of the RSA modulus N = pq, we must make the assumption that the parameter z 1 satisfies We summarize the first attack in Algorithm 1.

|z 1 | < D S N

Algorithm 4 Two exponents

Require: N = pq with q < p < 2q, two public exponents e i , i = 1, 2 satisfying e i x i -φ(N )y i = z i with unknown parameters x i , y i , z i . Ensure: The prime factors p and q.

Compute the continued fraction expansion of e 1 e 2 . for every convergent p k q k of e 1 e 2 with max(p k , q k ) < N 2 3 do Factor p k and q k . for every divisor y 1 of p k do for every divisor x 1 of q k do Compute S = N + 1 -e 1 x 1 y 1 and P =

• • • ] Each convergent a b is a candidate for x 2 y 1 x 1 y 2 . The 27th convergent is a b = 3889559329731
We see that a ≈ N 0.550 , b ≈ N 0.546 are not of difficult factorization shape. We get easily a = 3

+ q = N + 1 -e 1 x 1 y 1 + z 1 y 1 .
We then make the assumption that

p + q ≈ S = N + 1 - e 1 x 1 y 1 ≈ 594807230437.
From this, we get the approximation

p -q ≈ D = |S 2 -4N | ≈ 196630487186.
Combining the approximations of p + q and p -q, we get

p ≈ S + D 2 ≈ 395718858812.
Then Coppersmith's algorithm C.2.2 gives p = 395718860549 and then we get q = 199088370751.

Note that, in this example, the private exponents

d i ≡ e -1 i (mod φ(N )), i = 1, 2, are d 1 = 63426822067770650216953 ≈ N 0.996 , d 2 = 68134122111136587656939 ≈ N 0.997 , so that d 1 , d 2 > N 1 2
, which explains why Guo's attack would fail in this case. On the other hand, in connection with the attack of Blömer and May as described in Subsection C.2.3, the fraction y 1

x 1 is not among the convergents of the continued fraction of e 1 N . Similarly, y 2 x 2 is not among the convergents of the continued fraction of e 2 N . Moreover, all the convergents x k of e 1 N with x < 1 3 N

1 4 are such that |e 1 x -kφ(N )| > N -3 4 e 1 x so that the condition (C.1) is never satisfied. We have a similar result with the convergents of e 2 N . This explains why Blömer and May's attack would also fail in this case.

C.5 The New Attack on RSA with Three Exponents

To avoid factoring integers of size N 2 3 , we consider in this section that a third instance of RSA with the same modulus is available. Suppose we have three public exponents e 1 , e 2 , e 3 satisfying the equations

e 1 x 1 -φ(N )y 1 = z 1 , e 2 x 2 -φ(N )y 2 = z 2 , e 3 x 3 -φ(N )y 3 = z 3 ,
where the parameters satisfy gcd(x 2 y 1 , x 1 y 2 ) = 1, gcd(x 3 y 1 , x 1 y 3 ) = 1 and

x 1 y 2 |z 1 y 2 -z 2 y 1 | < e 2 2 , x 1 y 3 |z 1 y 3 -z 3 y 1 | < e 3 2 .
This immediately shows that the conditions of Lemma C.3.2 are satisfied for (e 1 , e 2 ) and for (e 1 , e 3 ). Hence x 2 y 1 x 1 y 2 is in lowest terms and is a convergent of e 1 e 2 . Similarly, x 3 y 1 x 1 y 3 is in lowest terms and is a convergent of e 1 e 3 . This gives gcd(x 1 y 2 , x 1 y 3 ) = x 1 , gcd(x 2 y 1 , x 3 y 1 ) = y 1 .

Now, if the condition

|z 1 | < D S N 1 4 y 1 ,
is satisfied, where S = N + 1 -e 1 x 1 y 1 and D = |S 2 -4N |, then by Lemma C.3.3 one can find p using Coppersmith's Theorem with the approximation

P = 1 2 S + |S 2 -4N | . of p.
We summarize the attack in Algorithm 2

An Example for the New Attack with Three Exponents

Here we take an RSA modulus N = pq and three public exponents e 1 , e 2 and Algorithm 5 Three Exponents Require: N = pq with q < p < 2q, three public exponents e i , i = 1, 2, 3, satisfying e i x i -φ(N )y i = z i with unknown parameters x i , y i , z i . Ensure: The prime factors p and q.

Compute the continued fraction expansion of e 1 e 2 . Compute the continued fraction expansion of e 1 e 3 . for every convergent a b of e 1 e 2 do for every convergent c d of e 1 e 3 do Compute x 1 = gcd(b, d), y 1 = gcd(a, c). The candidates for x 2 y 1

Compute S = N + 1 -e 1 x
x 1 y 2 are the convergents of e 1 e 2 . Indeed, the 25th convergent of e 1 e 2 is 44398785042941 1612259112200 . Similarly, the candidates for x 3 y 1 x 1 y 3 are the convergents of e 1 e 3 . The 35th convergent of e 1 e 3 is 6433869008153 29072252986700 . From the two convergents, we get x 1 = gcd(1612259112200, 29072252986700) = 59365900, y 1 = gcd(44398785042941, 6433869008153) = 617411.

Using the equation e 1 x 1 -φ(N )y 1 = z1, we get p + q = N + 1 -e 1 x 1 y 1 + z 1 y 1 , and neglecting z 1 y 1 , we get

p + q ≈ S = N + 1 - e 1 x 1 y 1 ≈ 642772787002.
From this, we get the approximation We notice that, for i = 1, 2, 3, the integers d i related to e i by the relations e i d i ≡ 1 (mod φ(N )) satisfy d i > N 0.98 which is far from Guo's upper bound N 1 3 as described in Subsection C.2.2. This shows that Guo's method would fail here. On the other hand, for i = 1, 2, 3, the convergents of the rational numbers e i N are all different from the expected convergents y i x i . Moreover, for i = 1, 2, 3, the conditions (C.1) are not satisfied by the convergents of e i N . This shows that the method of Blömer and May would also fail in this case.

p -q ≈ D = |S 2 -4N | ≈ 181799784560.

C.6 Conclusion

In this paper, we have presented a new attack on RSA with the same modulus N = pq and two or three exponents satisfying equations e i x i -φ(N )y i = z i with specific unknown parameters x i , y i , z i . Our attack is an extension of Guo's attack as well as an extension of the Blömer and May attack. The new attack enables us to find p and q efficiently with two exponents and in polynomial time with three exponents. This proves once again that, under some conditions, RSA is insecure even when the private exponents are sufficiently large.

substantially reduces the requirement of LSBs of ap and bq.

D.1 Introduction

The RSA cryptosystem was invented by Rivest, Shamir and Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] in 1977 and is today's most important public-key cryptosystem. The standard notations in RSA are as follows:

• p and q are two large primes of the same bit size.

• N = pq is the RSA modulus and φ(N ) = (p -1)(q -1) is Euler's totient function.

• e and d are respectively the public and the private exponents and satisfy ed -kφ(N ) = 1 for some positive integer k.

There have been a large number of attacks on RSA. Some attacks, called small private key attacks can break RSA in polynomial time when the private key is small. For example, Wiener [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] showed that if the private key satisfies d < 1 3 N 1 4 , then N can be factored and Boneh and Durfee [17] showed that RSA is insecure if d < N 0.292 . Some attacks, called partial key exposure attacks exploit the knowledge of a portion of the private exponent or of one of the prime factors. Partial key exposure attacks are mainly motivated by using side-channel attacks, such as fault attacks, power analysis and timing attacks ( [START_REF] Kocher | Timing attacks on implementations of Diffie-Hellman, RSA, DSS and other systems[END_REF], [START_REF] Kocher | Differential power analysis[END_REF]). Using a side-channel, an attacker can expose a part of one of the modulus prime factors p or q or of the private key d. In 1998, Boneh, Durfee and Frankel [18] presented several partial key exposure attacks on RSA with a public key e < N 1/2 where the attacker requires knowledge of most significant bits (MSBs) or least significant bits (LSBs) of the private exponent d. In [13], Ernest et al. [START_REF] Ernst | Partial key exposure attacks on RSA up to full size exponents[END_REF] proposed several partial key exposure attacks that work for e > N 1/2 . Notice that Wiener's attack [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] and the attack of Boneh and Durfee [17] can be seen as partial key exposure attacks because the most significant bits of the private exponent are known and are equal to zero. Sometimes, it is possible to factor the RSA modulus even if the private key is large and no bits are exposed. Such attacks exploit the knowledge of special conditions verified by the modulus prime factors or by the exponents. In 2004, Blömer and May [13] showed that RSA can be broken if the public exponent e satisfies an equation ex = y + kφ(N ) with x < 1 3 N 1 4

and |y| < N -3 4 ex. At Africacrypt 2009, Nitaj [START_REF] Nitaj | Cryptanalysis of RSA using the ratio of the primes[END_REF] presented an attack when the exponent e satisfies an equation eX -(N -(ap + bq))Y = Z with the constraints that a b is an unknown convergent of the continued fraction expansion of q p , 1

≤ Y ≤ X < 1 2 N 1 4
√ a , gcd(X, Y ) = 1, and Z depends on the size of |ap -bq|. Nitaj's attack combines techniques from the theory of continued fractions, Coppersmith's method [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] for finding small roots of bivariate polynomial equations and the Elliptic Curve Method [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] for integer factorization.

In this paper we revisit Nitaj's attack by studying the generalized RSA equation ed -k(N + 1 -ap -bq) = 1 with different constraints using Coppersmith's method [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] only. We consider the situation when an amount of LSBs of ap and bq are exposed where a b is an unknown approximation of q p , that is when a = bq p . More precisely, assume that ap = 2 m 0 p 1 + p 0 and bq = 2 m 0 q 1 + q 0 where m 0 , p 0 and q 0 are known to the attacker. We show that one can factor the RSA modulus if the public key e satisfies an equation

ed 1 -k 1 (N + 1 -ap -bq) = 1 where e = N γ , d 1 < N δ , 2 m 0 = N β and a < b < N α satisfy δ ≤ δ 1 if γ ≥ 1 2 (1 + 2α -2β), δ 2 if γ < 1 2 (1 + 2α -2β). with δ 1 = 7 6 + 1 3 (α -β) - 1 3 4(α -β) 2 + 4(3γ + 1)(α -β) + 6γ + 1, δ 2 = 1 4 (3 -2(α -β) -2γ).
We notice the following facts

• When a = b = 1, the equation becomes ed 1 -k 1 (N + 1 -p -q) = 1 as in standard RSA.

• When γ = 1 and α = β, the RSA instance is insecure if d < 7 6 -√ 7 0.284. This is a well known boundary in the cryptanalysis of RSA (see e.g. [17]).

• When γ = 1 and β = 0, that is no LSBs of ap nor of bq are known, the RSA instance is insecure if δ < 7 6 + 1 3 α -1 3 √ α 2 + 16α + 7. This considerably improve the bound δ < 1 4 (1 -2α) of [START_REF] Nitaj | Cryptanalysis of RSA using the ratio of the primes[END_REF]. • The ANSI X9.31 standard [1] requires that the prime factors p and q shall not be near the ratio of two small integers. Our new attack shows that this requirement is necessary and can be easily checked once one has generated two primes simply by computing the convergents of the continued fraction expansion of q p .

The rest of the paper is organized as follows. In Section 2 we review some basic results from lattice theory and their application to solve modular equations as well as two useful lemmas. In Section 3 we describe the new attack on RSA. In Section 4, we present various numerical experiments. Finally, we conclude in Section 5.

D.2 Preliminaries

D.2.1 Lattices

Let ω and n be two positive integers with

ω ≤ n. Let b 1 , • • • , b ω ∈ R n be ω linearly independent vectors. A lattice L spanned by {b 1 , • • • , b ω } is the set of all integer linear combinations of b 1 , • • • , b ω , that is L = ω i=1 x i b i | x i ∈ Z .
The set b 1 . . . , b ω is called a lattice basis for L. The lattice dimension is dim(L) = ω. We say that the lattice is full rank if ω = n. If the lattice is full rank, then the determinant of L is equal to the absolute value of the determinant of the matrix whose rows are the basis vectors b 1 , • • • , b ω . In 1982, Lenstra, Lenstra and Lovász [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] invented the so-called LLL algorithm to reduce a basis and to find a short lattice vector in time polynomial in the bit-length of the entries of the basis matrix and in the dimension of the lattice. The following lemma, gives bounds on LLL-reduced basis vectors.

Theorem D.2.1 (Lenstra, Lenstra, Lovász). Let L be a lattice of dimension ω. In polynomial time, the LLL-algorithm outputs two reduced basis vectors v 1 and v 2 that satisfy

v 1 ≤ 2 ω 2 det(L) 1 ω , v 2 ≤ 2 ω 2 det(L) 1 ω-1 .
Using the LLL algorithm, Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] proposed a method to efficiently compute small roots of bivariate polynomials over the integers or univariate modular polynomials. Howgrave-Graham [START_REF] Howgrave-Graham | Finding small roots of univariate modular equations revisited[END_REF] gave a simple reformulation of Coppersmith's method in terms of the norm of the polynomial f (x, y) = a ij x i y j which is defined by

f (x, y) = a 2 ij .
Theorem D.2.2 (Howgrave-Graham). Let f (x, y) ∈ Z[x, y] be a polynomial which is a sum of at most ω monomials. Suppose that f (x 0 , y 0 ) ≡ 0 (mod e m ) where |x 0 | < X and |y 0 | < Y and f (xX, yY ) < e m √ ω . Then f (x 0 , y 0 ) = 0 holds over the integers.

D.2.2 Useful Lemmas

Let N = pq be an RSA modulus. The following lemma is useful to find a value of ap -bq using a known value of ap + bq.

Lemma D.2.3. Let N = pq be an RSA modulus with q < p < 2q and S be a positive integer. Suppose that ap + bq = S where a b is an unknown approximation of q p . Then

ab = S 2 4N and |ap -bq| = S 2 -4 S 2 4N N .
Proof. Observe that multiplying q < p < 2q by p gives N < p 2 < 2N and consequently

√ N < p < √ 2 √ N . Suppose that a b is an approximation of q p ,
that is a = bq p . Hence a -bq p ≤ 1 2 , which gives

|ap -bq| ≤ p 2 ≤ √ 2 √ N 2 < 2 √ N .
Next, suppose that ap+bq = S. We have S 2 = (ap+bq) 2 = (ap-bq) 2 +4abN. Since |ap -bq| < 2 √ N , then the quotient and the remainder in the Euclidean division of S 2 by 4N are respectively ab and (ap -bq) 2 . Hence

ab = S 2 4N and |ap -bq| = S 2 -4abN ,
which terminates the proof.

The following lemma shows how to factor N = pq using a known value of ap + bq. Lemma D.2.4. Let N = pq be an RSA modulus with q < p < 2q and S be a positive integer. Suppose that ap + bq = S where a b is an unknown approximation of q p . Then N can be factored.

Proof. Suppose that a b is an approximation of q p and that ap + bq = S. By Lemma D.2.3, we get ab = S 2 4N and |ap -bq| = D where

D = S 2 -4abN .
Hence ap-bq = ±D. Combining with ap+bq = S, we get 2ap = S ±D. Since a < q, then gcd(N, S ± D) = gcd(N, 2ap) = p. This gives the factorization of N .

D.3 The New Attack

Let e, d 1 , k 1 be positive integers such that ed 1 -k 1 (N + 1 -ap -bq) = 1. In this section, we consider the following parameters.

• 2 m 0 = N β where m 0 is a known integer.

• a < b < N α with α < 1 2 where a b is an unknown approximation of q p . • ap = 2 m 0 p 1 + p 0 where p 0 is a known integer.

• bq = 2 m 0 q 1 + q 0 where q 0 is a known integer.

• e = N γ .

• d 1 = N δ .
The aim in this section is to prove the following result.

Theorem D.3.1. Suppose that ap = 2 m 0 p 1 + p 0 and bq = 2 m 0 q 1 + q 0 where m 0 , p 0 and q 0 are known with 2 m 0 = N β and a b is an unknown approximation of q p satisfying a, b < N α . Let e = N γ , d 1 = N δ and k 1 be positive integers satisfying an equation ed 1 -k 1 (N + 1 -ap -bq) = 1. Then one can factor N in polynomial time when

δ ≤ δ 1 if γ ≥ 1 2 (1 + 2α -2β), δ 2 if γ ≤ 1 2 (1 + 2α -2β)
, where

δ 1 = 7 6 + 1 3 (α -β) - 1 3 4(α -β) 2 + 4(3γ + 1)(α -β) + 6γ + 1, δ 2 = 1 4 (3 -2(α -β) -2γ).
Proof. Suppose that ap = 2 m 0 p 1 + p 0 and bq = 2 m 0 q 1 + q 0 with known m 0 , p 0 and q 0 . Then ap + bq = 2 m 0 (p 1 + q 1 ) + p 0 + q 0 . Starting with the variant RSA equation

ed 1 -k 1 (N + 1 -ap -bq) = 1, we get ed 1 -k 1 (N + 1 -p 0 -q 0 -2 m 0 (p 1 + q 1 )) = 1.
Reducing modulo e, we get

-2 m 0 k 1 (p 1 + q 1 ) + (N + 1 -p 0 -q 0 )k 1 + 1 ≡ 0 (mod e).
Observe that gcd(2 m 0 , e) = 1. Then multiplying by -2 -m 0 (mod e), we get where

k 1 (p 1 + q 1 ) + a 1 k 1 + a 2 ≡ 0 (mod e), 120APPENDIX
a 1 ≡ -(N + 1 -p 0 -q 0 )2 -m 0 (mod e), a 2 ≡ -2 -m 0 (mod e).
Consider the polynomial

f (x, y) = xy + a 1 x + a 2 .
Then (x, y) = (k 1 , p 1 + q 1 ) is a modular root of the equation f (x, y) ≡ 0 (mod e). Assuming that α 1 2 , we get

k 1 = ed 1 -1 N + 1 -ap -bq ∼ N γ+δ-1 .
On the other hand, we have

p 1 + q 1 < ap + bq 2 m 0 < N 1 2 +α-β .
Define the bounds X and Y as

X = N γ+δ-1 , Y = N 1 2 +α-β .
To find the small modular roots of the equation f (x, y) ≡ 0 (mod e), we apply the extended strategy of Jochemsz and May [START_REF] Jochemsz | A strategy for finding roots of multivariate polynomials with new applications in attacking RSA variants[END_REF]. Let m and t be positive integers to be specified later. For 0 ≤ k ≤ m, define the set

M k = 0≤j≤t {x i 1 y i 2 +j x i 1 y i 2 monomial of f m (x, y) and x i 1 y i 2 (xy) k monomial of f m-k }.
Observe that f m (x, y) satisfies

f m (x, y) = m i 1 =0 m i 1 x i 1 (y + a 1 ) i 1 a m-i 1 2 = m i 1 =0 m i 1 x i 1 i 1 i 2 =0 i 1 i 2 y i 2 a i 1 -i 2 1 a m-i 1 2 = m i 1 =0 i 1 i 2 =0 m i 1 i 1 i 2 x i 1 y i 2 a i 1 -i 2 1 a m-i 1 2 . Hence, x i 1 y i 2 is a monomial of f m (x, y) if i 1 = 0, . . . , m, i 2 = 0, . . . , i 1 .
Consequently, for 0 ≤ k ≤ m, when x i 1 y i 2 is a monomial of f m (x, y), then

x i 1 y i 2 (xy) k is a monomial of f m-k (x, y) if i 1 = k, . . . , m, i 2 = k, . . . , i 1 .
Hence, for 0 ≤ k ≤ m, we obtain

x i 1 y i 2 ∈ M k if i 1 = k, . . . , m, i 2 = k, . . . , i 1 + t.
Similarly,

x i 1 y i 2 ∈ M k+1 if i 1 = k + 1, . . . , m, i 2 = k + 1, . . . , i 1 + t.
For 0 ≤ k ≤ m, define the polynomials

g k,i 1 ,i 2 (x, y) = x i 1 y i 2 (xy) k f (x, y) k e m-k with x i 1 y i 2 ∈ M k M k+1 .
For 0 ≤ k ≤ m, these polynomials reduce to the following sets

   k =0, . . . , m, i 1 =k, . . . , m, i 2 =k, or    k =0, . . . , m, i 1 =k, i 2 =k + 1, . . . , i 1 + t.
This gives rise to the polynomials

G k,i 1 (x, y) = x i 1 -k f (x, y) k e m-k , for k = 0, . . . m, i 1 = k, . . . m, H k,i 2 (x, y) = y i 2 -k f (x, y) k e m-k , for k = 0, . . . m, i 2 = k + 1, . . . , k + t.
Let L denote the lattice spanned by the coefficient vectors of the polynomials G k,i 1 (xX, yY ) and H k,i 2 (xX, yY ). The ordering of two monomials

x i 1 y i 2 , x i 1 y i 2 is as in the following rule: if i 1 < i 1 , then x i 1 y i 2 < x i 1 y i 2 and if i 1 = i 1 and i 2 < i 2 , then x i 1 y i 2 < x i 1 y i 2 .
Notice that the matrix is left triangular. For m = 3 and t = 1, the coefficient matrix for L is presented in Table D.1. The non-zero elements are marked with an ' '.

From the triangular form of the matrix, the marked values do not contribute in the calculation of the determinant. Hence, the determinant of L is

det(L) = e n e X n X Y n Y .
(D.1)

1 x x 2 x 3 y xy x 2 y x 3 y xy 2 x 2 y 2 x 3 y 2 x 2 y 3 x 3 y 3 x 3 y 4 G 0,0 e 3 0 0 0 0 0 0 0 0 0 0 0 0 0 G 0,1 0 Xe 3 0 0 0 0 0 0 0 0 0 0 0 0 G 0,2 0 0 X 2 e 3 0 0 0 0 0 0 0 0 0 0 0 G 0,3 0 0 0 X 3 e 3 0 0 0 0 0 0 0 0 0 0 H 0,1 0 0 0 0 Y e 3 0 0 0 0 0 0 0 0 0 G 1,1 0 0 0 XY e 2 0 0 0 0 0 0 0 0 G 1,2 0 0 0 0 X 2 Y e 2 0 0 0 0 0 0 0 G 1,3 0 0 0 0 0 X 3 Y e 2 0 0 0 0 0 0 H 1,2 0 0 0 0 0 0 XY 2 e 2 0 0 0 0 0 G 2,2 0 0 0 0 X 2 Y 2 0 0 0 0 G 2,3 0 0 0 0 0 X 3 Y 2 e 0 0 0 H 2,3 0 0 0 0 0 0 X 2 Y 3 e 0 0 G 3,3 0 0 0 X 3 Y 3 0 H 3,4 0 0 0 0 0 X 3 Y 4 Table D.1: The coefficient matrix for the case m = 3, t = 1.
From the construction of the polynomials G k,i 1 (x, y) and H k,i 2 (x, y), we get

n e = m k=0 m i 1 =k (m -k) + m k=0 k+t i 2 =k+1 (m -k) = 1 6 m(m + 1)(2m + 3t + 4).
Similarly, we have

n X = m k=0 m i 1 =k i 1 + m k=0 k+t i 2 =k+1 k = 1 6 m(m + 1)(2m + 3t + 4),
and

n Y = m k=0 m i 1 =k k + m k=0 k+t i 2 =k+1 i 2 = 1 6 (m + 1)(m 2 + 3mt + 3t 2 + 2m + 3t).
Finally, we can calculate the dimension of L as

ω = m k=0 m i 1 =k 1 + m k=0 k+t i 2 =k+1 1 = 1 2 (m + 1)(m + 2t + 2).
For the following asymptotic analysis we let t = τ m. For sufficiently large m, the exponents n e , n X , n Y and the dimension ω reduce to

n e = 1 6 (3τ + 2)m 3 + o(m 3 ), n X = 1 6 (3τ + 2)m 3 + o(m 3 ), n Y = 1 6 (3τ 2 + 3τ + 1)m 3 + o(m 3 ), ω = 1 2 (2τ + 1)m 2 + o(m 2 ).
To apply Theorem D.2.2 to the shortest vector in the LLL-reduced basis of L, we have to set

2 ω 2 det(L) 1 ω-1 < e m √ ω .
This transforms to

det(L) < 1 2 ω 2 √
ω ω e m(ω-1) < e mω .

Using (D.1), we get e n e X n X Y n Y < e mω .

Plugging n e , n X , n Y , ω as well as the values e = N γ , X = N γ+δ-1 , and

Y = N 1 2 +α-β , we get 1 6 (3τ + 2)m 3 γ + 1 6 (3τ + 2)m 3 (γ + δ -1) + 1 6 (3τ 2 + 3τ + 1)m 3 ( 1 2 + α -β) < 1 2 (2τ + 1)m 3 γ, which transforms to 3(2α -2β + 1)τ 2 + 3(2α + 2δ -2β -1)τ + (2γ + 2α + 4δ -2β -3) < 0. (D.2)
Next, we consider the cases τ = 0 and τ = 0 separately. First, we consider the case τ > 0. The optimal value for τ in the left side of (D.2) is

τ = 1 + 2β -2α -2δ 2(1 + 2α -2β) . (D.3)
Observe that for α < 1 2 and β < 1 2 , we have 1 + 2α -2β > 0. To ensure τ > 0, δ should satisfy δ < δ 0 where

δ 0 = 1 2 (1 -2(α -β)) . (D.4)
Replacing τ by the optimal value (D.3) in the inequation (D.2), we get

-12δ 2 + 4(7 + 2α -2β)δ + 4(α -β) 2 + 4(4γ -1)(α -β) + 8γ -15 < 0,
which will be true if δ < δ 1 where

δ 1 = 1 3 (α -β) + 7 6 - 1 3 4(α -β) 2 + 4(3γ + 1)(α -β) + 6γ + 1. (D.5)
Since δ has to satisfy both δ < δ 0 and δ < δ 1 according to (D.4) and (D.5), let us find the minimum min(δ 0 , δ 1 ). A straightforward calculation shows that

min(δ 0 , δ 1 ) = δ 0 if γ ≤ 1 2 (1 + 2α -2β), δ 1 if γ ≥ 1 2 (1 + 2α -2β
). Now, consider the case τ = 0, that is t = 0. Then the inequation (D.2) becomes 2γ + 2α + 4δ -2β -3 < 0, which leads to δ < δ 2 where

δ 2 = 1 4 (2β + 3 -2γ -2α). (D.6)
To obtain an optimal value for δ, we compare δ 2 as in (D.6) to min(δ 0 , δ 1 ), obtained respectively with τ > 0 and τ = 0. First suppose that γ

≤ 1 2 (1 + 2α -2β). Then min(δ 0 , δ 1 ) -δ 2 = δ 0 -δ 2 = 1 2 g - 1 2 (1 + 2α -2β) ≤ 0. Hence min(δ 0 , δ 1 ) ≤ δ 2 . Next suppose that γ ≥ 1 2 (1 + 2(α -β)). Then min(δ 0 , δ 1 ) -δ 2 = δ 1 -δ 2 = 5 6 (α -β) + 1 2 γ + 5 12
- 1 3 4(α -β) 2 + 4(3γ + 1)(α -β) + 6γ + 1.
On the other hand, we have

5 6 (α -β) + 1 2 γ + 5 12 2 - 1 3 4(α -β) 2 + 4(3γ + 1)(α -β) + 6γ + 1 2 = 1 16 (1 + 2(α -β) -2γ) 2 ,
which implies that min(δ 0 , δ 1 ) ≥ δ 2 .

Summarizing, the attack will succeed to find k 1 , p 1 + q 1 and d 1 = N δ when δ < δ with

δ = δ 1 if γ ≥ 1 2 (1 + 2α -2β), δ 2 if γ ≤ 1 2 (1 + 2α -2β)
, where δ 1 and δ 2 are given by (D.5) and (D.6).

Next, using the known value of p 1 + q 1 , we can precisely calculate the value ap + bq = 2 m 0 (p 1 + q 1 ) + p 0 + q 0 = S. Then using Lemma D.2.3 and Lemma D.2.4, we can find p and q. Since every step in the method can be done in polynomial time, then N can be factored in polynomial time. This terminates the proof.

For example, consider the standard instance with the following parameters

• 2 m 0 = N β with β = 0. • a ≤ b ≤ N α with α = 0, that is ap + bq = p + q. • ap = 2 m 0 p 1 + p 0 = p 1 , that is p 0 = 0.
• bq = 2 m 0 q 1 + q 0 = q 1 , that is q 0 = 0.

• e = N γ with γ = 1.

• d 1 = N δ . Then γ ≥ 1 2 (1 + 2α -2β) > 1 2 and the instance is insecure if δ < δ 1 , that is if δ < 7 6 - √ 7
3 ≈ 0.284 which is the same boundary as in various cryptanalytic approaches to RSA (see e.g. [17]).

δ 1 < 7 6 - 1 3 β - 1 3 4β 2 -16β + 7,
where the right side increases from 0.284 to 1 when β ∈ 0, 1 2 . This implies that the existence of good approximation a b of q p substantially reduces the requirement of LSBs of ap and bq for the new attack. This confirms the recommendation of the X9.31-1997 standard for public key cryptography [1] regarding the generation of primes, namely that q p shall not be near the ratio of two small integers.

D.4 Experimental Results

We have implemented the new attack for various parameters. The machine was with Windows 7 and Intel(R) Core(TM)2 Duo CPU, 2GHz and the algebra system was Maple 12 [90]. For each set of parameters, we solved the modular equation f (x, y) ≡ 0 (mod e) using the method described in Section D.3. We obtained two polynomials f 1 (x, y) and f 2 (x, y) with the expected root (k 1 , p 1 + q 1 ). We then solved the equation obtained using the resultant of f 1 (x, y) and f 2 (x, y) in one of the variables. For every instance, we could recover k 1 and p 1 + q 1 and hence factor N . The experimental results are shown in Table D.2

In the rest of this section, we present a detailed numerical example. Consider an instance of a 200-bit RSA public key with the following parameters.

• N = 246320082143813941567955319095334323576128\ 7240746891883363309.

• e = 266625289801406462041749617541089513158406\ 651283204161816153.

Hence e = N γ with γ = 0.984.

• m 0 = 35. Hence 2 m 0 = N β with β = 0.174.

• a < b < N 0.080 . Hence α = 0.080. • m = 4, t = 2. Now suppose we know p 0 = 28297245379 and q 0 = 28341074839 such that ap = 2 m 0 p 1 + p 0 and bq = 2 m 0 q 1 + q 0 . The modular equation to solve is then f (x, y) = xy + a 1 x + a 2 ≡ 0 (mod e), where

a 1 = 39647847095344866596181159701545336706740936762\ 997081713297, a 2 = 23087066210610578500111693688056153546690310769\
3317985538102.

Working with m = 4 and t = 2, we get a lattice with dimension ω = 25.

Using the parameters γ = 0.984, α = 0.080, and β = 0.174, the method will succeed with the bounds X and Y satisfying

p 1 + q 1 < X = N γ+δ-1 ≈ 2 52 , k 1 < Y = N 1 2 +α-β ≈ 2 81 ,
if δ < 0.356. Applying the LLL algorithm, we find two polynomials f 1 (x, y) and f 2 (x, y) sharing the same integer solution. Then solving the resultant equation in y, we get x = 4535179907267444 and solving the resultant equation in x, we get y = 3609045068101717298446784. Hence Hence q = N p = 828358562917839001533347328061. This terminates the factorization of the modulus N . Using the equation ed 1 = k 1 (N + 1 -apbq) + 1, we get d 1 = 41897971798817657 ≈ N 0.275 . We notice that, with the standard RSA equation ed -kφ(N ) = 1, we have d ≡ e -1 (mod φ(N )) ≈ N 0.994 which is out of reach of the attack of Boneh and Durfee as well as the attack of Blömer and May. Also, using 2ap = S-D, we get a = S-D 2p = 20851. Similarly, using 2bq = S + D, we get b = S+D 2q = 74851. We notice that gcd(a, b) = 1 and a b is not among the convergents of q p . This shows that Nitaj's attack as presented in [START_REF] Nitaj | Cryptanalysis of RSA using the ratio of the primes[END_REF] can not succeed to factor the RSA modulus in this example.

p 1 + q 1 = 4535179907267444, k 1 = 3609045068101717298446784.

D.5 Conclusion

In this paper, we propose a new polynomial time attack on RSA with a public exponent satisfying an equation ed 1 -k 1 (N + 1 -ap -bq) = 1 where a b is an unknown approximation of q p and where certain amount of the Least Significant Bits of ap and aq are known to the attacker. The attack is based on the method of Coppersmith for solving modular polynomial equations. This attack can be seen as an extension of the well known partial key attack on RSA when a = b = 1 and certain amount of the Least Significant Bits of one of the modulus prime factors is known.

primes, the method of Faugère et al. provably factors N 1 and N 2 as soon as p 1 and p 2 share t ≥ 2α + 3 MSBs. The method heuristically generalizes to the case when p 1 and p 2 share an amount of bits in the middle. It also heuristically generalizes to k RSA moduli N 1 = p 1 q 1 , . . . , N k = p k q k when the p i 's share t ≥ k k-1 α + 6 of MSBs. In IWSEC 2013, Kurosawa and Ueda [START_REF] Kurosawa | Low exponent attack against elliptic curve RSA, Low exponent attack against elliptic curve RSA[END_REF] presented a lattice-based method to factor two RSA moduli N 1 = p 1 q 1 and N 2 = p 2 q 2 of the same bit size when p 1 and p 2 share t LSBs with t ≥ 2α + 1 where q 1 ≈ q 2 ≈ 2 α . Their method takes advantage on using Gaussian reduction techniques. It slightly improves the bound t ≥ 2α + 3 of May and Ritzenhofen. We notice that Kurosawa and Ueda did not study a number of possible extensions of their method, namely, when p 1 and p 2 share t MSBs and also when the multiple of the primes share LSB's and MSB's.

All the former attacks apply when the RSA moduli N 1 = p 1 q 1 , . . . , N k = p k q k are of the same bit-size and the p i 's share an amount of MSBs, LSBs or bits in the middle. In this paper, we present novel approaches of implicit factoring that generalize the former attacks and apply when some unknown multiples a i p i of the prime factors p i share an amount of MSBs or of LSBs.

Our first method concerns two RSA moduli N 1 = p 1 q 1 , N 2 = p 2 q 2 of arbitrarily sizes in the situation that there exist two integers a 1 , a 2 such that a 1 p 1 and a 2 p 2 share t many MSBs. We show that, using the continued fraction expansion of N 2 N 1 , one can factor simultaneously N 1 and N 2 whenever |a 1 p 1 -a 2 p 2 | < p 1 2a 2 q 1 q 2 . In particular, when N 1 and N 2 are of the same bit size and q 1 , q 2 are α-bit primes, then one can factor N 1 and N 2 whenever a i ≤ 2 β for i = 1, 2 and t ≥ 2α + 2β + 1. When β = 0, that is a 1 = a 2 = 1, our result becomes t ≥ 2α + 1 and improves the bound t ≥ 2α + 3 presented in [START_REF] Sarkar | Further results on implicit factoring in polynomial time[END_REF] and [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF] where the methods are based on lattice reduction techniques.

Our second method is a heuristic generalization of the first method to an arbitrary number k ≥ 3 of RSA moduli N i = p i q i , i = 1, . . . , k in the situation that there exist k integers a i such that the a i p i 's share t many MSBs. When the RSA moduli are of the same bit size and the factors q i , i = 1, . . . , k, are α-bit primes, the method allows us to factor the RSA moduli as soon as

t > k k -1 α + k 2 k -1 β + k 2(k -1) (1 + log 2 (πe)) , (E.1)
where β is such that a i ≤ 2 β . Once again, with β = 0, we improve the bound presented in the attack of [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF].

Our third method addresses the implicit factoring problem when two unbalanced RSA moduli N 1 = p 1 q 1 and N 2 = p 2 q 2 of arbitrarily sizes are such that there exist two integers a 1 and a 2 such that a 1 p 1 and a 2 p 2 share t many LSBs. We show that it is possible to factor both N 1 and N 2 if a 1 a 2 q 1 q 2 < 2 t-1 . This method is also based on the continued fraction algorithm, applied to T 2 t where T ≡ N 2 N -1 1 (mod 2 t ). We notice that, when a 1 = a 2 = 1 and q 1 , q 2 are α-bit primes, the former condition on t transforms to t ≥ 2α + 1 which improves the bound on t for LSBs in [START_REF] May | Implicit factoring: On polynomial time factoring given only an implicit hint[END_REF] and [START_REF] Sarkar | Further results on implicit factoring in polynomial time[END_REF] and retrieves the bound of [START_REF] Kurosawa | Low exponent attack against elliptic curve RSA, Low exponent attack against elliptic curve RSA[END_REF].

Our fourth method is a generalization of the third method to k ≥ 3 RSA moduli N i = p i q i , i = 1, . . . , k. Assume that there exist k integers a i such that the a i p i 's share t many LSBs. If the RSA moduli are of the same bit size and the q i 's are α-bit primes, our method allows us to address the implicit factoring problem whenever t satisfies (E.1) where β is such that a i ≤ 2 β .

In fact our findings under the four scenarios, further discus possible malicious key generation of RSA moduli by observing not only the difference between primes, but also the differences of the multiple of primes. At the same time it generalizes the previous works by [START_REF] May | Implicit factoring: On polynomial time factoring given only an implicit hint[END_REF], [START_REF] Sarkar | Further results on implicit factoring in polynomial time[END_REF], [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF] and [START_REF] Kurosawa | Low exponent attack against elliptic curve RSA, Low exponent attack against elliptic curve RSA[END_REF]. Contrarily to the previous works, we study all the possible situations involving k = 2 as well as k ≥ 3 in both cases of MSBs and LSBs. In Table E.1, we compare the applicability of our methods against the previous methods for the different scenarios. Also, we notice that not only the new bounds improve the previous ones, but also that the rank of the new underlying lattices are often lower than the ranks of the lattices used in the former methods. In Table E.2 and Table E.3, we compare our results against the former results with k RSA moduli in terms of bounds and dimension of the lattices.

We apply our results to the implicit factorization of k ≥ 2 RSA for Paranoids [START_REF] Shamir | RSA for Paranoids[END_REF] N i = p i q i , i = 1, . . . , k, where p i ≈ 2 4500 and q i ≈ 2 500 . For example, we show that we can easily factor two RSA for Paranoids moduli N 1 = p 1 q 1 , N 2 = p 2 q 2 if there exist two integers a 1 and a 2 such that a 1 p 1 and a 2 p 2 share t MSBs or t LSBs with t ≥ 1001 + 2β where β is such that a i ≤ 2 β for i = 1, 2.

The rest of this paper is organized as follows. In Section 2, we introduce some useful background on continued fractions and lattice basis reduction. In section 3, we present our first method to address the problem of implicit factoring of two RSA moduli N 1 = p 1 q 1 and N 2 = p 2 q 2 when a 1 p 1 and a 2 p 2 share t MSBs. In section 4, we present a generalization to k ≥ 3 RSA moduli N i = p i q i , i = 1, . . . , k, in the situation that the a i p i 's share t MSBs. In section 5, we present an attack on two RSA moduli N 1 = p 1 q 1 and N 2 = p 2 q 2 when a 1 p 1 and a 2 p 2 share t LSBs and we generalize this attack to k ≥ 3 RSA moduli in Section 6. In Section 7, we present our experiments and we conclude in Section 8. For q 1 ≈ q 2 ≈ 2 α and |p 1 -p 2 | < 2 t , the bound is heuristically better than t ≥ 2α + 3 and the dimension of the lattice is at least 9 (m = t = 1).

Can not be applied Faugère et al. [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF] For q 1 ≈ q 2 ≈ 2 α and |p 1 -p 2 | < 2 t , the rigorous bound is t ≥ 2α + 3 using 2dimensional lattices of Z 3 .

For

q 1 ≈ . . . ≈ q k ≈ 2 α and |p i -p j | < 2 t , the heuris- tic bound is t > k k-1 α + 1 + k 2(k-1) 2 + log 2 (k) 2 + log 2 (πe) using k-dimensional lat- tices of Z k(k+1) 2 .
Kurosawa, Ueda [START_REF] Kurosawa | Low exponent attack against elliptic curve RSA, Low exponent attack against elliptic curve RSA[END_REF] Not studied.

Can not be applied

Our results

For q 1 ≈ q 2 ≈ 2 α and |a 1 p 1 -a 2 p 2 | < 2 t for some unknown integers a 1 , a 2 ≤ 2 β , the rigorous bound is t ≥ 2α + 2β + 1 using the continued fraction algorithm. For a 1 = a 2 = 1, β = 0 and the the rigorous bound is t ≥ 2α + 1.

For q 1 ≈ . . . ≈ q k ≈ 2 α and |a i p i -a j p j | < 2 t for some unknown integers a 1 , . . . , a k , the heuristic bound is t For q 1 ≈ q 2 ≈ 2 α and p 1 ≡ p 2 (mod 2 t ), the rigorous bound is t ≥ 2α + 3 using 2dimensional lattices of Z 2 .

> k k-1 α+ k 2 k-1 β+ k 2(k-1) (1 + log 2 (πe)) using k-dimensional lattices of Z k . For a 1 = . . . = a k = 1, β = 0 and the the heuris- tic bound is t > k k-1 α + k 2(k-1) (1 + log 2 (πe)).
For q 1 ≈ . . . ≈ q k ≈ 2 α and p i ≡ p j (mod 2 t ), the heuristic bound is t

≥ k k-1 α using k-dimensional lattices of Z k .
Sarkar, Maitra [START_REF] Sarkar | Further results on implicit factoring in polynomial time[END_REF] For q 1 ≈ q 2 ≈ 2 α and p 1 ≡ p 2 (mod 2 t ), the bound is heuristically better than t ≥ 2α + 3 and the dimension of the lattice is at least 9 (m = t = 1).

Can not be applied.

Faugère et al. [45]

Not studied. Not studied.

Kurosawa, Ueda [82]

For q 1 ≈ q 2 ≈ 2 α and p 1 ≡ p 2 (mod 2 t ), the rigorous bound is t ≥ 3α + 1 using 2dimensional lattices of Z 2 .

Can not be applied

Our results

For q 1 ≈ q 2 ≈ 2 α and |a 1 p 1 -a 2 p 2 | < 2 t for some unknown integers a 1 , a 2 ≤ 2 β , the rigorous bound is t ≥ 2α + 2β + 1 using the continued fraction algorithm. For a 1 = a 2 = 1, β = 0 and the the rigorous bound is t ≥ 2α + 1.

For q 1 ≈ . . . ≈ q k ≈ 2 α and a i p i ≡ a j p j (mod 2 t ) for some unknown integers a 1 , . . . , a k , the heuristic bound is

t > k k-1 α+ k 2 k-1 β+ k 2(k-1) (1 + log 2 (πe)) using k-dimensional lattices of Z k . For a 1 = . . . = a k = 1, β = 0 and the the heuris- tic bound is t > k k-1 α + k 2(k-1) (1 + log 2 (πe)).

E.2 Preliminaries

In this section, we review some knowledge background on continued fractions and lattice basis reduction.

E.2.1 Continued fractions

First we give the definition of continued fractions and state a related theorem. The details can be referenced in [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]. For any positive real number ξ, define ξ 0 = ξ and for i = 0, 1, . . . , n, a i = ξ i , ξ i+1 = 1/(ξ i -a i ) unless ξ n is an integer. Then ξ can be expanded as a continued fraction in the following form

x = a 0 + 1 a 1 + 1 . . . + 1 a n + 1 . . .
, which, for simplicity, can be rewritten as ξ = [a 0 , a 1 , . . . , a n , . . .]. If ξ is a rational number, then the process of calculating the continued fraction expansion would be finished in some finite index n and then ξ = [a 0 , a 1 , . . . , a n ]. The convergents a b of ξ are the fractions defined by a b = [a 0 , . . . , a i ] for i ≥ 0. We note that, if ξ = a b is a rational number, then the continued fraction expansion of ξ is finite with the total number of convergents being polynomial in log(b).

Another important result on continued fractions that will be used throughout this paper is the following (Theorem 184 of [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]).

Theorem E.2.1 (Legendre). Let ξ be a positive number. Suppose gcd(a, b) = 1 and

ξ - a b < 1 2b 2 .
Then a b is one of the convergents of the continued fraction expansion of ξ. On the other hand, for comparison, the Gaussian Heuristic says that the length of the shortest non-zero vector of a lattice L is usually approximately σ(L) where

σ(L) ≈ d 2πe det(L) 1 d .

E.3 Factoring two RSA Moduli in the MSB Case

In this section, we study the problem of factoring two RSA moduli N 1 = p 1 q 1 and N 2 = p 2 q 2 where a 1 p 1 and a 2 p 2 coincide on the t most significant bits (MSBs), that is when |a 2 p 2 -a 1 p 1 | is sufficiently small.

E.3.1 The general attack for two RSA Moduli in the MSB Case

We begin by the following result which applies to two RSA moduli not necessarily of the same bit size.

Theorem E.3.1. Let N 1 = p 1 q 1 , N 2 = p 2 q 2 be two RSA moduli. If there exist two integers a 1 , a 2 such that a 1 < p 2 , a 2 < p 1 and |a 1 p 1 -a 2 p 2 | < p 1 2a 2 q 1 q 2 , then one can factor N 1 and N 2 in polynomial time.

Proof. For N 1 = p 1 q 1 and N 2 = p 2 q 2 , let x = a 1 p 1 -a 2 p 2 . Multiplying x by q 2 , we get a 1 p 1 q 2 -a 2 N 2 = xq 2 . Suppose that |x| < p 1 2a 2 q 1 q 2 . Then, dividing by a 2 N 1 = a 2 p 1 q 1 , we get

N 2 N 1 - a 1 q 2 a 2 q 1 = |x|q 2 a 2 p 1 q 1 < p 1 2a 2 q 1 q 2 × q 2 a 2 p 1 q 1 = 1 2(a 2 q 1 ) 2 .
Hence, from Theorem E.2.1, it follows that a 1 q 2 a 2 q 1 , in lowest term is one of the convergents in the continued fraction expansion of N 2 N 1 . If we assume a 1 < p 2 , a 2 < p 1 , then using a 1 q 2 a 2 q 1 , we get q 1 = gcd(N 1 , a 2 q 1 ) and therefore p 1 = N 1 q 1 . Similarly, we get q 2 = gcd(N 2 , a 1 q 2 ) and p 2 = N 2 q 2 . Remark E.3.2. The result of Theorem E.3.1 is valid even when the RSA moduli are not of the same size. Comparatively, the attacks presented by Sarkar and Maitra in [START_REF] Sarkar | Further results on implicit factoring in polynomial time[END_REF] and Faugère et al. in [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF] are valid only if N 1 ≈ N 2 and q 1 ≈ q 2 . Example E.3.3. Consider the following RSA moduli

N 1 = 63431782986412625310912155582547071972279848634479, N 2 = 9946006657067710178027582903059286609914354223.
The first partial quotients of Each convergent a b of N 2 N 1 is a candidate for a 1 q 2 a 2 q 1 and the good one will reveal q 1 and q 2 if the conditions of Theorem E.3.1 are fulfilled. Indeed, the 40th convergent is a b = 1351300027964332 8618068847003717463 and gives q 1 = gcd(N 1 , b) = 2125300178867,

p 1 = N 1 q 1 = 29846034747067203786403150576377329237, q 2 = gcd(N 2 , a) = 9531501481, p 2 = N 2 q 2 = 1043487920228935667940393294165327383.
We notice that p 1 and p 2 do not share any amount of LSBst nor MSBs nor bits in the middle. This shows that the attacks presented in [START_REF] Sarkar | Further results on implicit factoring in polynomial time[END_REF] and [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF] will not give a result in this situation.

E.3.2 Application to unbalanced RSA and RSA for Paranoids

As an application of Theorem E.3.1 to factor two unbalanced RSA moduli of the same bit-size, we get the following result.

Corollary E.3.4. Let N 1 = p 1 q 1 , N 2 = p 2 q 2 be two unbalanced RSA moduli of the same bit-size n. Suppose that q i ≈ 2 α , p i ≈ 2 n-α for i = 1, 2. Let a 1 , a 2 be two integers such that a i ≤ 2 β , i = 1, 2. If a 1 p 1 and a 2 p 2 share t most significant bits with t ≥ 2α + 2β + 1, then one can factor N 1 and N 2 in polynomial time.

Proof. Let N 1 = p 1 q 1 , N 2 = p 2 q 2 be two RSA moduli with N 1 ≈ N 2 ≈ 2 n and q 1 ≈ q 2 ≈ 2 α . Suppose that a multiple a 1 p 1 and a multiple a 2 p 2 share the t most significant bits, that is

a 1 p 1 -a 2 p 2 = x with |x| ≤ 2 n-α+β-t . Assume that t ≥ 2α + 2β + 1. Then 2a 2 q 1 q 2 |x| < 2 1+β+2α+n-α+β-t ≤ 2 n-α ≈ p 1 ,
which can be transformed into the inequality |x| < p 1 2a 2 q 1 q 2 . Hence, as in Theorem E.3.1, it follows that a 1 q 2 a 2 q 1 is a convergent of the continued fraction of N 2 N 1 which leads to the factorization of N 1 and N 2 .

Remark E.3.5. If we consider β = 0 in Corollary E.3.4, that is, if a 1 = a 2 = 1, a sufficient condition to factor the two RSA moduli is t ≥ 2α + 1 which slightly improves the bound t ≥ 2α + 3 found by Faugère et al. in [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF].

This shows that the bound found by Faugère et al. with lattice reduction techniques can be achieved using the continued fraction algorithm instead.

Consider two RSA for Paranoids moduli N i = p i q i with N i ≈ 2 5000 , q i ≈ 2 500 and p i ≈ 2 4500 for i = 1, 2. Then α = 500 and by Corollary E.3.4, it is possible to factor N 1 and N 2 if a multiple a 1 p 1 and a multiple a 2 p 2 share the t MSBs whenever t ≥ 2α + 2β + 1, that is whenever t ≥ 1001 + 2β.

E.4 Factoring k RSA Moduli in the MSB Case

The attack mounted for two RSA moduli can be generalized to an arbitrary number k ≥ 3 of moduli N i = p i q i , i = 1 . . . , k where the q i 's are α-bit primes and the a i p i 's share t MSBs. Instead of using the continued fraction algorithm, we use a lattice based method to find simultaneous diophantine approximations.

Theorem E.4.1. Let N i = p i q i , i = 1 . . . , k, be k ≥ 3 n-bit RSA moduli where the q i 's are α-bit primes. Suppose that there exist k integers a 1 , . . . , a k with a i ≤ 2 β , i = 1, . . . , k, such that the a i p i 's share all t most significant bits. If

t > k k -1 α + k 2 k -1 β + k 2(k -1) (1 + log 2 (πe)) ,
then, under the Gaussian Heuristic assumption, one can factor the k RSA

moduli N 1 , • • • , N k in polynomial time. Proof. For 2 ≤ i ≤ k, we set x i = a i p i -a 1 p 1 .
Then, multiplying by q 1 q i , we get a i q 1 N i -a 1 q i N 1 = q 1 q i x i . Define a = k j=1 a j . Multiplying by a a i , we get

aq 1 N i - aa 1 q i a i N 1 = aq 1 q i x i a i .
Let C be a number to be fixed later. Consider the vector

v = Caq 1 , aq 1 q 2 x 2 a 2 , . . . , aq 1 q k x k a k ∈ Z k . (E.2) Then v = aq 1 , aa 1 q 2 a 2 . . . , aa 1 q k a k × M, where M is the k × k-matrix M =               C N 2 N 3 . . . N k-1 N k 0 -N 1 0 . . . 0 0 0 0 -N 1 . . . 0 0 . . . . . . . . . . . . . . . . . . 0 0 0 . . . -N 1 0 0 0 0 . . . 0 -N 1               .
Let L be the lattice defined by the rows of M . The dimension of L is k and the determinant is det(L) = CN k-1

1

. The Gaussian Heuristic for L asserts that the length of its shortest non-zero vector is usually σ(L) where

σ(L) ≈ k 2πe det(L) 1 k = k 2πe C 1 k N k-1 k 1 . (E.3)
If we choose C such that σ(L) > v , then v can be found among the shortest non-zero vectors of the lattice L. Using (E.2), we get

v 2 = C 2 a 2 q 2 1 + k i=2 a 2 q 2 1 q 2 i x 2 i a 2 i . (E.4)
Suppose that for i = 1, . . . , k, we have

N i ≈ 2 n , q i ≈ 2 α , p i ≈ 2 n-α , a i ≤ 2 β .
Moreover, suppose that the a i p i 's share all t MSBs. Then, for i ≥ 2, we have

|x i | = |a i p i -a 1 p 1 | ≤ 2 n-α+β-t .
Hence (E.4) leads to

v 2 < C 2 × 2 2kβ+2α + (k -1)2 2kβ+4α+2(n+β-α-t)-2β = C 2 × 2 2kβ+2α + (k -1) × 2 2kβ+2α+2n-2t . Define C such that C 2 × 2 2kβ+2α ≥ 2 2kβ+2α+2n-2t , that is C ≥ 2 n-t . Then v 2 < kC 2 × 2 2kβ+2α
. On the other hand, using N i ≈ 2 n in (E.3), we get

σ(L) 2 ≈ k 2πe C 2 k × 2 2n(k-1) k . Suppose σ(L) > v . Then σ(L) 2 > v 2 , that is k 2πe C 2 k 2 2n(k-1) k > kC 2 × 2 2kβ+2α . Hence C 2(k-1) k < 1 πe 2 2n(k-1) k -2kβ-2α-1 .
Plugging C ≥ 2 n-t and extracting t, we get

t > k k -1 α + k 2 k -1 β + k 2(k -1)
(1 + log 2 (πe)) .

Using (E.2), we get q 1 = gcd(Caq 1 , N 1 ) and for i = 2, . . . , k, q i = gcd( aa 1 q i a i , N i ). This terminates the proof.

We notice that with β = 0, that is a i = 1 for i = 1, . . . , k, we get

t > k k -1 α + k 2(k -1) (1 + log 2 (πe)) ,
which slightly improves the bound obtained by Faugère et al. in [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF]. This shows that our result extends the result of Faugère et al. where they considered only the case when the p i 's share t MSBs.

E.5 Factoring Two RSA Moduli in the LSB Case

The study of implicit factorization when p 1 , p 2 share some LSBs has been considered in [START_REF] May | Implicit factoring: On polynomial time factoring given only an implicit hint[END_REF], [START_REF] Sarkar | Further results on implicit factoring in polynomial time[END_REF], [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF] and [START_REF] Kurosawa | Low exponent attack against elliptic curve RSA, Low exponent attack against elliptic curve RSA[END_REF]. In this section, we extend the former attacks to the case where an unknown multiple a 1 p 1 of p 1 and an unknown multiple a 2 p 2 of p 2 share their t LSBs.

E.5.1 The general attack

Theorem E.5.1. Let N 1 = p 1 q 1 , N 2 = p 2 q 2 be two RSA moduli. Assume that there exist two integers a 1 , a 2 with a 1 < p 2 , a 2 < p 1 such that a 1 p 1 and a 2 p 2 share t many LSBs. If a 1 a 2 q 1 q 2 < 2 t-1 , then one can factor N 1 and N 2 in polynomial time.

Proof. Let N 1 = p 1 q 1 and N 2 = p 2 q 2 . Assume that a 1 p 1 and a 2 p 2 share t many LSBs. Then a 1 p 1 -a 2 p 2 = 2 t x for some integer x and we have

q 1 q 2 (a 1 p 1 -a 2 p 2 ) = N 1 a 1 q 2 -N 2 a 2 q 1 = 2 t xq 1 q 2 .
Then N 1 a 1 q 2 -N 2 a 2 q 1 ≡ 0 (mod 2 t ). Since gcd(N 1 , 2) = 1, then N -1 1 (mod 2 t ) exists and a 1 q 2 -a 2 q 1 N 2 N -1

1 ≡ 0 (mod 2 t ). Define T ≡ N 2 N -1 1
(mod 2 t ). Then a 1 q 2 -a 2 q 1 T ≡ 0 (mod 2 t ) and there exists an integer y such that

a 1 q 2 = a 2 q 1 T -2 t y. (E.5)
Suppose that a 1 a 2 q 1 q 2 < 2 t-1 . Then dividing by 2 t a 2 q 1 , we get

T 2 t - y a 2 q 1 = |a 2 q 1 T -2 t y| 2 t a 2 q 1 = a 1 q 2 2 t a 2 q 1 < a 1 q 2 2a 1 a 2 q 1 q 2 a 2 q 1 = 1 2(a 2 q 1 ) 2 .
Therefore from Theorem E.2.1, it follows that y a 2 q 1 is one of the convergents in the continued fraction expansion of T 2 t . Since a 2 < p 1 , we get q 1 = gcd(N 1, a 2 q 1 ) and p 1 = N 1 q 1 . Using (E.5), we get a 1 q 2 = a 2 q 1 T -2 t y. Similarly, since a 1 < p 2 , we get q 2 = gcd(N 2 , a 1 q 2 ) and p 2 = N 2 q 2 . This terminates the proof.

E.5.2 Application to unbalanced RSA and RSA for Paranoids

Here we apply Theorem E.5.1 in the situation that the two RSA moduli N 1 = p 1 q 1 , N 2 = p 2 q 2 are of the same shape, that is N 1 and N 2 are of the same bit-size and the q i 's are α-bit primes.

Corollary E.5.2. Let N 1 = p 1 q 1 , N 2 = p 2 q 2 be two unbalanced n-bit size RSA moduli with q 1 ≈ q 2 ≈ 2 α . Suppose that there exist two positive integers a 1 ≤ 2 β , a 2 ≤ 2 β such that a 1 p 1 and a 2 p 2 share the t LSBs. If t ≥ 2α +2β +1, then one can factor N 1 and N 2 in polynomial time.

Proof. Let N 1 = p 1 q 1 , N 2 = p 2 q 2 be two RSA moduli with N 1 ≈ N 2 ≈ 2 n and, q 1 ≈ q 2 ≈ 2 α . Suppose that a multiple a 1 p 1 and a multiple a 2 p 2 share the t least significant bits where a i ≤ 2 β for i = 1, 2. Define T ≡ N 2 N -1 1 (mod 2 t ). As in the proof of Theorem E.5.1, we have a 1 p 1 -a 2 p 2 = 2 t x and a 1 q 2 = a 2 q 1 T -2 t y for some integers x and y. Suppose that t ≥ 2α + 2β + 1. Then a 1 a 2 q 1 q 2 < 2 2β+2α ≤ 2 t-1 . Therefore, using the same arguments than Theorem E.5.1, we conclude that y a 2 q 1 is one of the convergents in the continued fraction expansion of T 2 t which leads to the factorization of N 1 and N 2 .

Remark E.5.3. Here again, if β = 0, then the condition of Corollary E.5.2 becomes t ≥ 2α + 1 which improves the bounds found in the former approaches of [START_REF] May | Implicit factoring: On polynomial time factoring given only an implicit hint[END_REF], [START_REF] Sarkar | Further results on implicit factoring in polynomial time[END_REF], [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF] and retrieves the bound of [START_REF] Kurosawa | Low exponent attack against elliptic curve RSA, Low exponent attack against elliptic curve RSA[END_REF].

As an application of Corollary E.5.2, consider two 1024-bit RSA for Paranoids moduli N 1 = p 1 q 1 , N 2 = p 2 q 2 where q 1 , q 2 are 500-bit primes. Hence α = 500 and using Corollary E.5.2, one can factor N 1 and N 2 if there exist two integers a 1 ≤ 2 β and a 2 ≤ 2 β such that a 1 p 1 and a 2 p 2 share t LSBs with t > 2001 + 2β.

E.6 Factoring k RSA Moduli in the LSB Case

In this section, we assume that we are given k ≥ 3 different RSA moduli N i = p i q i , i = 1, . . . , k where some unknown multiples a i p i 's coincide on the t least significant bits. For suitably large t, we show that there is an efficient algorithm that recovers the factorization of the k RSA moduli. To this end, we use the lattice reduction techniques to solve a simultaneous diophantine approximations problem.

Theorem E.6.1. Let N i = p i q i , i = 1 . . . , k, be k ≥ 3 n-bit RSA moduli where the q i 's are α-bit primes. Suppose that there exist k positive integers a 1 , . . . , a k with a i ≤ 2 β , i = 1, . . . , k, such that the a i p i 's share all t least significant bits. If

t > k k -1 α + k 2 k -1 β + k 2(k -1) (1 + log 2 (πe)) ,
then, under the Gaussian Heuristic assumption, one can factor the k RSA moduli N 1 , • • • N k in polynomial time.

Proof. For 1 ≤ i ≤ k, suppose that the a i p i 's share t least significant bits. Then, for 1 ≤ i ≤ k, a i p i -a 1 p 1 = 2 t x i . Multiplying by q 1 q i , we get a i q 1 N ia 1 q i N 1 = 2 t q 1 q i x i . Define a = k j=1 a j . Multiplying by a a i , we get

aq 1 N i - aa 1 q i a i N 1 = 2 t aq 1 q i x i a i .
Transforming modulo 2 t , we get aq

1 N i N -t 1 -aa 1 q i a i ≡ 0 (mod 2 t ). Define T i ≡ N i N -1 1 (mod 2 t ).
Then aq 1 T i -aa 1 q i a i ≡ 0 (mod 2 t ) and there exists an integer y i such that aq 1 T i -2 t y i = aa 1 q i a i . Consider the vector

v = aq 1 , aa 1 q 2 a 2 , . . . , aa 1 q k a k ∈ Z k . (E.6) Then v = (aq 1 , y 2 . . . , y k ) × M, where M is the k × k-matrix M =               1 T 2 T 3 . . . T k-1 T k 0 -2 t 0 . . . 0 0 0 0 -2 t . . . 0 0 . . . . . . . . . . . . . . . . . . 0 0 0 . . . -2 t 0 0 0 0 . . . 0 -2 t               .
Let L be the lattice defined by the rows of the matrix M . The dimension of L is k and the determinant is det(L) = 2 (k-1)t . The Gaussian Heuristics for L asserts that the length of its shortest non-zero vector is σ(L) where

σ(L) ≈ k 2πe det(L) 1 k = k 2πe 2 (k-1)t k . (E.7)
Observe that the norm of v satisfies

v 2 = a 2 q 2 1 + k i=2 aa 1 q k a k 2 .
If the a i p i 's share all t least significant bits, then, for i = 1, . . . , k, we have

q i ≈ 2 α , a i ≤ 2 β , |x i | = |a i p i -a 1 p 1 | 2 t < 2 n-α+β-t . Hence v 2 < 2 2kβ+2α + (k -1)2 2kβ+2α = k2 2kβ+2α . (E.8)
Using (E.8) and (M.9) and transforming σ(L)

2 > v 2 into k 2πe 2 2(k-1)t k > k2 2kβ+2α , we get t > k k -1 α + k 2 k -1 β + k 2(k -1)
(1 + log 2 (πe)) .

Using (E.6), we get q 1 = gcd(aq 1 , N 1 ) and for i = 2, . . . , k, q i = gcd( aa 1 q i a i , N i ). This terminates the proof.

Once again, if β = 0, then a i = 1 and the bound of Theorem E.6.1 transforms to t > k k-1 α + k 2(k-1) (1 + log 2 (πe)) , which improves the bound of [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF].

E.7 Experiments

In this section, we describe the experiments that we conducted for k = 4, 10, 30 and 50 RSA moduli, in connection with Theorem E.4.1 and Theorem E.6.1. We verified our assumptions by running experiments on a Core2 Duo 2GHz notebook. The lattice reduction basis technique was based on the LLL algorithm.

Assume that a 1 p 1 and the a i p i 's share t MSBs. Then since a i p i ≤ 2 n-α+β , we see that |a i p i -a 1 p 1 | ≤ 2 n-α+β-t . Therefore, t ≤ n -α + β. Similarly, assume that a 1 p 1 and the a i p i 's share t LSBs. Then |a i p i -a 1 p 1 | = 2 t x i with t ≤ n-α +β. In both cases, combining with the bound of t in Theorem E.4.1 and Theorem E.5.1, we get

n -α + β ≥ t > k k -1 α + k 2 k -1 β + k 2(k -1) (1 + log 2 (πe)) ,
which is satisfied if

β < n(k -1) k 2 -k + 1 - 2k -1 k 2 -k + 1 α - k 2(k 2 -k + 1)
(1 + log 2 (πe)) . (E.9)

Consequently, we only consider the situation where the bit-size β of the a i 's satisfies condition (E.9).

We generated many random 1024-bit RSA moduli for k = 4, 10, 30, 50 and various values of α and β according to the bound (E.9). All our experiments were successful and the assumptions on the Gaussian Heuristics were verified. In Table E.4, we notice the experimentally lowest values of t that have 100% success rate.

E.8 Conclusion

In this work we have designed a technique to factor k ≥ 2 RSA moduli N i = p i q i , i = 1, . . . , k when some unknown multiples a i p i share t many Most Significant Bits (MSBs) or t many Least Significant Bits (LSBs). The new technique generalizes many previous results where the prime factors p i share

F.1 Introduction

The RSA cryptosystem, invented in 1978 by Rivest, Shamir and Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] is undoubtedly one of the most popular public key cryptosystems. In the standard RSA [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF], the modulus N = pq is the product of two large primes of the same bit-size. The public exponent e is an integer such that 1 ≤ e < φ(N ) and gcd(e, φ(N )) = 1 where φ(N ) = (p -1)(q -1) is the Euler totient function. The corresponding private exponent is the integer d such that ed ≡ 1 (mod φ(N )). In RSA, the encryption, decryption, signature generation, and signature verification require substantial CPU cycles because the time to perform these operations is proportional to the number of bits in public or secret exponents [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF]. To reduce CPU time necessary for encryption and signature verification, one may be tempted to use a small public exponent e. This situation has been proven to be insecure against some small public exponent attacks (see [START_REF] Hastad | On Using RSA with Low Exponent in a Public Key Network[END_REF] and [START_REF] Hastad | Solving simultaneous modular equations of low degree[END_REF]). To reduce the decryption and signature generation time, one may also be tempted to use a small private exponent d.

Unfortunately, RSA is also vulnerable to various powerful short secret exponent attacks such as, the attack of Wiener [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF], and the attack of Boneh and Durfee [17] (see also [15]). An alternate way for increasing the performance of encryption, decryption, signature generation, and signature verification, without reverting to small exponents, is to use the multi-prime variant of RSA. The multi-prime RSA is a generalization of the standard RSA cryptosystem in which the modulus is in the form N = p 1 p 2 • • • p k where k ≥ 3 and the p i 's are distinct prime numbers. Combined with the Chinese Remainder Theorem, a multi-prime RSA is much more efficient than the standard RSA (see [START_REF]Cryptography using Compaq multiprime technology in a parallel processing environment[END_REF]).

In Section 4.1.2 of the X9.31-1998 standard for public key cryptography [1], some recommendations are presented regarding the generation of the prime factors of an RSA modulus. For example, it is recommended that the modulus should have 1024 + 256x bits for x ≥ 0. This requirement deters some factorization attacks, such as the Number Field Sieve (NFS) [START_REF] Lenstra | The number field sieve[END_REF] and the Elliptic Curve Method (ECM) [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF]. Another recommendation is that the prime difference |p -q| should be large, and p q should not be near the ratio of two small integers. These requirements guard against Fermat factoring algorithm [START_REF] Weger | Cryptanalysis of RSA with small prime difference[END_REF], as well as Coppersmith's factoring attack on RSA [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] when one knows half of the bits of p. For example, if N = pq and p, q are of the same bit-size with |p -q| < N 1/4 , then p -√ N < N 1/4 (see [START_REF] Nitaj | Another generalization of Wiener's attack on RSA[END_REF]) where √ N is the nearest integer to √ N , which means that half of the bits of p are those of [ √ N ] which leads to the factorization of N (see [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] and [START_REF] Weger | Cryptanalysis of RSA with small prime difference[END_REF]). Observe that the factorization attack of Coppersmith applies provided that one knows half of the bits of p, that is p is in one of the forms

p = M 1 + u 0 with known M 1 and unknown u 0 ≤ N 1 4 , M 1 u 1 + M 0 with known (M 1 , M 0 ) and unknown u 1 ≤ N 1 4 .
Such primes are called Coppersmith's weak primes. In the case of p = M 1 u 1 + M 0 with known M 1 and M 0 , the Euclidean division of q by M 1 is in the form

q = M 1 v 1 + v 0 . Hence N = pq = (M 1 u 1 + M 0 )(M 1 v 1 + v 0 ) which gives M 0 v 0 ≡ N (mod M 1 ). Hence, since gcd(M 0 , M 1 ) = 1, then v 0 ≡ N M -1 0 (mod M 1 )
. This means that when p is of the form p = M 1 u 1 + M 0 with known M 1 and M 0 , then q is necessarily of the form q = M 1 v 1 + v 0 with known v 0 . Coppersmith's attack is therefore applicable only when small enough parameters M 0 and v 0 can be found such that p = M 1 u 1 + M 0 and q = M 1 v 1 + v 0 . This reduces the applicability of the attack to the set of moduli such that p and q are of the form defined above.

In this paper, we consider the generalization of Coppersmith's attack by considering a more satisfiable decomposition of any of the multipliers of p or q, i.e., ap or aq not just p or q, effectively leading to an increased set of moduli that can be factored. We describe two new attacks on RSA with a modulus N = pq. The first attack applies in the situation that, for given positive integers M 1 , . . . , M k , one of the prime factors, p say, satisfies a linear equation ap = u 0 + M 1 u 1 + . . . + M k u k with suitably small integers a and u 0 , . . . , u k . We call such prime factors weak primes for the integers M 1 , . . . , M k . The second attack applies when both factors p and q are weak for the integers M 1 , . . . , M k . We note that, for k = 1, the weak primes are such that ap = u 0 + M 1 u 1 . This includes the class of Coppersmith's weak primes. For both attacks, we give an estimation of the RSA moduli N = pq with a prime factor p ∈ 2 n , 2 n+1 which is weak for the integers M, M 2 , . . . , M k where M = 2 n 2k .

The rest of the paper is organized as follows. In Section 2, we give some basic concepts on integer factorization and lattice reduction as well as an overview of Coppersmith's method. In Section 3, we present an attack on an RSA modulus N = pq with one weak prime factor. In Section 4, we present the second attack an RSA modulus N = pq with two weak prime factors. We conclude the paper in Section 5.

F.2 Preliminaries

In this section we give the definitions and results that we need to perform our attacks. These preliminaries include basic concepts on integer factorization and lattice reduction techniques.

F.2.1 Integer factorization: the state of the art

Currently, the most powerful algorithm for factorizing large integers is the Number Field Sieve (NFS) [START_REF] Lenstra | The number field sieve[END_REF]. The heuristic expected time T N F S (N ) of the NFS depends on the bitsize of the integer N to be factored:

T N F S (N ) = exp (1.92 + o(1))(log N ) 1/3 (log log N ) 2/3 .
If the integer N has small factors, the Elliptic Curve Method (ECM) [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] for factoring is substantially faster than the NFS. It can compute a non-trivial factor p of a composite integer N in an expected runtime T ECM :

T ECM (p) = exp √ 2 + o(1) (log p) 1/2 (log log p) 1/2 ,
which is sub-exponential in the bitsize of the factor p. The largest factor found so far with the ECM is a 83 decimal digits (275 bits) prime factor of the special number 7 337 + 1 (see [START_REF] Zimmermann | 50 largest factors found by ECM[END_REF]).

F.2.2 Lattice reduction

Let m and n be positive integers with m ≤ n. Let u 1 , . . . , u m ∈ R n be m linearly independent vectors. The lattice L spanned by u 1 , . . . , u m is the set

L = m i=1 a i u i | a i ∈ Z .
(L) = √ M • M t . When L is full rank, the determinant reduces to det(L) = | det(M )|. The Euclidean norm of a vector v = m i=1 a i u i ∈ L is defined as v = m i=1 a 2 i .
As a lattice has infinitely many bases, some bases are better than others, and a very important task is to find a basis with small vectors {b 1 , . . . , b m } called the reduced basis. This task is very hard in general, however, the LLL algorithm proposed by Lenstra, Lenstra, and Lovász [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] finds a basis of a lattice with relatively small vectors in polynimial time. The following theorem determines the sizes of the reduced basis vectors obtained with LLL (see [START_REF] May | New RSA Vulnerabilities Using Lattice Reduction Methods[END_REF] for more details).

Theorem F.2.1. Let L be a lattice spanned by a basis {u 1 , . . . , u m }. The LLL algorithm applied to L outputs a reduced basis {b 1 , . . . , b m } with

b 1 ≤ b 2 ≤ . . . ≤ b i ≤ 2 m(m-1) 4(m-i+1) det(L) 1 m+i-1 , for i = 1, 2, . . . , m.
The existence of a short nonzero vector in a lattice is guaranteed by a result of Minkowski stating that every m-dimensional lattice L contains a non-zero vector v with v ≤ √ m det(L) 1 m . On the other hand, the Gaussian Heuristic asserts that the norm γ 1 of the shortest vector of a random lattice satisfies

γ 1 ≈ dim(L) 2πe det(L) 1 dim(L) .
Hereafter, we will use this result as an estimation for the expected minimum norm of a non-zero vector in a lattice.

F.3 The Attack with One Weak Prime Factor F.3.1 The Attack

In this section, we present an attack to factor an RSA modulus N = pq when p satisfies a linear equation in the form ap = u 0 + M 1 u 1 + . . . M k u k for a suitably small positive integer a and suitably small integers u 0 , u 1 , . . . , u k where M 1 , . . . , M k are given positive integers. Such prime factor p is called a weak prime for the integers M 1 , . . . , M k .

Theorem F.3.1. Let N = pq be an RSA modulus such that p > N β and M 1 , . . . , M k be k positive integers with M 1 < M 2 < . . . < M k . Suppose that there exists a positive integer a, and k + 1 integers u i , i = 0, . . . , k such that

ap = u 0 + M 1 u 1 + . . . + M k u k with max(u i ) < N δ and δ < 1 k + 1 1 -(1 -β) k+1 k -(k + 1) 1 -k 1 -β (1 -β) .
Then one can factor N in polynomial time.

Proof. Let M 1 , . . . , M k be k positive integers such that M 1 < M 2 < . . . < M k . Suppose that ap = u 0 + M 1 u 1 + . . . + M k u k , that is (u 0 , . . . , u k ) is a solution of the modular polynomial equation

x 0 + M 1 x 1 + . . . + M k x k = 0 (mod p). (F.1)
Suppose that |u i | < N δ for i = 0, . . . , k. Using n = k + 1, u = 1 and v = 1 in Theorem F.2.3, means that the equation (F.1) can be solved in polynomial time, i.e., finding (u 0 , . . . , u k ) if

(k + 1)δ < 1 -(1 -β) k+1 k -(k + 1) 1 -k 1 -β (1 -β) ,
which gives the bound

δ < 1 k + 1 1 -(1 -β) k+1 k -(k + 1) 1 -k 1 -β (1 -β) .
This terminates the proof.

Theorem F.3.1 we should find u 0 , u 1 and u 2 as long as u 0 , u 1 , u 2 < 2 28 . We apply the method of Lu et al. [START_REF] Lu | New Results on Solving Linear Equations Modulo Unknown Divisors and its Applications[END_REF] with m = 4 and t = 1. This gives a 35-dimensional lattice. Applying the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF], we find a reduced basis with multivariate polynomials

f i (x 1 , x 2 , x 3 ) ∈ Z[x 1 , x 2 , x 3 ], i = 1, . . . , 3.
Applying the Gröbner basis technique for solving a system of polynomial equations, we get u 0 = 9005, u 1 = 7123, u 2 = 3915. Using these values, we can compute ap = u 0 + M u 1 + M 2 u 2 from which we deduce p = gcd(u

0 + M u 1 + M 2 u 2 , N ), that is p = 123356126338704841740132972382836883609800988209539117002682143.
Finally, we can compute q = N p , that is q = 81145162250214072465980396192562821802697970661432623765038987. Note here that there is no linear decomposition of p in the form p = M 1 + u 0 nor p = M 1 u 1 + M 0 with u 0 , u 1 < N 0.25 that makes p vulnerable to the attack of Coppersmith. This shows that the modulus N is vulnerable to our attack, while it is not vulnerable to Coppersmith's attack. Finally, the overall recorded execution time for our attack using an off-the-shelf computer was 17 seconds.

Example F.3.5. In [10], Bernstein et al. discovered many prime factors with special forms. Many of these primes were found by computing the greatest common divisor of a collection of RSA moduli. Others were found by applying Coppersmith's technique. We show below that our attack can find some primes among the list of Bernstein et al. One of these primes is

p =0xc00000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000002f 9, =10055855947456947824680518748654384595609524365444295033292671082 79132302255516023260140572362517757076752389363986453814031541210 8959927459825236754563833.
Using M = 2 510 , we get p = 3M +761 = M u 1 +u 0 where u 1 = 3 and u 0 = 761. We have u 1 , u 0 < N δ with δ ≈ 0.007 which is less than the bound 0.125 in Table F.1 for a 1024 bit-size RSA modulus N with β = 0.5, and k = 1. This implies that the conditions for Theorem F.3.1 are satisfied and our method finds p when used in any RSA modulus.

Example F.3.6. Now, consider this other example from the list of Bernstein et al. [10] p =0xc000b80000000000000000000000000000000000000000000000000000000000 0000068000000000000000000000000000000000000000000000000000000251 =1005600299430066190917858574741029677291519034741120712409376115 2520749216065545598886037221777994938111659319232428746318812487 609513837263772711701709393

Then p has the form p = 3145774M 7 +27262976M 3 +593 = M 7 u 7 +M 3 u 3 +u 0 where M = 2 70 . The coefficients u 7 , u 3 and u 0 satisfy u 7 , u 3 , u 0 < N δ with δ ≈ 0.016 while the bound of Theorem F.3.1 is 0.021 (see Table F.1 for k = 7 and β = 0.5). Again, this shows that our method will find the factorization of any RSA modulus that is a multiple of p.

F.3.3 The Number of Single Weak Primes in an Interval

In this section, we consider two positive integers n and M and present a study of the weak primes with M , that is the primes p ∈ 2 n , 2 n+1 such that there exists a positive integer a that gives the decomposition

ap = k i=0 M i u i
where |u i | < N δ and δ satisfies Theorem F.3.1. We show that the number of the RSA moduli N in the interval [2 2n , 2 2(n+1) ] with a weak prime factor p ∈ 2 n , 2 n+1 is polynomial in 2 n . That is, this number is lower bounded by 2 η where η > 1 2 . We call such a class weak RSA Moduli in the interval [2 2n , 2 2(n+1) ].

Theorem F.3.7. Let n be a positive integer. For k ≥ 1, define M = 2 n k . Let N be the set of the weak RSA moduli N ∈ 2 2n , 2 2(n+1) such that N = pq, p and q are of the same bitsize, p > q, and p

= k i=0 M i u i a + b ∈ 2 n , 2 n+1
for some small integers b, a < N δ and |u i | < N δ for i = 0, . . . , k with

δ = 1 k + 1 1 - 1 2 k+1 k - 1 2 1 - 1 2 1 k
.

Then the cardinality of N satisfies #N ≥ 2 η where η = (1 + 2(k + 1)δ)n + log 2 (n -1) n(n + 1) log (2) .

Proof. Let N be an RSA moduli. Suppose that N ∈ 2 2n , 2 2(n+1) with N = pq where p and q are of the same bitsize. Since p ≈ N 1 2 , then p ∈ 2 n , 2 n+1 . Suppose further that for some positive integer a, we have ap = k i=0 M i u i . Then

M k = ap -k-1 i=0 M i u i u k ≈ a u k p, which implies M ≈ p 1 k ≈ N 1 2k . Now, define M = N 1 2k = 2 n k
, where x is the integer greater or equal to x. This yields 2 n ≤ M k ≤ 2 n+1 . Consider the set P ⊂ 2 n , 2 n+1

P = p = k i=0 M i u i a + b, p is prime, | a < N δ , |u i | < N δ ,
where δ satisfies (F.2). Here b is as small as possible so that

k i=0 M i u i a + b
is prime. Also, since M k is the leading term, then observe that

k i=0 M i u i a -M k = u k -a a M k + k i=1 M i u i a .
To ensure p ∈ 2 n , 2 n+1 , we consider only the situation where u k ≥ a. Hence, using the bounds a < N δ and |u i | < N δ for i = 0, . . . , k -1, we get a lower bound for the number of possibilities for a and for u i , which themselves set a lower bound for the cardinality of P as follows:

#P ≥ N δ N δ k ≈ N (k+1)δ ≈ 2 2(k+1)nδ . (F.3)
On the other hand, the prime number theorem asserts that the number π(x) of the primes less than x is

π(x) ≈ x log(x)
.

Hence, the number of primes in the interval 2 n , 2 n+1 is approximately

π 2 n+1 -π (2 n ) ≈ 2 n+1 log (2 n+1 ) - 2 n log (2 n ) = (n -1)2 n n(n + 1) log(2) . (F.4)
It follows that the number of RSA moduli N = pq ∈ 2 2n , 2 2(n+1) with a weak factor p ∈ P and q ∈ 2 n , 2 n+1 is at least #(N ) ≥ #P × π 2 n+1 -π (2 n ) . Using F.3 and F.4, we get

#(N ) ≥ 2 2(k+1)nδ × (n -1)2 n n(n + 1) log(2) = (n -1) n(n + 1) log(2) × 2 (1+2(k+1)δ)n = 2 η , where η = (1 + 2(k + 1)δ)n + log 2 (n -1) n(n + 1) log(2)
.

This terminates the proof.

Table F.2 presents a list of values of the bound η in terms of k and n. In Table F.2, we see that in the situation (β, k) = (0.5, 1), the number #(N ) of 1024-bits RSA moduli N = pq ∈ 2 1024 , 2 1026 with a weak factor p is at least #(N ) ≥ 2 759 . Observe that the number of RSA moduli with a weak Coppersmith's prime factor in the same interval is approximately N In this section, we present an attack on RSA with a modulus N = pq when both the prime factors p and q are weak primes.

k = 1 k = 2 k = 3 k = 4 k = 5 k = 6 k = 7 n = 1 2 log 2 (N ) =
Theorem F.4.1. Let N = pq be an RSA modulus and M be a positive integer. Let k ≥ 1. Suppose that there exist integers a, b, u i and

v i , i = 1, . . . , k such that ap = k i=0 M i u i and bq = k i=0 M i v i with |u i |, |v i | < N δ and δ < 1 2k + 1 + log 2k 3 2(2k + 1) log(N ) + log(2k + 1) -log(2πe) 4 log(N ) - log 4k 3 4 log(N ) .
Then one can factor N in polynomial time.

Proof. Suppose that ap = k i=0 M i u i and bq = k i=0 M i v i . Then multiplying ap and bq, we get

abN = 2k i=0 M i w i , with w i = i j=0 u j v i-j .
This can be transformed into the equation

M 2k x 2k + M 2k-1 x 2k-1 + . . . + M x 1 -yN = -x 0 , (F.5)
with the solution (x 2k , x 2k-1 , . . . , x 1 , y, x 0 ) = (w 2k , w 2k , . . . , w 1 , ab, u 0 v 0 ). For i = 0, . . . , k, suppose that |u i |, |v i | < N δ . Since for i = 0, . . . , 2k, the maximal number of terms in w i is k, we get

|x i | = |w i | ≤ k max j (|u j |) • max j (|v j |) < kN 2δ . (F.6)
Let C be a constant to be fixed later. Consider the lattice L generated by the row vectors of the matrix

M (L) =             1 0 0 . . . 0 CM 2k 0 1 . . . 0 0 CM 2k-1 . . . . . . . . . . . . . . . . . . 0 0 0 . . . 1 CM 0 0 0 . . . 0 -CN             . (F.7)
The dimension of the lattice L is dim(L) = 2k + 1 and its determinant is det(L) = CN . According to the Gaussian Heuristic, the length of the shortest non-zero vector of the lattice L is approximately σ(L) with

σ(L) ≈ dim(L) 2πe det(L) 1 dim(L) = 2k + 1 2πe (CN ) 1 2k+1
.

Consider the vector v = (x 2k , x 2k-1 , . . . , x 1 , -Cx 0 ). Then, using (F.5), we get

(x 2k , x 2k-1 , . . . , x 1 , -Cx 0 ) = (x 2k , x k-1 , . . . , x 1 , y) • M (L).
This means that v ∈ L. Consequently, if C satisfies v ≤ σ(L), then, by the Gaussian Heuristic, v is the shortest vector of L. Using the bound (F.6), the length of the vector v satisfies

v 2 = C 2 x 2 0 + 2k i=1 x 2 i ≤ C 2 + 2k i=1 k 2 N 4δ = C 2 + 2k 3 N 4δ .
Let C be a positive integer satisfying C ≤ √ 2k 3 . Then the norm of the vector v satisfies v 2 < 4k 3 N 4δ . Hence, using the Gaussian approximation σ(L),

the inequality v ≤ σ(L) is satisfied if 2k 3 2 N 2δ ≤ 2k + 1 2πe 2 1 2 k 3 2 N 1 2k+1
.

Solving for δ, we get

δ < 1 2k + 1 + log 2k 3 2(2k + 1) log(N ) + log(2k + 1) -log(2πe) 4 log(N ) - log 4k 3 4 log(N ) .
If δ satisfies the former bound, then the LLL algorithm, applied to the lattice L will output the vector v = (x 2k , x 2k-1 , . . . , x 1 , -Cx 0 ) from which, we deduce

w 2k = |x 2k |, w 2k-1 = |x 2k-1 |, . . . , w 1 = |x 1 |, w 0 = | -Cx 0 | C .
Using the coefficients w i , i = 1, . . . , 2k, we construct the polynomial P (X) = w 2k X 2k + w 2k-1 X 2k-1 + . . . + w 1 X + w 0 . Factoring P (X), we get

P (X) = k i=0 M i u i k i=0 M i v i ,
from which we deduce all the values u i and v i for i = 1, . . . , k. Using each u i and v i for i = 1, . . . , k, we get ap = k i=0 M i u i and finally obtain p = gcd k i=0 M i u i , N which in turn gives q = N q . This terminates the proof.

In Table F.3, we give the bound for δ for a given k and a given size of the RSA modulus. Let M = 2 50 . Suppose further that the prime factors p and q are such that ap = M 2 u 2 + M u 1 + u 0 and bq = M 2 v 2 + M v 1 + v 0 , that is k = 2 with the notation of Theorem F.4.1. We built the matrix (F.7) with C = √ 2k 3 = 4 and applied the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF]. We got a new basis, where the last row is:

(w 4 , w 3 , w 2 , w 1 , -Cw 0 ) = (30223231819936, 68646317659290, 109044283791446, 80821741694637, -162291153390444).

From this, we form the polynomial P (X) = w 4 X 4 +w 3 X 3 +w 2 X 2 +w 1 X 1 +w 0 . which factors as:

P (X) = 4678994X 2 + 5832048X + 4871673 6459344X 2 + 6620037X + 8328307 .
From this, we deduce

u 2 = 4678994, u 1 = 5832048, u 0 = 4871673, v 2 = 6459344, v 1 = 6620037, v 0 = 8328307.
Using these values, we compute

ap = M 2 u 2 + M u 1 + u 0 = 5931329552564290566528965219451557369, bq = M 2 v 2 + M v 1 + v 0 = 8188191298680619668680362464158618739.
and obtain p = gcd(ap, N ) = 126198501118389160989977983392586327, q = gcd(bq, N ) = 143652478924221397696146709897519627.

This leads to the factorization of N = pq. We note that the first attack described in Section F.3 does not succeed to factor N . Indeed, we have

log(max i (|v i |)) log N
≈ 0.098 which is larger than the value δ = 0.069 for k = 2 and β = 0.5 in Table F.1. Finally, the overall recorded execution time for our attack using an off-the-shelf computer was 12 seconds.

F.4.3 The Number of Double Weak Primes in an Interval

In this section, we consider two positive integers n and M and present a study of the double weak primes with M , that is the primes p, q ∈ 2 n , 2 n+1 such that there exists positive integer a and b that give the decompositions:

ap = k i=0 M i u i , bq = k i=0 M i v i
where |u i | < N δ , |v i | < N δ and δ satisfies Theorem F.4.1. We show that the number of the RSA moduli N in the interval [2 2n , 2 2(n+1) ] with a weak prime factors p, q ∈ 2 n , 2 n+1 is lower bounded by 2 η 2 where η 2 > 1 2 .

Theorem F.4.3. Let n be a positive integer. For k ≥ 1, define M = 2 n k . Let N be the set of the weak RSA moduli N ∈ 2 2n , 2 2(n+1) such that N = pq

with p = k i=0 M i u i a + u, q = k i=0 M i v i b + v, p, q ∈ 2 n , 2 n+1 for some small integers u, v, a < N δ , b < N δ , |u i | < N δ and |v i | < N δ for i = 0, . . . , k with δ = 1 k + 1 1 - 1 2 k+1 k - 1 2 1 - 1 2 1 k
.

Then the cardinality of N is at least #N ≥ 2 η 2 where η 2 = 4(k + 1)nδ.

Proof. As in the proof of Theorem F.3.7, the number of prime numbers p ∈

2 n , 2 n+1 such that p = k i=0 M i u i a + u with |u i | < 2 2nδ is #P ≥ 2 2(k+1)nδ .
Then, the number N 2 of RSA modulus N ∈ 2 2n , 2 2(n+1) with N = pq, where both p and q are weak primes is at least

#N 2 ≥ 2 4(k+1)nδ = 2 η 2 ,
where η 2 = 4(k + 1)nδ. This terminates the proof.

In Table F.3, we present a list of values of the bound η 2 in terms of k and n.

k = 1 k = 2 k = 3 k = 4 k = 5 k = 6 k = 7 n =

F.5 Conclusions

In this paper we presented and illustrated two attacks based on factoring RSA moduli with weak primes. We further computed lower bounds for the

G.1 Introduction

The RSA public-key cryptosystem, invented in 1978 by Rivest, Shamir and Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF], is one of the most popular systems in use today. In the RSA cryptosystem, the public key is (N, e) where the modulus N = pq is a product of two primes of the same bitsize, and the public exponent is a positive integer satisfying ed ≡ 1 (mod φ(N )). In RSA, encryption and decryption require executing heavy exponential multiplications modulo the large integer N . To reduce the decryption time, one may be tempted to use a small private exponent d. However, in 1990 Wiener [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] showed that RSA is insecure if d < 1 3 N 0.25 , and Boneh and Durfee [17] improved the bound to d < N 0.292 . In 2004, Blömer and May [13] combined both Wiener's method and Boneh and Durfee's method to show that RSA is insecure if the public exponent e satisfies an equation ex + y = kφ(N ) with x < 1 3 N 1 4 and |y| ≤ N -3 4 ex. Concurrent to these efforts, many RSA variants have been proposed in order to ensure computational efficiency while maintaining the acceptable levels of security. One such important variant is the Prime Power RSA. In Prime Power RSA the modulus N is in the form N = p r q for r ≥ 2. In [START_REF] Takagi | Fast RSA-Type Cryptosystem Modulo p k q[END_REF], Takagi showed how to use the Prime Power RSA to speed up the decryption process when the public and private exponents satisfy an equation ed ≡ 1 (mod (p -1)(q -1)). As in the standard RSA cryptosystem, the security of the Prime Power RSA depends on the difficulty of factoring integers of the form N = p r q.

Therefore, a Prime Power RSA modulus must be appropriately chosen, since it has to resist factoring algorithms such as the Number Field Sieve [START_REF] Lenstra | The number field sieve[END_REF] and the Elliptic Curve Method [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF]. Table G.1, shows the suggested secure Power RSA forms as a function of the size of the modulus back in 2002 (see [START_REF]Cryptography using Compaq multiprime technology in a parallel processing environment[END_REF]). Note that, due to the ever increasing development of computing hardware, the form N = p 2 q is no longer recommended for 1024 bit modulus. Form of the modulus N pq, p 2 q pq, p 2 q pq, p 2 q pq, p 2 q pq, p 2 q, p 3 q pq, p 2 q, p 3 q, p 4 q Table G.1: Optimal number of prime factors of a Prime Power RSA modulus [START_REF]Cryptography using Compaq multiprime technology in a parallel processing environment[END_REF].

In 1999, Boneh, Durfee, and Howgrave-Graham [16] presented a method for factoring N = p r q when r is large. Furthermore, Takagi [START_REF] Takagi | Fast RSA-Type Cryptosystem Modulo p k q[END_REF] proved that one can factor N if d < N 1 2(r+1) , and May [START_REF] May | Secret Exponent Attacks on RSA-type Schemes with Moduli N = p r q. Public Key Cryptography-PKC[END_REF] improved the bound to

d < N r (r+1) 2 or d < N (r-1) 2 (r+1) 2 .
Very recently, Lu, Zhang and Lin [START_REF] Lu | New Results on Solving Linear Equations Modulo Unknown Divisors and its Applications[END_REF] improved the bound to d < N r(r-1) (r+1) 2 , and Sarkar [START_REF] Sarkar | Small secret exponent attack on RSA variant with modulus N = p r q, Designs[END_REF] improved the bound for N = p 2 q to d < N 0.395 and gave explicit bounds for r = 3, 4, 5.

In this paper, we focus on the Prime Power RSA with a modulus N = p r q, and present three new attacks: In the first attack we consider a public exponent e satisfying an equation ex -φ(N )y = z where x and y are positive integers. Using a recent result of Lu, Zhang and Lin [START_REF] Lu | New Results on Solving Linear Equations Modulo Unknown Divisors and its Applications[END_REF], we show that one can factor N in polynomial time if |xz| < N r(r-1) (r+1) 2 . In the standard situation z = 1, the condition becomes d = x < N r(r-1) (r+1) 2 which improves the bound of May [START_REF] May | Secret Exponent Attacks on RSA-type Schemes with Moduli N = p r q. Public Key Cryptography-PKC[END_REF] for r ≥ 3 and retrieves the bound of Lu, Zhang and Lin [START_REF] Lu | New Results on Solving Linear Equations Modulo Unknown Divisors and its Applications[END_REF]. Note that unlike Sarkar [START_REF] Sarkar | Small secret exponent attack on RSA variant with modulus N = p r q, Designs[END_REF] who solves ex -φ(N )y = 1, we solve a more general equation ex -φ(N )y = z. This leads to less constraints on the solution space, which in turn leads to an increase in the number of solutions to the equation. Intuitively speaking, our method has higher likelihood of finding solutions; that is, factoring RSA. In section G.3, we shall present an example supporting this claim.

In the second attack, we consider an instance of the Prime Power RSA with modulus N = p r q. We show that one can factor N if two private keys d 1 and d 2 share an amount of their most significant bits, that is if

|d 1 -d 2 | is small enough. More precisely, we show that if |d 1 -d 2 | < N r(r-1)
(r+1) 2 , then N can be factored in polynomial time. The method we present is based on a recent result of [START_REF] Lu | New Results on Solving Linear Equations Modulo Unknown Divisors and its Applications[END_REF] with Coppersmith's method for solving an univariate linear equation.

In the third attack, we consider two instances of the Prime Power RSA with two moduli N 1 = p r 1 q 1 and N 2 = p r 2 q 2 such that the prime factors p 1 and p 2 share an amount of their most significant bits, that is |p 1 -p 2 | is small. More precisely, we show that one can factor the RSA moduli N 1 and N 2 in polynomial time if |p 1 -p 2 | < p 1 2rq 1 q 2 . The method we use for this attack is based on the continued fraction algorithm.

The rest of this paper is organized as follows: In Section 2, we briefly review the preliminaries necessary for the attacks, namely Coppersmith's technique for solving linear equations and the continued fractions theorem. In Section 3, we present the first attack on the Prime Power RSA, which is valid with no conditions on the prime factors. In Section 4, we present the second attack in the situation where two decryption exponents share an amount of their most significant bits. In Section 5, we present the third attack on the Prime Power RSA when the prime factors share an amount of their most significant bits. We then conclude the paper in Section 6.

G.2 Preliminaries

In this section, we present some basics on Coppersmith's method for solving linear modular polynomial equations and an overview of the continued fraction algorithm. Both techniques are used in the crafting of our attacks.

First, observe that if N = p r q with q < p, then p r+1 > p r q = N , and p > N 1 r+1 . Hence throughout this paper, we will use the inequality p > N β where β = 1 r+1 .

G.2.1 Linear Modular Polynomial Equations

In 1995, Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] developed powerful lattice-based techniques for solving both modular polynomial diophantine equations with one variable and two variables. These techniques have been generalized to more variables, and have served for cryptanalysis of many instances of RSA. More on this can be found in [START_REF] Hinek | Cryptanalysis of RSA and its Variants[END_REF][START_REF] May | Using LLL-reduction for solving RSA and factorization problems: a survey[END_REF]. In [START_REF] Herrmann | Solving linear equations modulo divisors: On factoring given any bits[END_REF], Herrmann and May presented a method for finding the small roots of a modular polynomial equation f (x 1 , . . . , x n ) ≡ 0 (mod p) where f (x 1 , . . . , x n ) ∈ Z[x 1 , . . . , x n ] and p is an unknown divisor of a known integer N . Their method is based on the seminal work of Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF]. Very recently, Lu, Zhang and Lin [START_REF] Lu | New Results on Solving Linear Equations Modulo Unknown Divisors and its Applications[END_REF] presented a generalization for finding the small roots of a modular polynomial equation f (x 1 , . . . , x n ) ≡ 0 (mod p v ), where p v is a divisor of some composite integer N . For the bivariate case, they proved the following result, which we shall use in the crafting of our attacks.

Theorem G.2.1 (Lu, Zhang and Lin). Let N be a composite integer with a divisor p u such that p ≥ N β for some 0 < β ≤ 1. Let f (x, y) ∈ Z[x, y] be a homogenous linear polynomial. Then one can find all the solutions (x, y) of the equation f (x, y) = 0 mod p v with gcd(x,

y) = 1, |x| < N γ 1 , |y| < N γ 2 , in polynomial time if γ 1 + γ 2 < uvβ 2 .

G.2.2 The Continued Fractions Algorithm

We present here the well known result of Legendre on convergents of a continued fraction expansion of a real number. The details can be found in [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]. Let ξ be a positive real number. Define ξ 0 = ξ and for i = 0, 1, . . . , n, a i = ξ i , ξ i+1 = 1/(ξ i -a i ) unless ξ i is an integer. This expands ξ as a continued fraction in the following form:

ξ = a 0 + 1 a 1 + 1 . . . + 1 a n + 1 . . . , a 0 ∈ N, and a i ∈ N * for i ≥ 1,
which is often rewritten as ξ = [a 0 , a 1 , . . . , a n , . . .]. For i ≥ 0, the rational numbers [a 0 , a 1 , . . . , a i ] are the convergents of ξ. If ξ = a b is a rational number, then ξ = [a 0 , a 1 , . . . , a n ] for some positive integer n, and the continued fraction expansion of ξ is finite with the total number of convergents being polynomial in log(b). The following result enables one to determine if a rational number a b is a convergent of the continued fraction expansion of a real number ξ (see Theorem 184 of [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]).

Theorem G.2.2 (Legendre). Let ξ be a positive real number. Suppose gcd(a,b

) = 1 and ξ - a b < 1 2b 2 .
Then a b is one of the convergents of the continued fraction expansion of ξ.

Note that the continued fractions expansion process is polynomial in time.

In order to solve the diophantine equation ex -φ(N )y = z, we transformed it into the equation ex -z ≡ 0 (mod p r-1 ) using Theorem G.3.1. To be able to apply Coppersmith's technique via Theorem G.2.1, we chose the parameters m = 7, t = 6 so that the dimension of constructed the lattice is 36, and X = N r(r-1) (r+1) 2 = 1592999974064. We built the lattice using the polynomial f (x 1 , x 2 ) = x 1 + ex 2 , then applied the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF], and used Gröbner basis method to find the smallest solution x 1 = -11537 and x 2 = 7053 to f (x 1 , x 2 ) ≡ 0 (mod p r-1 ) in 174 seconds using an off-theshelf computer. From this solution, we deduced p = gcd(x 1 + ex 2 , N ) = 2294269585934949239, and finally recovered q = N p 2 = 1546077175000723901. We then computed φ(N ) and d ≡ e -1 (mod φ(N )) as follows:

φ(N ) = 8138044578297117310671227668089561946257896925261579800, d = 2015994747748388772982436393811213317361971865510756269.
Observe that d ≈ N 0.98 which is out of range of Sarkar's bound [START_REF] Sarkar | Small secret exponent attack on RSA variant with modulus N = p r q, Designs[END_REF] which can only retrieve private keys d < N 0.395 for r = 2.

G.4 The Second Attack on Prime Power RSA using Two Decryption Exponents

In this section, we present an attack on the Prime Power RSA when two private exponents d 1 and d 2 share an amount of their most significant bits, that is

|d 1 -d 2 | is small.
Theorem G.4.1. Let N = p r q be an RSA modulus and d 1 and d 2 be two private exponents such that e 1 e 2 (d 1 -d 2 ) -(e 2 -e 1 ) ≡ 0 (mod N ). Then, one can factor N in polynomial time, if

|d 1 -d 2 | < N r(r-1) (r+1) 2 .
Proof. Suppose that e Since φ(N ) = p r-1 (p -1)(q -1), we get e 1 e 2 (d 1 -d 2 ) ≡ e 2 -e 1 (mod p r-1 ). Now, consider the modular linear equation e 1 e 2 x -(e 2 -e 1 ) ≡ 0 (mod p r-1 ),

d 1 -d 2 is a root of such equation. Suppose further that |d 1 -d 2 | < N δ , then applying Theorem G.2.1 with u = r, v = r -1 and β = 1 r+1 will lead to the solution x = d 1 -d 2 obtained in polynomial time if δ < uvβ 2 = r(r -1) (r + 1) 2 . That is if |d 1 -d 2 | < N r(r-1) (r+1) 2 . Computing
gcd(e 1 e 2 x -(e 2 -e 1 ), N ) = gcd p r-1 (p -1)(q -1)y, p r q = g, and assuming that e 1 e 2 (d 1 -d 2 ) -(e 2 -e 1 ) ≡ 0 (mod N ) will lead to determining p, hence factoring N as follows:

p = g 1 r-1 when g = p r-1 , or p = g 1 r when g = p r , or p = N g if g = p r-1 q.
Example G.4.2. Let us present an example corresponding to Theorem G.4.1. Consider N = p 2 q with N = 6093253851486120878859471958399737725885946526553626219, e 1 = 2749600381847487389715964767235618802529675855606377411, e 2 = 3575081244952414009316396501512372226545892558898276551.

The polynomial equation is f (x) = e 1 e 2 x -(e 2 -e 1 ) ≡ 0 (mod p r-1 ), which can be transformed into g(x) = x -a ≡ 0 (mod p r-1 ) where a ≡ (e 2 -e1)(e 1 e 2 ) -1 (mod N ). Using m = 8 and t = 6, we built a lattice with dimension ω = 9. Applying the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] and solving the first reduced polynomials, we get the solution x 0 = 1826732340. Hence gcd(f (x 0 ), N ) = p = 1789386140116417697 and finally q = N p 2 = 1903010275819064491. The whole process took less than 4 seconds using an off-the-shelf computer. Then, using φ(N ) = p(p -1)(q -1), we retrieved the private exponents d 1 ≡ e -1 1 (mod φ(N )) and d 2 ≡ e -1 2 (mod φ(N )). Note that again d 1 ≈ d 2 ≈ N 0.99 which Sarkar's method with the bound d < N 0.395 could not possibly retrieve.

G.5 The Third Attack on Prime Power RSA with Two RSA Moduli

In this section, we consider two Prime Power RSA moduli N 1 = p r 1 q 1 and N 2 = p r 2 q 2 , where p 1 and p 2 share an amount of their most significant bits.

Theorem G.5.1. Let N 1 = p r 1 q 1 and N 2 = p r 2 q 2 be two RSA moduli with

p 1 > p 2 . If |p 1 -p 2 | < p 1 2rq 1 q 2 ,
then, one can factor N in polynomial time.

Proof. Suppose that N 1 = p r 1 q 1 and N 2 = p r 2 q 2 with p 1 > p 2 . Then q 2 N 1 -

q 1 N 2 = q 1 q 2 (p r 1 -p r 2 ). Hence N 2 N 1 - q 2 q 1 = q 1 q 2 |p r 1 -p r 2 | q 2 1 p r 1 .
In order to apply Theorem G.2.2, we need that q 1 q 2 |p r

1 -p r 2 | q 2 1 p r 1 < 1 2q 2 1
, or equivalently

|p r 1 -p r 2 | < p r 1 2q 1 q 2 . (G.1)
Observe that

|p r 1 -p r 2 | = |p 1 -p 2 | r-1 i=0 p r-1-i 1 p i 2 < r|p 1 -p 2 |p r-1 1 . Then (G.1) is fulfilled if r|p 1 -p 2 |p r-1 1 < p r 1 2q 1 q 2 , that is if |p 1 -p 2 | < p 1 2rq 1 q 2 .
Under this condition, we get q 2 q 1 among the convergents of the continued fraction expansion of N 2 N 1 . Using q 1 and q 2 , we get

p 1 = N 1 q 1 1 r and p 2 = N 2 q 2 1 r .

H.1 Introduction

In 1991, Koyama, Maurer, Okamoto and Vanstone [START_REF] Koyama | New public-key schemes based on elliptic curves over the ring Z n[END_REF] introduced a new public key cryptosystem based on elliptic curves, called KMOV. The KMOV cryptosystem is based on elliptic curves over the ring Z n where n = pq is an RSA modulus, that is, the product of two large unknown primes of equal bitsize. Introduced in 1978 by Rivest, Shamir and Adleman, RSA [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] is one of the most popular cryptosystems in research as well as in commercial domain (see [15], [START_REF] Hinek | Cryptanalysis of RSA and its Variants[END_REF]). The RSA public key is denoted by (n, e) where n = pq is an RSA modulus and e is an integer satisfying gcd(e, (p -1)(q -1)) = 1. The corresponding private exponent d is an integer satisfying ed ≡ 1 (mod (p -1)(q -1)). Then, there exists some integer k such that

ed -k(p -1)(q -1) = 1. (H.1)
Similarly, the KMOV public key is denoted by (n, e) where n = pq and e is an integer satisfying gcd(e, (p + 1)(q + 1)) = 1. The corresponding private exponent d is an integer satisfying ed ≡ 1 (mod (p + 1)(q + 1)) which can be reformulated as an equation

ed -k(p + 1)(q + 1) = 1. (H.2)
The security of RSA and KMOV is mainly based on the difficulty of factoring the RSA modulus n. To speed up the encryption or decryption one may try to use small public or secret decryption exponent. Many important papers studied RSA and KMOV to explore the weaknesses in using small exponents. In 1990, Wiener [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] showed that using equation (H.1) and the continued fraction algorithm, it is possible to break RSA if the private key d satisfies d < 1 3 n 0.25 . In 2004, Blömer and May [13] described an attack on RSA starting with the equation ex -k(p -1)(q -1) = y.

Using the continued fraction algorithm and lattice reduction techniques, they showed that RSA is insecure if 0 < x < 1 3 n 0.25 and |y| = O n -0.75 ex . In this paper, we consider KMOV with a public exponent e satisfying the more general equation

ed -k(p + 1)(q + 1) = z. (H.3)
where x and y are co-prime positive integers. Observe that this equation has infinitely many solutions but we will focus on small solutions. In 1995, Pinch [128] extended the Wiener attack to KMOV using similar techniques applied with equation (H.2), that is when z = 1. Similarly, Ibrahimpasic [START_REF] Ibrahimpasic | Cryptanalysis of KMOV cryptosystem with short secret exponent[END_REF], studied the security of KMOV with short secret exponents.

We mainly focus on the equation (H.2) which is a generalization of the equation (H.2). We use Diophantine approximations to find x, y among the convergents of the continued fraction expansion of e n when x, y and z satisfy

|z| < (p -q)n 1 4 y 3(p + q) , xy < √ 2 √ n 12 .
After finding x and y, one can get an approximation p of p satisfying |p-p| < n

1 4 where p = 1 2 ex y -n -1 + 1 2 ex y -n -1 2 -4n .
Finally, this approximation leads to the factorization of n by using Coppersmith's Theorem [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF].

The rest of this paper is organized as follows. In the next section, we review some necessary definitions and notation on elliptic curves and recall the KMOV cryptosystem. In section 3, we present our new attack on KMOV. In Section 4, we propose a numerical example. We conclude in Section 5.

H.2 Preliminaries

In this section, we give a brief description of the KMOV cryptosystem and elliptic curves (see [START_REF] Silverman | The Arithmetic of Elliptic Curves[END_REF] for more details on elliptic curves).

H.2.1 Elliptic Curves over F p

An elliptic curve over a field K is an algebraic curve with no singular points, given by the Weierstrass equation

y 2 + a 1 xy + a 3 y = x 3 + a 2 x 2 + a 4 x + a 6 , a i ∈ K,
together with a single element denoted O and called the point at infinity. The elliptic curve E over K is denoted E/K and the set of solutions (x, y) ∈ K 2 together with O is denoted E(K). Given two points P, Q ∈ E(K) we define a third point P + Q so that E(K) forms an abelian group with this addition operation.

• The point O serves as the identity element.

• The opposite of P = (x 1 , y 1 ), is -P = (x 1 , -y 1 -a 1 x 1 -a 3 ).

• If P = (x 1 , y 1 ) and Q = (x 2 , y 2 ) with Q = -P , then P + Q = (x 3 , y 3 )
where

x 3 = λ 2 -x 1 -x 2 -a 2 + a 1 λ, y 3 = -y 1 -(x 3 -x 1 )λ -a 1 x 3 -a 3 , where λ =        y 2 -y 1 x 2 -x 1 if x 1 = x 2 , 3x 2 1 +2a 2 x 1 +a 4 -a 1 y 1 2y 2 1 +a 1 x 1 +a 3 if x 1 = x 2 ,
If K is of characteristic different from 2 or 3, the equation of the elliptic curve E can be transformed into the reduced Weierstrass form

y 2 = x 3 + ax + b, a, b ∈ K,
where 4a 3 + 27b 2 = 0. When K = F p for some prime p > 3, such a curve will be denoted E p (a, b).

Theorem H.2.1 (Hasse). The order of the group E p (a, b)(F p ) is given by

#E p (a, b) = p + 1 -a p ,
where

|a p | ≤ 2 √ p.
For the special case a = 0, the order #E p (0, b) can easily be determined.

Lemma H.2.2. Let p > 3 be a prime satisfying p ≡ 2 (mod 3) and 0 < b < p. Then #E p (0, b) = p + 1.

H.2.2 Elliptic Curves over Z n

We now consider elliptic curves over the ring Z n = Z/nZ where n = pq is the product of two large distinct primes p and q. An elliptic curve E n (a, b) over Z n is the set of points (x, y) ∈ Z 2 n satisfying y 2 = x 3 + ax + b (mod n) together with the point at infinity O. The addition law can be extended for points in a curve E n (a, b) over Z n . Note that the addition law is not always well-defined when using analytical expressions since there are elements in Z n which are not invertible. It follows that E n (a, b)(Z n ) is not a group. By the Chinese Remainder Theorem, the mapping

E n (a, b) → E p (a, b) × E q (a, b)
defined by the the natural projections is a bijection. Thus, a point (x, y) of the elliptic curve E n (a, b) is associated to the point ((x (mod p), y (mod p)), (x (mod q), y

(mod q)) ∈ E p (a, b) × E q (a, b).
The points (O, P ) and (P, O) can not be represented like this. Finding such a point is, however, very unlikely and would lead to the factorization of n. The Chinese Remainder Theorem leads to the following lemma.

Lemma H.2.3. Let n = pq be an RSA modulus and E n (a, b) an elliptic curve over Z n with gcd 4a 3 + 27b 2 , n = 1. Then for any P ∈ E n (a, b) and any integer k, we have

(1 + k#E p (a, b)#E q (a, b))P = P.

H.2.3 KMOV Scheme

In 1991, Koyama, Maurer, Okamoto and Vanstone [START_REF] Koyama | New public-key schemes based on elliptic curves over the ring Z n[END_REF] proposed the so called KMOV cryptosystem using elliptic curves defined over the elliptic curve E n (a, b) where n = pq is an RSA modulus.

• Key Generation

INPUT: The bit-length k of the RSA modulus. OUTPUT: The public key (n, e) and the private key (n, d).

1. Find two primes, p and q, of length k/2 bits satisfying p ≡ q ≡ 2 (mod 3). 2. Compute the RSA modulus n = pq. 3. Choose a public key e co-prime to (p + 1)(q + 1). 4. Compute the inverse d of e mod ((p + 1)(q + 1)). 5. Return the public key (n, e) and the private key (n, d).

• KMOV Encryption

INPUT: The public key (n, e) and the plaintext message m.

OUTPUT: The cyphertext (c 1 , c 2 ).

1. Represent the message m as a couple (m

1 , m 2 ) ∈ Z 2 n . 2. Compute b = m 2 2 -m 3 1 (mod n). 3. Compute the point (c 1 , c 2 ) = e(m 1 , m 2 ) on the elliptic curve y 2 = x 3 + b (mod n). 4. Return (c 1 , c 2 ).

• KMOV Decryption

INPUT: The private key (n, d) and the cyphertext (c 1 , c 2 ). OUTPUT: The plaintext message (m 1 , m 2 ).

1. Compute b = c 2 2 -c 3 1 (mod n). 2. Compute the point (m 1 , m 2 ) = d(c 1 , c 2 ) on the elliptic curve y 2 = x 3 + b (mod n). 3. Return (m 1 , m 2 ).
The decryption scheme is valid since, using Lemma H.2.2 and Lemma H.2.3, we have

d(c 1 , c 2 ) = de(m 1 , m 2 ) = (1 + k(p + 1)(q + 1))(m 1 , m 2 ) = (1 + k#E p (0, b)#E q (0, b))(m 1 , m 2 ) = (m 1 , m 2 ),
where k is the integer satisfying ed = 1 + k(p + 1)(q + 1).

H.3 The New attack on the KMOV Cryptosystem

Let n = pq be an RSA modulus as required by the KMOV Cryptosystem.

Suppose that e is an integer satisfying gcd(e, (p + 1)(q + 1)) = 1. Let x, y be co-prime positive integers. Define z by ex -(p + 1)(q + 1)y = z.

In this section, we show that, under some conditions, it is possible find x, y, p, q which leads to the factorization of the RSA modulus and breaks the system. We shall need the following useful result.

Lemma H.3.1. Let n = pq be an RSA modulus with q < p < 2q. Then

2 √ n < p + q < 3 √ 2 2 √ n.
Proof. We have (p + q) 2 = (p -q) 2 + 4n > 4n.

Then p + q > 2 √ n. On the other hand, since q < p < 2q, then n < p 2 < 2n and √ n < p < √ 2n. Hence

p + q = p + n p < √ 2n + n √ 2n = 3 √ 2 2 √ n.
This terminates the proof.

We shall also need the following result (see [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF], Theorem 184).

Theorem H.3.2. Let α be a real number. If x and y are positive integers such that gcd(x, y) = 1 and

α - y x < 1 2x 2 ,
then y x is one of the convergents of the continued fraction expansion of α. Now, we can prove the following theorem which permits to find x and y using the convergents of the continued fraction expansion of e n .

Theorem H.3.3. Let n = pq be an RSA modulus with q < p < 2p. Suppose that the public exponent e satisfies an equation ex -(p + 1)(q + 1)y = z with gcd(x, y) = 1 and

|z| < n 1 4 y, xy < √ 2 √ n 12 .
Then y x is one of the convergents of the continued fraction expansion of e n .

Proof. Transforming the equation ex -(p + 1)(q + 1)y = z, we get ex -ny = (p + q + 1)y + z.

Dividing by nx, we get

e n - y x = (p + q + 1)y + z nx . (H.4)
Assume that |z| < n 1 4 y. Then using Lemma H.3.1, we get

|(p + q + 1)y + z| ≤ (p + q + 1)y + |z| ≤ (p + q + 1)y + n 1 4 y = (p + q + 1 + n 1 4 )y < 2(p + q)y ≤ 3 √ 2 √ ny. Now, assume that xy < √ 2 √ n 12 . Then (H.4) implies e n - y x = |(p + q + 1)y + z| nx < 3 √ 2 √ ny nx < 1 2x 2 .
Then, applying Theorem H.3.2, y x is a convergent of the continued fraction expansion of e N . This terminates the proof.

Next assume that x and y are known in the equation ex-(p+1)(q+1)y = z. We show how to find p and q. Let us first refer to the following existing result (see [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF]).

Theorem H.3.4 (Coppersmith). Let n = pq be an RSA modulus with q < p < 2q. Suppose we know an approximation p of p with |p -p| < n 1 4 . Then n can be factored in time polynomial in log n.

Let us summarize the factorization algorithm.

Algorithm 6 The factorization algorithm Require: a public key (N, e) satisfying N = pq, q < p < 2q and ex -(p + 1)(q + 1) = z for some parameters x, y, z. Ensure: the prime factors p and q.

1: Compute the continued fraction expansion of e n . 2: For every convergent y

x of e n with x < √ n:

3: Compute U = ex y -n -1 and V = |U 2 -4n|. 4: Apply Coppersmith's algorithm with U +V 2
as an approximation of p. 5: If Coppersmith's algorithm outputs the factorization of n, then stop.

H.4 A Numerical Example

As an example let us take for n and e the numbers n = 173428286141894798156748251, e = 723753947009734907342239.

I.1 Introduction

In 1978, Rivest, Shamir and Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] proposed RSA, the first and widely most used public key cryptosystem. The security of RSA is mainly based on the hardness of factoring large composite integers, nevertheless, RSA has been extensively studied for vulnerabilities by various non factorization attacks. The public parameters in RSA are the RSA modulus N = pq which is the product of two large primes of the same bit-size and a public exponent e satisfying gcd(e, (p -1)(q -1)) = 1. The correspondent private exponent is the integer d < N satisfying ed ≡ 1 (mod (p -1)(q -1)) which can be rewritten as a key equation ed -k(p -1)(q -1) = 1. In RSA, the encryption and decryption time are proportional to the bit-length of the public and the private exponents. To reduce encryption or decryption time, one may be tempted to use small public exponents or private exponents. While a few attacks on RSA with small public exponent e have been launched (see [START_REF] Hastad | Solving simultaneous modular equations of low degree[END_REF]), many attacks on RSA with small or special private exponent d exploit the algebraic properties of the key equation. In 1990, Wiener [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] presented an attack on RSA that solves the key equation and factors N if d is sufficiently small, namely d < 1 3 N 0.25 . Wiener's attack consists on finding k d among the convergents of the continued fraction expansion of e N and then using k d to factor N . Wiener's attack on RSA has been extended in many ways using lattice reduction and Coppersmith's method [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] (see [15], [START_REF] Hinek | Cryptanalysis of RSA and its Variants[END_REF], [START_REF] May | New RSA Vulnerabilities Using Lattice Reduction Methods[END_REF]). In 1997, Boneh and Durfee [17] used lattice reduction and Coppersmith's method to improve the bound to d < N 0.292 . In 2004, Blömer and May studied the variant equation ex + y ≡ 0 (mod (p -1)(q -1)) and showed that the RSA modulus can be factored if the unknown parameters satisfy x < 1 3 N 0.25 and |y| ≤ cN -3 4 ex for some constant c ≤ 1. In order to improve the implementation of the RSA cryptosystem, many schemes have been presented giving rise to RSA type cryptosystems [20]. One way to extend RSA is to consider a prime-power modulus of the form N = p r q with r ≥ 2 (see [START_REF] Takagi | Fast RSA-Type Cryptosystem Modulo p k q[END_REF]) or a multi-prime modulus of the form N = p 1 p 2 . . . p r . Another way to extend RSA is to consider the modulus N = pq and the exponent e with specific arithmetical operations such as elliptic curves [START_REF] Kuwakado | A new RSA-type scheme based on singular cubic curves y 2 = x 3 + bx 2 (mod n)[END_REF] [79], Gaussian domains [START_REF] Elkamchouchi | Extended RSA cryptosystem and digital signature schemes in the domain of Gaussian integers[END_REF] and quadratic fields [START_REF] Paulus | A new public key cryptosystem over quadratic orders with quadratic decryption time[END_REF].

In 1995, Kuwakado, Koyama and Tsuruoka [START_REF] Kuwakado | A new RSA-type scheme based on singular cubic curves y 2 = x 3 + bx 2 (mod n)[END_REF] presented a scheme based on using an RSA modulus N = pq and a singular cubic equation with equation y 2 = x 3 + bx 2 mod N where a message M = (m x , m y ) is represented as a point on the singular cubic equation. In this system, the public exponent e and the private exponent d satisfy an equation of the form ed -k p 2 -1 q 2 -1 . In 2002, Elkamchouchi, Elshenawy and Shaban [START_REF] Elkamchouchi | Extended RSA cryptosystem and digital signature schemes in the domain of Gaussian integers[END_REF] adapted RSA to the Gaussian domain by using a modulus of the form N = P Q where P and Q are two Gaussian primes. The public exponent e and the private exponent d satisfy ed ≡ 1 (mod (|P | -1) (|Q| -1)). When P = p and Q = q are integer prime numbers, the equation becomes ed ≡ 1 (mod p 2 -1 q 2 -1 ) = 1. In 1993, Smith and Lennon proposed LUC [START_REF] Smith | LUC: a new public-key cryptosystem[END_REF], where the public exponent e and the private exponent d are such that ed ≡ 1 (mod p 2 -1 q 2 -1 ). In 2007, in connection with LUC, Castagnos [START_REF] Castagnos | An efficient probabilistic public-key cryptosystem over quadratic field quotients[END_REF] proposed a scheme that uses an RSA modulus N = pq and a public exponent e. The two public parameters N and e are such that gcd e, p 2 -1 q 2 -1 = 1 which implies the existence of two positive integers d and k satisfying the equation ed -k p 2 -1 q 2 -1 = 1. The former four variants of RSA use a modulus N = pq and a public exponent e satisfying an equation of the form ed -k p 2 -1 q 2 -1 = 1. In [START_REF] Bunder | A new attack on three variants of the RSA cryptosystem[END_REF], an attack is presented that solves the former equation when d satis-

fies d < 2N 3 -18N 2 e
. The attack, which is related to Wiener's attack on RSA, is based on applying the continued fraction algorithm to find k d among the covergents of the continued fraction expansion of e N 2 -9 4 N +1 . In this paper, we consider an extension of this attack by studying the more general equation ex -p 2 -1 q 2 -1 y = z where the unknown parameters x, y, z satisfy

xy < 2N -4 √ 2N 3 4
and |z| < (p -q)N 1 4 y.

The new attack uses the convergents of the continued fraction expansion of e N 2 +1-9 4 N to find y x and then applies Coppersmith's technique [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] to find p and q.

The remainder of the paper is organized as follows. In section 2, we recall some RSA type schemes that are based on a modulus of the form N = pq with a public exponent satisfying gcd e, p 2 -1 q 2 -1 = 1. In Section 3, we briefly review some basic results used in the paper, including continued fractions and Coppersmith's technique. In Section 4, we present some lemmas that will be used in the paper. In Section 5, we present our new method. In Section 6, we give a numerical example. We conclude the paper in Section 7.

I.2 Variant RSA schemes

Let N = pq be an RSA modulus and e a public integer. In this section, we briefly describe three schemes that are variants of the RSA cryptosystem with a modulus N = pq and with a public key e and a private key d satisfying ed -k p 2 -1 q 2 -1 = 1. As this equation does not depend on the underlying variant schemes, we then generalize it to the equation ex -p 2 -1 q 2 -1 y = z which is the main focus of this paper.

I.2.1 LUC cryptosystem

In 1993, Smith and Lennon [START_REF] Smith | LUC: a new public-key cryptosystem[END_REF] proposed a variant of the RSA cryptosystem, called LUC, based on a Lucas functions. In LUC, the modulus is a RSA modulus N = pq and the public exponent e is a positive integer satisfying gcd e, p 2 -1 q 2 -1 which can be rewritten as an equation edk p 2 -1 q 2 -1 = 1. A more general equation is ex-p 2 -1 q 2 -1 y = z with the unknown parameters x, y and z.

I.2.2 Castagnos cryptosystem

In 2007, Castagnos [START_REF] Castagnos | An efficient probabilistic public-key cryptosystem over quadratic field quotients[END_REF] proposed a cryptosystem related to LUC and RSA where the modulus N = pq and the public exponent e satisfy the condition gcd e, p 2 -1 q 2 -1 or equivalently ed-k p 2 -1 q 2 -1 = 1 for some integers d and k. This equation can be extended to a more general one, namely ex -p 2 -1 q 2 -1 y = z.

I.2.3 RSA with Gaussian primes

In 2002, Elkamchouchi, Elshenawy and Shaban [START_REF] Elkamchouchi | Extended RSA cryptosystem and digital signature schemes in the domain of Gaussian integers[END_REF] proposed a generalization of the RSA cryptosystem to the domain of Guassian integers. A Gaussian integer is a complexe number z = a + bi where a and b are both integers. A Gaussian prime is a Gaussian integer that is not the product of two non-unit Gaussian integers, the only units being ±1 and ±i. The Gaussian primes are of one of the following forms

• P = ±1 ± i,
• P = a where |a| is an integer prime with |a| ≡ 3 (mod 4),

• P = ai where |a| is an integer prime with |a| ≡ 3 (mod 4), mod 4) is an integer prime.

• P = a + ib where |P | = a 2 + b 2 ≡ 1 (
In the RSA variant with Gaussian integers, the modulus is N = P Q, a product of two Gaussian integer primes P and Q. The Euler totient function is φ(N ) = (|P | -1) (|Q| -1) and the public exponent e is a positive integer satisfying gcd(e, φ(N )) = 1. When P = p and Q = q are integer primes, then φ(N ) = p 2 -1 q 2 -1 and the public exponent satisfies the key equation ed-k p 2 -1 q 2 -1 = 1 which can be extended to a more general equation ex -p 2 -1 q 2 -1 y = z.

I.2.4 RSA type schemes based on singular cubic curves

Let N = pq be an RSA modulus. For an integer b ∈ Z/nZ, consider the cubic curve E N (b) defined over the ring Z/nZ given by the Weierstrass equation

E N (b) : y 2 = x 3 + bx 2 mod N.
In 1995, Kuwakado, Koyama, and Tsuruoka [START_REF] Kuwakado | A new RSA-type scheme based on singular cubic curves y 2 = x 3 + bx 2 (mod n)[END_REF] proposed a new cryptosystem based the elliptic curve E N (b). The encryption key is a positive integer satisfying gcd e, p 2 -1 q 2 -1 and the decryption key is the integer d satisfying ed ≡ 1 (mod p 2 -1 q 2 -1 ), or equivalently

ed -k p 2 -1 q 2 -1 = 1.
The encryption and the decryption procedures use operations on the singular cubic curve E N (b). Using the continued fraction algorithm, it is possible to attack the scheme using the key equation ed-k p 2 -1 q 2 -1 = 1. A more general attack on the scheme can be launched by using the equation exp 2 -1 q 2 -1 y = z and by combining the continued fraction algorithm and Coppersmith's method.

I.3 Preliminaries

In this section, we present the mathematical preliminaries.

I.3.1 Continued fractions

Let x be a real number. Define the sets (x 0 , x 1 , . . .) and [a 0 , a 1 , . . .] by x 0 = x and by the recurrences

a i = x i , x i+1 = 1 x i -a i , i = 0, 1, . . . .
The set [a 0 , a 1 , • • • ] is the continued fraction expansion of x and satisfies

x = a 0 + 1 a 1 + 1 a 2 + 1 . . . .
The convergents of x are the rational numbers p n q n , n = 0, 1, . . . satisfying

p n q n = a 0 + 1 a 1 + 1 a 2 + 1 . . . + 1 a n .
Continued fractions have numerous properties and applications in cryptography. The following useful result characterizes the approximations to a real number x (see Theorem 184 of [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]).

Theorem I.3.1 (Legendre). If a, b be positive integers and

0 < x - a b < 1 2b 2
then a b is a convergent of the continued fraction of x.

Note that when x = r s is a rational number, then the list of the convergents of the continued fraction expansion of r s can be done in polynomial time in log(max(a, b)).

I.3.2 Coppersmith's method

In 1997, Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] introduced an algorithm to find small solutions of univariate modular polynomial equations and another algorithm to find small roots of bivariate polynomial equations. Since then, Coppersmith's method has been applied in various applications in cryptography, mainly to attack the RSA cryptosystem. A typical example is the following result.

Theorem I.3.2. Let N = pq be the product of two unknown primes such that q < p < 2q. Given an approximation p of p with an additive error term at most N 1 4 , one can find p and q in polynomial time in log(N ).

As a consequence of Coppersmith's Theorem, one can show that if N = pq with |p -q| < N 1 4 , then N can be factored (see [START_REF] Nitaj | Another generalization of Wiener's attack on RSA[END_REF]). Thus, throughout this paper, we will consider that the prime difference p -q satisfies |p -q| > N

I.4 Useful Lemmas

One of the main RSA standard recommendations for safe parameters is to choose the prime factors factors p, q of the same bit-size. More precisely, p and q should satisfy 1 < p q < 2 or equivalently q < p < 2q. Under this assumption, one can find intervals for p, q, p -q, p + q and p 2 + q 2 in terms of N . We begin by the following results (see [START_REF] Nitaj | Another generalization of Wiener's attack on RSA[END_REF]).

Lemma I.4.1. Let N = pq be an RSA modulus with q < p < 2q. Then √ 2 2

√ N < q < √ N < p < √ 2 √ N and 0 < p -q < √ 2 2 √ N .
We will need the following result.

Lemma I.4.2. Let N = pq be an RSA modulus with q < p < 2q. Then

2 √ N < p + q < 3 √ 2 2 √ N and 2N < p 2 + q 2 < 5 2 N.
Proof. Assume that N = pq with q < p < 2q. Then 1

< p q < 2. The function f (x) = x + 1 x is increasing on [1, +∞). Hence, f (1) < f ( p q ) < f (2), that is 2 < p q + q p < 5 2 .
Multiplying by N = pq, we get

2N < p 2 + q 2 < 5 2 N.
Similarly, since 1

< p q < √ 2, then f (1) < f ( p q ) < f ( √ 2), or equivalently 2 < p q + p q < 3 √ 2 2 .
Hence, multiplying by

√ N = √ pq, we get 2 √ N < p + q < 3 √ 2 2 √ N .
This terminates the proof.

I.5 The New Attack

In this section, we present our new attack to solve the equation exp 2 -1 q 2 -1 y = z when x, y and z are suitably small. The new method combines two techniques, the continued fraction algorithm and Coppersmith's method.

Theorem I.5.1. Let N = pq be an RSA modulus with q < p < 2q. Let e be a public exponent satisfying an equation ex -p 2 -1 q 2 -1 y = z with coprime positive integers x and y. If

xy < 2N -4 √ 2N 3 4
and |z| < (p -q)N 1 4 y, then one can find p and q in polynomial time in log(N ).

Proof. Suppose that N = pq with q < p < 2q and that a public exponent e satisfies the equation

ex -p 2 -1 q 2 -1 y = z, (I.1)
with x > 0, y > 0 and gcd(x, y) = 1. Then

ex -N 2 + 1 - 9 4 N y = ex -(p 2 -1)(q 2 -1)y -p 2 + q 2 - 9 4 N y = z -p 2 + q 2 - 9 4 N y.
(I.2) From this we deduce

e N 2 + 1 -9 4 N - y x ≤ |z| x N 2 + 1 -9 4 N + p 2 + q 2 -9 4 N y x N 2 + 1 -9 4 N . (I.3)
Using Lemma I.4.2, we get that p 2 + q 2 -9 4 N < 1 4 N . Suppose in addition that |z| < |p -q|N 1 4 y. Then, using Lemma I.4.1, we get

|z| < |p -q|N 1 4 y < √ 2 2 √ N • N 1 4 y = √ 2 2 N 3 4 y. (I.4) Hence (I.3) leads to e N 2 + 1 -9 4 N - y x < √ 2 2 N 3 4 N 2 + 1 -9 4 N • y x + 1 4 N N 2 + 1 -9 4 N • y x = N + 2 √ 2N 3 4 4N 2 + 4 -9N • y x . (I.5) Now, suppose that xy < 2N -4 √ 2N 3 4 . A straightforward calculation shows that 2N -4 √ 2N 3 4 < 4N 2 + 4 -9N 2N + 4 √ 2N 3 4
. ex ≡ z (mod p 2 -1 q 2 -1 ). Moreover, the exponent e satisfies e ≡ z x (mod p 2 -1 q 2 -1 ).

Hence, Theorem I.5.1 implies that one can factor N = pq for such exponents e in the case where xy < 2N -4 √ 2N

3 4 and |z| < (p -q)N 1 4 y. We now consider an application of Theorem I.5.1 to the private exponent d. We recall that d satisfies ed ≡ 1 (mod p 2 -1 q 2 -1 ). Instead of this modular equation, we consider the key equation

ed -k p 2 -1 q 2 -1 = 1.
Corollary I.5.2. Let N = pq be an RSA modulus with q < p < 2q. Let e < p 2 -1 q 2 -1 be a public exponent. If the private exponent d satisfies

d < 2N -4 √ 2N 3 4
, then one can find p and q in polynomial time in log(N ).

Proof. Suppose that q < p < 2q and e < p 2 -1 q 2 -1 . Since the private exponent d satisfies ed -k p 2 -1 q 2 -1 = 1 for a positive integer k, then

k = ed -1 (p 2 -1) (q 2 -1) < d • e (p 2 -1) (q 2 -1) < d.
Then dk < d 2 . Now, assume that d 2 < 2N -4 √ 2N

I.6 A Numerical Example

In this section we give a detailed numerical example to explain our method as developed in Theorem I.5.1. Let us consider the small public key

N = 204645825996541, e = 26384989321053458213237.
It is obvious that equation ex -p 2 -1 q 2 -1 y = z has infinitely many solutions (x, y, z) with positive integers x, y and non zero integer z. Our aim is to find the solution that satisfies the conditions of Theorem I.5.1, if any. Define We want to find y

x among the convergents of the continued fraction expansion of

I.7 Conclusion

In this paper, we considered some variants of the RSA cryptosystem with a modulus N = pq and an exponent e satisfying gcd e, p 2 -1 q 2 -1 = 1. We studied the general equation ex -p 2 -1 q 2 -1 y = z and combined the continued fraction algorithm with Coppersmith's technique to find x and y and then to factor the RSA modulus N . Our new method can considered as an extension to some RSA type schemes of two former methods that work for RSA, namely Wiener's attack and Blömer-May attack. public-key cryptosystems, offering both encryption (NTRUencrypt) and digital signatures (NTRUSign). It is a relatively new cryptosystem that appears to be more efficient than the current and more widely used public-key cryptosystems, such as RSA [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] and El Gamal [START_REF] Gamal | A public key cryptosystem and signature scheme based on discrete logarithms[END_REF]. It is well known that the security of RSA and El Gamal relies on the difficulty of factoring large composite integers or computing discrete logarithms. However, in 1994, Shor [START_REF] Shor | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF] showed that quantum computers can be used to factor integers and to compute discrete logarithms in polynomial time. Since NTRU does not rely on the difficulty of factoring or computing discrete logarithms and is still considered secure even against quantum computer attacks, it is a promising alternative to the more established public key cryptosystems. In [START_REF] Hoffstein | NTRU: A Ring Based Public Key Cryptosystem[END_REF], Hoffstein, Pipher and Silverman have studied different possible attacks on NTRU. The brute force and the meet-in-the-middle attacks may be used against the private key or against a single message but will not succeed in a reasonable time. The multiple transmission attack also will fail for a suitable choice of parameters. However, we notice that NTRU suggests that the public key should be changed very frequently, for each transmission if possible. The most important attack, presented by Coppersmith and Shamir [START_REF] Coppersmith | Lattice attacks on NTRU[END_REF] in 1997 makes use of the LLL algorithm of Lenstra, Lenstra and Lovász [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF]. Coppersmith and Shamir constructed a lattice generated by the public key and found a factorization of the public key that could be used to break the system if the NTRU parameters are poorly set.

The NTRU cryptosystem depends on three integer parameters (N, p, q) and four sets L f , L g , L r , L m of polynomials of degree N -1 with small integer coefficients. Let Z q denote the ring of integers modulo q. The operations of NTRU took place in the ring of polynomials Z q [X]/ X N -1 . In this ring, the addition of two polynomials is defined as pairwise addition of the coefficients of the same degree and multiplication, noted " * " is defined as convolution multiplication. In NTRU, to create a public key h, one chooses a private key (f, g) composed with two polynomials f and g and computes

h = f -1 q * g ∈ Z q [X]/ X N -1 , where f -1 q is the inverse of f in Z q [X]/ X N -1 .
In this paper, we consider NTRU with two public keys h, h defined by the private keys (f, g) and (F , G ) with

h = F -1 q * G (mod q).
Since f is invertible in Z q [X]/ X N -1 , then we can define g = f * h (mod q) so that h = f -1 q * g mod q. The main objective of this paper is to show how to find the private key (f, g) when g -g < min( g , g ).

Using h and h , we construct a lattice L(h, h ) of dimension 2N , and applying the lattice basis reduction algorithm LLL, we show that short vectors in L(h, h ) can be used to find the private polynomials f , g, g when gg < min( g , g ). Under this condition, it is important to notice that our method is more efficient than the method of Coppersmith and Shamir to recover the private key (f, g) using the public key h.

We note that when the polynomials g, g are generated randomly and independently, then with overwhelming probability the condition g -g < min( g , g ) is not satisfied. So in practice one can easily avoid this inequality.

Similarly, assume that h = F -1 q * G (mod q) is invertible in the ring Z q [X]/ X N -1 . Then we can define a polynomial f as

f = h -1
q * g (mod q), where h -1 q is the inverse of h in Z q [X]/ X N -1 . Using lattice reduction techniques, we show that it is possible to recover the private key (f, g) assuming that the condition f -f < min( f , f ) is fulfilled.

The paper is organized as follows. In Section 2, we give motivation for our work. Section 3 gives a brief mathematical description of NTRU and introduces the LLL algoritm as well as the attack of Coppersmith and Shamir on NTRU. In Section 4, we present our new attack on NTRU with two private keys (f, g) and (f, g ) with g -g < min( g , g ) and compare it with the attack of Coppersmith and Shamir. In Section 5, we present our new attack on NTRU when h and h are invertible and f -f < min( f , f ). We conclude the paper in Section 6.

J.2 Motivation

RSA, the most commonly used public-key cryptosystem [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] has stood up remarkably well to years of extensive cryptanalysis and is still considered secure by the cryptographic community (see [15] for more details). Various schemes and digtal signatures are based on the same problem behind RSA (see e.g. [START_REF] Cao | Universal Encrypted Deniable Authentication Protoco[END_REF] and [START_REF] Yang | A Traitor Tracing Scheme Based on the RSA System[END_REF] ). Indeed, RSA derives its security from the difficulty of factoring large numbers of the shape N = pq where p, q are large unknown primes of the same bit-size. In some cases, the problem can be slightly easier given two RSA modulus N = pq, N = p q . If p = p , then it is trivial to factor N and N by computing gcd(N, N ). However, it is possible to factor N and N when p and p share a certain amount of bits (see [START_REF] May | Implicit factoring: On polynomial time factoring given only an implicit hint[END_REF], [START_REF] Sarkar | Small secret exponent attack on RSA variant with modulus N = p r q, Designs[END_REF]).

The first paper on NTRU was written by Coppersmith and Shamir [START_REF] Coppersmith | Lattice attacks on NTRU[END_REF] in 1997. In that paper, they noted that the best way to attack the NTRU cryptosystem was via the techniques of lattice reduction. Nevertheless, the security of NTRU is also based on the following factorization problem: Given a polynomial h ∈ Z[X]/ X N -1 , find two short polynomials f and g with f ∈ Z[X]/ X N -1 and g ∈ Z[X]/ X N -1 such that h = f -1 q * g (mod q), where f -1 q is the inverse of f in Z q [X]/ X N -1 .

Similarly to RSA with two modulus, consider NTRU with two public keys h and h defined by the same parameters (N, p, q). Assume that h = f -1 q * g (mod q). Then, h can be expressed as h = f -1 q * g (mod q) where g = f * h (mod q). The main contribution of this paper is to show how to find the private keys (f, g) when g and g satisfy g -g < min( g , g ).

We notice that lattice-based cryptography is currently seen as one of the most promising alternatives to cryptography based on number theory. Given recent advances in lattice-based cryptography (see [START_REF] Lyubashevsky | On Ideal Lattices and Learning with Errors over Rings[END_REF] and [START_REF] Stehlé | Making NTRU as Secure as Worst-Case Problems over Ideal Lattices[END_REF]), studying NTRU and related schemes is both useful and timely. In this direction, our work shows that using the same f or the same g in generating public keys h, h is likely to reduce the security of NTRU.

J.3 Mathematical background

In this section, we give a brief description of the NTRU encryption and the LLL algorithm for lattice reduction and the well known attack of Coppersmith and Shamir on NTRU. Further details can be found in [START_REF] Hoffstein | NTRU: A Ring Based Public Key Cryptosystem[END_REF] and [START_REF] Coppersmith | Lattice attacks on NTRU[END_REF].

J.3.1 Definitions and notations

We start by introducing the ring R = Z[X]/(X N -1), upon which NTRU operates. We use * to denote a polynomial multiplication in R, which is the cyclic convolution of two polynomials. If

f = (f 0 , f 1 , • • • , f N -1 ) = N -1 i=0 f i X i , g = (g 0 , g 1 , • • • , g N -1 ) = N -1 i=0 g i X i , are polynomials of R, then h = f * g is given by h = (h 0 , h 1 , • • • , h N -1 ), where h k is defined for 0 ≤ k ≤ N -1 by h k = i+j≡k mod N f i g j = k i=0 f i g k-i + N -1 i=k+1 f i g N +k-i .
The Euclidean norm or the length of a polynomial f

= (f 0 , f 1 , • • • , f N -1 ) is defined as f = N -1 i=0 f 2 i .
One more notation is the binary set of polynomials B(d) defined for a positive integers d by

B(d) = {f (X) = N -1 i=0 f i X i ,
where

f i ∈ {0, 1}, N -1 i=0 f i = d}.
In other words, B(d) is the set of polynomials of R with d coefficients equal to 1 and all the other coefficients equal to 0.

Different descriptions of NTRUEncrypt and different proposed parameter sets have been in circulation since 1996. The 2005 instantiation of NTRU is set up by six public integers N , p, q, d f , d g , d r and four public spaces L f , L g , L m , L r such that

• N is prime and sufficiently large to prevent lattice attacks.

• p and q are relatively prime.

• q is much larger than p.

• L f is a set of small polynomials from which the private keys are selected.

• L g is a similar set of small polynomials from which other private keys are selected.

• L m is the plaintext space. It is a set of polynomials m ∈ Z p [X]/(X N -1) that represent encryptable messages.

• L r is a set of polynomials from which the blinding value used during encryption is selected.

J.3.2 The NTRU Encryption Scheme

Key pair generation.

To create a NTRU key, one randomly chooses a polynomial f ∈ L f and a polynomial g ∈ L g . The polynomial f must satisfy the additional requirement that it has an inverse f -1 p modulo p and an inverse f -1 q modulo q, that is f * f -1 p = 1 (mod p), f * f -1 q = 1 (mod q). Then the private key is f and the public key is the polynomial h = f -1 q * g (mod q). We recall that N , p, q are also public.

Encryption.

To encrypt a message m ∈ L m , one randomly chooses a polynomial r ∈ L r . The ciphertext is the polynomial e = pr * h + m (mod q). Decryption.

To decrypt an encrypted message e using the private key f , one computes

a = f * e mod q,
where the coefficients of a lie between -q/2 and q/2. The message m is then obtained from a by reducing the coefficients of f -1 p * a modulo p.

J.3.3 The LLL algorithm

Since lattice reduction is an essential tool for our attack, let us recall a few facts about lattices and reduced basis. Let u 1 , . . . , u n ∈ R m be linearly independent vectors with n ≤ m. The lattice L spanned by (u 1 , . . . , u n ) consists of all integral linear combinations of u 1 , . . . , u n , that is

L = Zu 1 ⊕ • • • ⊕ Zu n = n i=1 b i u i , b i ∈ Z .
The set (u 1 , . . . , u n ) is called a lattice basis. A lattice can be conveniently represented by a matrix B whose rows are the vectors u 1 , . . . , u n . The determinant of the lattice L is defined as det(L) = det (BB T ).

the row vectors of a matrix of the following form

M (L) = λI N H 0 qI N =                 λ 0 • • • 0 h 0 h 1 • • • h N -1 0 λ • • • 0 h N -1 h 0 • • • h N -2 . . . . . . . . . . . . . . . . . . . . . . . . 0 0 • • • λ h 1 h 2 • • • h 0 0 0 • • • 0 q 0 • • • 0 0 0 • • • 0 0 q • • • 0 . . . . . . . . . . . . . . . . . . . . . . . . 0 0 • • • 0 0 0 • • • q                 . Since h = f -1 q * g (mod q), then f * h -qu = g for some u ∈ R and (f, -u) * M (L) = (f, -u) * λI N H 0 qI N = (λf, g).
So the vector (λf, g) is a short vector in the NTRU lattice L, which is with high probability the shortest vector of L. Hence, an attacker uses lattice reduction algorithms to find (f, g) from L, then he can recover the private keys. More precisely, the Gaussian heuristic says that the length of the shortest non-zero vector is usually approximately σ(L) where

σ(L) = dim(L) 2πe (det L) 1/ dim(L) = 2N 2πe (λq) N 2N = λqN πe .
Hence, in order to maximize the probability of breaking the NTRU system using lattice reduction, the attacker should choose λ to minimize the ratio

c = (λf, g) σ(L) = λ 2 f 2 + g 2 λqN πe
.

This occurs for λ = g / f which leads to c = 2πe g f qN .

(J.1)

The ratio c measures how much smaller the key is compared to the expected smallest vector. If c is very small then we expect a lattice reduction algorithm as LLL to have an easier time finding it.

J. 4 The new attack when g -g < min( g , g )

J.4.1 The new lattice Let h(X) = N -1 i=0 h i X i , h (X) = N -1 i=0 h i X i ,
be two NTRU public keys created by the private polynomials (f, g) and (F , G ) with the same parameters (N, p, q, d f , d g , d r , d m ), that is

h = f -1 q * g (mod q), h = F -1 q * G (mod q). Let g = f * h (mod q). Then h = f -1 q * g (mod q).
For a positive constant λ, define the lattice

L(h, h ) = {(λv, w) ∈ R 2 : where w = v * (h -h ) (mod q)}.
This is a 2N -dimension lattice spanned by the matrix

M (h, h ) = λI N H -H 0 qI N ,
where H -H is the circulant matrix

      h 0 -h 0 h 1 -h 1 • • • h N -1 -h N -1 h N -1 -h N -1 h 0 -h 0 • • • h N -2 -h N -2 . . . . . . . . . . . . h 1 -h 1 h 2 -h 2 • • • h 0 -h 0      
.

The matrix M (h, h ) has the following property.

Proposition J.4.1. Let h, h be two NTRU public keys. Assume that

f * h = g + qu, f * h = g + qu .
Then the vector (λf, g -g ) is in the lattice L(h, h ) and

(f, -u + u ) * M (h, h ) = (λf, g -g ).
Proof. Assume that f * h = g + qu and f * h = g + qu . Substracting the two equalities, we get

f * h -f * h = f * (h -h ) = g -g (mod q).
This implies that the vector (λf, g -g ) is in L(h, h ). Next, we have

(f, -u + u ) * M (h, h ) = (f, -u + u ) * λI N H -H 0 qI N = (λf, g -g ).
This terminates the proof.

J.4.2 The Gaussian heuristics

For a random lattice L, the Gaussian heuristic says that the length of the shortest non-zero vector is approximately

σ(L) = dim(L) 2πe det L 1/ dim(L) .
The dimension and determinant of L(h, h ) are given by

dim(L(h, h )) = 2N, det(L(h, h )) = λ N q N .
Hence for the lattice L(h, h ), we have

σ(L(h, h )) = λN q πe .
Let us define the ratio

c 1 = (λf, g -g ) σ(L(h, h )) .
So c 1 is the ratio of the length of the target vector to the length of the expected shortest vector. The smaller the value of c 1 , the easier it will be to find the target vector. Thus, the idea to increase the chances of LLL to find (λf, g -g ) is to choose λ such that (λf, g -g ) is as small as possible compared to σ(L(h, h )). In L(h, h ), we have

(λf, g -g ) = λ 2 f 2 + g -g 2 .
It turns out that we should choose

λ = g -g f .
This implies that the ratio c 1 satisfies

c 1 = 2πe g -g f qN .
Let us compare the ratio c 1 and the ratio c as defined by (J.1) in the the attack of Coppersmith and Shamir. Our attack will be more efficient when c 1 < c. This leads to the following condition g -g < min( g , g ).

J. 5 The new attack when f -f < min ( f , f )

J.5.1 The new lattice

Let h = f -1 q * g (mod q) and h = F -1 q * G (mod q) be two NTRU public keys with the same parameters (N, p, q, d f , d g , d r , d m ). In this section, we assume that h, h are invertible in Z q [X]/ X N -1 . Let h q and h q be their inverses. Define f = g * h q . We have g * h q = f (mod q), g * h q = f (mod q).

Let

h q (X) = N -1 i=0 h q,i X i , h q (X) = N -1 i=0 h q,i X i ,
be the representations of h q (X) and h q (X) in Z q [X]/ X N -1 . For a positive constant λ, define the 2N dimension lattice

L q (h, h ) = (λv, w) ∈ R 2 : w = v * h q -h q (mod q) .
The lattice is generated by the row vectors of the matrix M q (h, h ) given below

M q (h, h ) = λI N H q -H q 0 qI N ,
where H q -H q is the circulant matrix

      h q,0 -h q,0 • • • h q,N -1 -h q,N -1 h q,N -1 -h q,N -1 • • • h q,N -2 -h q,N -2 . . . . . . . . . h q,1 -h q,1 • • • h q,0 -h q,0      
.

The matrix M q (h, h ) has the following property.

Proposition J.5.1. Let h, h be two NTRU public keys and h q , h q their inverses in Z q [X]/ X N -1 . Assume that g * h q = f + qv, g * h q = f + qv .

Then the vector (λg, f -f ) is in the lattice L q (h, h ) and

(g, -v + v ) * M q (h, h ) = (λg, f -f ).
Proof. Assume that g * h q = f + qv and g * h q = f + qv . Then g * h q = f (mod q) and g * h q = f (mod q). This gives g * (h q -h q ) = f -f (mod q) and it follows that the vector (λg, f -f ) is in L q (h, h ). More precisely,

(g, -v + v ) * M q (h, h ) = (g, -v + v ) * λI N H q -H q 0 qI N = (λg, f -f ).
This terminates the proof.

J.5.2 The Gaussian heuristics

We can apply the the Gaussian heuristic to the lattice L q (h, h ). The shortest non-zero vector is approximately

σ(L q (h, h )) = dim(L q (h, h )) 2πe det L q (h, h ) 1/ dim(L q (h,h )) = λN q πe .
To compare the length of the target vector (λg, f -f ) to the length of the expected shortest vector σ(L q (h, h )), we consider the ratio

c 2 = (λg, f -f ) σ(L q (h, h )) .
In order to increase the chances of LLL to find the vector (λg, f -f ), the attacker chooses the balancing constant λ to make c 2 as small as possible.

For the lattice L q (h, h ), we have

(λg, f -f ) = λ 2 g 2 + f -f 2 .
Hence the optimal choice for λ is

λ = f -f g .
which leads to

c 2 = 2πe f -f g qN .
To increase the chance of this attack to find (λg, f -f ) comparatively to the attack of Coppersmith and Shamir, we should have c 2 < c where c is the constant defined by (J.1). This gives the condition f -f < min ( f , f ) .

J.6 Conclusion

We have shown that choosing two NTRU public keys h = f -1 q * g (mod q) and h = F -1 q * G (mod q) could be insecure in some cases. Rewriting h as h = f -1 q * g (mod q), where g = f * h (mod q), we have shown, that using lattice reduction techniques, it is possible to find the private key (f, g) when gg < min ( g , g ). We have shown that the same techniques apply when h is invertible modulo q and f -f < min ( f , f ). Here f is defined by the equality f * h = g (mod q). For implementations of NTRU key pair generation we recommend to build in a check for g -g > min ( g , g ) and f -f > min ( f , f ). This is very easy to implement, and will only in extremely rare cases imply that the key pair is to be rejected. The main reason is that when f , g, F and G are generated randomly, the probability that g and g = f * h (mod q) share an important amount of monomials is negligible. Similarly, the probability that f and f = g * h -1 (mod q) share an important amount of monomials is also negligible.

K.1 Introduction

Boolean functions are used in logic and in many cryptographic applications such as blocks of symmetric key cryptosystems, stream cipher systems, coding theory and hash functions. Boolean functions are important for the security of such systems. So, for security reason, one seeks boolean functions having good properties such as nonlinearity, balancedness and algebraic immunity [START_REF] Dalai | Cryptographically significant boolean functions: construction and analysis in terms of algebraic immunity[END_REF][START_REF] Sarkar | Construction of Nonlinear Boolean Functions with Important Cryptographic Properties[END_REF] (see [START_REF] Crama | Boolean Functions, Theory, Algorithms, and Applications[END_REF] for more properties). A boolean function is a mapping {0, 1} n → {0, 1}, often characterized by its truth table. The number of boolean functions with n variables is 2 2 n and it is impracticable to exhaustively exhibit a boolean function with optimal properties. One way to tackle this problem is to study the arithmetical structure of boolean functions and test their cryptographic reliability by the mean of algebraic tools such as Möbius transform and Algebraic Normal Form. For this reason, a lot of effort has been given to find ways to construct boolean functions with strong cryptographic properties.

For n ≥ 1, we set GF (2) = {0, 1} and GF (2) n = {0, 1} n . Any vector x ∈ GF (2) n is represented by its coordinates as x = (x 1 , . . . , x n ) or simply x = x 1 . . . x n . The Hamming weight w H (x) of x ∈ GF (2) n is the number of non zero coordinates of x. An n-boolean function f is a mapping from GF (2) n into GF (2). A boolean function is completely determined by its truth table f (0, 0, 0 . . . , 0), f (0, 1, 0, . . . , 0), f (0, 1, 0, . . . , 0), . . . , f (1, 1, 1, . . . , 1), and can be represented uniquely by the algebraic normal form (ANF)

f (x 1 , . . . , x n ) = ( 1 ,..., n )∈GF (2) n f ( 1 , . . . , n )x 1 1 . . . x n n ,
where f is also a boolean function, called the Möbius transform of f . The transformation of f to its ANF can be performed using the truth table of f (see [START_REF] Carlet | Boolean Functions for Cryptography and Error Correcting Codes[END_REF] and [START_REF] Pieprzyk | Computing Möbius Transforms of Boolean Functions and Characterizing Coincident Boolean functions[END_REF]).

Boolean functions have been intensively studied and various arithmetical properties are known such as Möbius transforms [START_REF] Pieprzyk | Computing Möbius Transforms of Boolean Functions and Characterizing Coincident Boolean functions[END_REF], Fourier transforms [START_REF] Carlet | Boolean Functions for Cryptography and Error Correcting Codes[END_REF] and some cryptographic applications [START_REF] Sarkar | Construction of Nonlinear Boolean Functions with Important Cryptographic Properties[END_REF]. In this paper, we improve much further such arithmetic properties by introducing the concept of Dirichlet product. Usually, Dirichlet product is well defined for arithmetical functions. An arithmetical function is a real-valued function defined on the positive integers [5]. The classical Dirichlet product F * G for two arithmetical functions F, G : N → R is defined by

(F * G)(n) = d|n F (d)G( n d ) = xy=n F (x)G(y). Dirichlet product is commutative F * G = G * F , associative F * (G * H) = (F * G) * H,
and it has an identity

I(n) = 1 if n = 1 0 if n > 1 (K.1)
where F * I = I * F = F . So the set of all arithmetical functions N → R together with the Dirichlet product form an Abelian monoid. What more is that if F (1) = 0 then F has an inverse. So the subset of all arithmetical functions such that F (1) = 0 is an Abelian group with respect to the Dirichlet multiplication. The classical Dirichlet product provides great inside into some of the classical theorems in number theory. Many identities involving the Möbius function µ and the Euler totient function φ can be seen more intuitively in the language of Dirichlet product. For example, we have this identity

d|n µ(d) = 1 if n = 1 0 if n > 1 (K.2)
where µ is the the Möbius function

µ(n) =      1 if n = 1 (-1) k if n = p 1 • p 2 • • • p k 0 otherwise.
In the language of Dirichlet product, the identity (K. properties. In Section 4, we study the arithmetical and algebraic structure of the set of all coincident boolean functions. We conclude the paper in Section 5.

K.2 Boolean functions

Let n ≥ 1. A boolean function f on n variables is a mapping from {0, 1} n into {0, 1}. It can be defined by its truth table, that is by f (x 1 , . . . , x n ) for each (x 1 , . . . , x n ) ∈ {0, 1} n . For x i , i ∈ GF (2), we define

x i i x i i = x i if i = 1, 1 if i = 0
with the convention that 0 0 = 1.

The set of all boolean functions on n variables is denoted B n and any boolean function f ∈ B n can be uniquely represented by an n-multivariate polynomial over GF (2), called algebraic normal form (ANF),

f (x) = ∈GF (2) n f x ,
where f ∈ GF (2) is the coefficient of the term x = x 1 1 x 2 2 . . . x n n . In GF (2), the addition operation is simply the XOR.

The summand x = x 1 1 . . . x n n is called a monomial (term) in the ANF of f . The summand x is said to appear in f if f = 0. The degree of this summand x is the Hamming weight w H ( ) of , that is the number of nonzero elements in it. The (algebraic) degree of f , denoted by deg(f ), is the maximum degree of all summands that appear in f , that is maximum of all Hamming weights. For a constant zero function, we assume its degree is 0. The coefficient f of the summand x is related the Möbius transformation.

Definition K.2.1. Let f ∈ B n with a polynomial f (x) = ∈GF (2) n f x .
The Möbius transformation of f is the boolean function f : GF (2) n → GF (2) defined as f ( ) = f .

Using this definition, the polynomial f (x) becomes

f (x) = ∈GF (2) n f ( ) x .
We now define a partial ordering in GF (2) n in the following definition.

Definition K.2.2. Let u = (u 1 , u 2 , . . . , u n ) ∈ GF (2) n and x = (x 1 , x 2 , . . . , x n ) ∈ GF (2) n . We define the ordering

u x ⇔ u i ≤ x i for all i with 1 ≤ i ≤ n.
The following simple result gives an expression of a boolean function f in terms of its Möbius transform f . Theorem K.2.3. For x = (x 1 , . . . , x n ) ∈ GF (2) n and u = (u 1 , . . . , u n ) ∈ GF (2) n , f (x) = u x f (u), (K.5)

Take an example, let n = 3,

f (x 1 , x 2 , x 3 ) = f (0, 0, 0) + f (1, 0, 0)x 1 + f (0, 1, 0)x 2 + f (0, 0, 1)x 3 + f (1, 1, 0)x 1 x 2 + f (0, 1, 1)x 2 x 3 + f (1, 0, 1)x 1 x 3 + f (1, 1, 1)x 1 x 2 x 3 .
So f (0, 0, 0) = f (0, 0, 0) f (1, 0, 0) = f (0, 0, 0) + f (1, 0, 0) f (0, 1, 0) = f (0, 0, 0) + f (0, 1, 0) f (0, 0, 1) = f (0, 0, 0) + f (0, 0, 1) f (1, 1, 0) = f (0, 0, 0) + f (1, 0, 0) + f (0, 1, 0) + f (1, 1, 0) . . . Solving these equations, we have the dual equations f (0, 0, 0) = f (0, 0, 0) f (1, 0, 0) = f (0, 0, 0) + f (1, 0, 0) f (0, 1, 0) = f (0, 0, 0) + f (0, 1, 0) f (0, 0, 1) = f (0, 0, 0) + f (0, 0, 1) f (1, 1, 0) = f (0, 0, 0) + f (1, 0, 0) + f (0, 1, 0) + f (1, 1, 0)

In the above example, we can see the duality between f and f

f (x) = u x f (u). (K.8)
Example K.3.4. Let n = 3 and x = (0, 1, 1) ∈ GF (2) 3 . Let f, g ∈ B 3 . Then the Dirichlet product of f and g is (f * g)(0, 1, 1) =f (0, 0, 0)g(0, 1, 1) + f (0, 1, 0)g(0, 0, 1) + f (0, 0, 1)g(0, 1, 0) + f (0, 1, 1)g(0, 0, 0).

The following result shows that the set B n is an abelian monoid with respect to the Dirichlet product.

Theorem K.3.5. (B n , * ) is an Abelian monoid with the identity

I(x) = 1 if x = 0 0 if x = 0 (K.9)
Proof. We have

(f * g)(x) = u x f (u)g(x -u) = u,v x,u+v=x f (u)g(v) = v x g(v)f (x -v) = (g * f )(x),
so the Dirichlet product is commutative: f * g = g * f . We also have

((f * g) * h)(x) = u,v,w x,u+v+w=x f (u)g(v)h(w) = (f * (g * h))(x)
so the Dirichlet product is associative. Finally,

(f * I)(x) = u,v x,u+v=x f (u)I(v) = f (x)I(0) = f (x),
and I is the identity.

The following result shows that the Dirichlet product is distributive over the addition operation in B n .

Proof. By Theorem K.3.7, we have (1 * 1)(0) = 1(0)1(0) = 1. For x = 0, we have

(1 * 1)(x) = u x 1(u)1(x -u) = u x 1.
Since, by Lemma K.3.1, there are 2 w H (x) terms u with u x, we have (1 * 1)(x) = 0 for x = 0. In conclusion, 1 * 1 = I.

The following result shows that the ANF of a boolean function is related to the Dirichlet product.

Theorem K.3.9. For any function f ∈ B n , we have

f = f * 1, f = f * 1, f = f. Proof. First, we have ( f * 1)(x) = u x f (u)1(x -u) = u x f (u).
Therefore, by Theorem K.2.3, f = f * 1. Combining this with Lemma K.3.8, we get

f * 1 = ( f * 1) * 1 = f * (1 * 1) = f * I = f .
Applying the former results, we get

f = f * 1 = (f * 1) * 1 = f * (1 * 1) = f * I = f.
This terminates the proof.

The mysterious duality between a boolean function and its Möbius transformation is actually a manifestation of a simple fact in Dirichlet product, that is 1 * 1 = I. The relationship between the results of Theorem K.3.9 is liken to that of (K.3) and (K.4).

Theorem K.3.10. For any function f ∈ B n ,

f (0) = f (0).
Proof. The proof follows from Lemma K.3.7 and Theorem K.3.9.

The following result shows that f * f is either the identity I or the constant function 0.

Theorem K.3.11. For any function f ∈ B n ,

f * f = f (0)I = I if f (0) = 1 0 if f (0) = 0 (K.11) Proof. Applying Lemma K.3.7, we get (f * f )(0) = f (0)f (0) = f (0). When x = 0, (f * f )(x) = u x f (u)f (x -u).
Since u x and x -u x, everything in the sum appear twice. Hence, (f * f )(x) = 0. So f * f = f (0)I.

Theorem K.3.12. For any function f ∈ B n ,

f * f = f * f = f (0), (K.12)
where f (0) is the constant function defined by f (0)(x) = f (0).

Proof. By Theorem K.3.9 and Theorem K.3.11, we have

f * f = f * (f * 1) = (f * f ) * 1 = f (0)I * 1 = f (0)1 = f (0),
In the following result, we give a characterization of a reversible boolean function with respect to the Dirichlet product. Proof. Let f ∈ B + n and g ∈ B + n be two invertible boolean functions. By Theorem K.3.13, we know that f (0) = g(0) = 1. Then (f * g)(0) = f (0)g(0) = 1, which implies that f * g ∈ B + n . Moreover, the inverse of f ∈ B + n is itself and B + n contains the identity function I. These properties show that (B + n , * ) is an Abelian subgroup of (B n , * ).

The following result is related to the degree of boolean functions. Recall the degree of a boolean function f is defined as the maximum number of variables of the terms x = x 1 1 x 2 2 . . . x n n in the ANF of f . Theorem K. Then {ρ a } a∈GF (2) n forms a basis for the vector space (B n , +). Each function f ∈ B n can be written as a linear combination of basis functions ρ a as

f = a∈GF (2) n f (a) ρ a . (K.17)
Proof. If a x then a i ≤ x i for each i = 1, 2, . . . , n. If x i = 0, then a i = 0 and x a i i = 0 0 = 1. If x i = 1, then x a i i = 1. In all cases, x a i i = 1 and ρ a (x) = 1. Next, suppose that a x. Then there exists i with 1 ≤ i ≤ n such that a i > x i . This implies that x i = 0 and a i = 1. Hence x a i i = x i = 0 and ρ a (x) = 0. Now, we have for

x ∈ GF (2) n , a∈GF (2) n f (a) ρ a (x) = a x f (a) ρ a (x) + a x f (a) ρ a (x) = a x f (a) = f (x), by Theorem K.2.3.
Theorem K.3.18. For any a ∈ GF (2) n , the basis functions δ a and ρ a satisfy the following relations:

• δ a * 1 = ρ a and ρ a * 1 = δ a , • δ a * δ b = ρ a * ρ b = ρ a ρ b δ a+b .
Proof. First, observe that since ρ a (x) = x a , the function ρ a in ANF has only one monomial term x a , so its ANF coefficient function is δ a . That is ρ a * 1 = δ a , and so δ a * 1 = ρ a * 1 * 1 = δ a * I = δ a . Next, for any a and b, we have

(δ a * δ b )(x) = u,v x,u+v=x δ a (u)δ b (v) = 1 if a x, b x, a + b = x. 0 otherwise = ρ a (x)ρ b (x)δ a+b (x) Therefore, δ a * δ b = ρ a ρ b δ a+b . Finally, ρ a * ρ b = δ a * 1 * δ b * 1 = δ a * δ b .

K.4 Coincident functions

In this section, we study a special family of boolean functions, called coincident functions which was first introduced in [START_REF] Pieprzyk | Computing Möbius Transforms of Boolean Functions and Characterizing Coincident Boolean functions[END_REF].

Definition K.4.1. A coincident function is a function f : GF (2) n → GF (2) such that f = f . Example K.4.2. For n = 3, let f be the function f (x 1 , x 2 , x 3 ) = f (0, 0, 0) + f (1, 0, 0)x 1 + f (0, 1, 0)x 2 + f (0, 0, 1)x 3 + f (1, 1, 0)x 1 x 2 + f (0, 1, 1)x 2 x 3 + f (1, 0, 1)x 1 x 3 + f (1, 1, 1)x 1 x 2 x 3 = 0 + x 1 + x 2 + x 3 + x 1 x 2 + x 2 x 3 + x 1 x 3 + x 1 x 2 x 3 . Then f (0, 0, 0) = f (0, 0, 0) = 0, f (1, 0, 0) = f (1, 0, 0) = 1, . . . , f (1, 1, 1) = f (1, 1, 1) = 1, that is f = f and f is coincident. Theorem K.4.3. For any coincident function f , f (0) = 0.
Proof. Suppose that f is a coincident function, that is f = f . Then, using Theorem K.2.3, we get f (0, 0, . . . , 0, 1) = f (0) + f (0, 0, . . . , 0, 1).

Since f (0, 0, . . . , 0, 1) = f (0, 0, . . . , 0, 1), then f (0) = f (0) = 0.

Let C n denote the set of all such coincident functions.

Theorem K.4.4. A function f ∈ B n is a coincident function if and only if

(1 + I) * f = 0.
Thus, C n is the annihilator of 1 + I in B n .

Proof. Suppose that f is a coincident function, that is f = f . Then

0 = f + f = f * 1 + f * I = f * (1 + I).
Conversely, suppose that f * (1 + I) = 0. Then, using Theorem K.3.9, we get f * 1+f * I = f +f = 0. This implies that f = f and then f is coincident.

Observe that for any x ∈ GF (2) n , we have

(1 + I)(x) = (x 1 + 1)(x 2 + 1) . . . (x n + 1) + 1, δ 1...1 (x) = x 1 x 2 . . . x n , ρ 1...1 (x) = x 1 x 2 . . . x n .
Theorem K. Then, using Theorem K.3.16 and Theorem K.3.17, we get

ρ 1...1 (x) + δ 1...1 (x) = 1 + 1 = 0 if x = 1 . . . 1, 0 + 0 = 0 if x = 1 . . . 1.
It follows that (1 + I) * δ 1...1 = 0 and δ 1...1 is coincident.

Theorem K.4.6. For any u ∈ GF (2) n , δ u + ρ u is a coincident function.

Therefore, if f is a coincident function then for any (x 2 , . . . , x n ) ∈ GF (2) n-1 , we must have

f (0, x 2 , . . . , x n ) = (u 2 ,...,u n )≺(x 2 ,...,x n ) f (1, u 2 , . . . , u n ).
Conversely, suppose that for any (x 2 , . .

. , x n ) ∈ GF (2) n-1 , f (0, x 2 , . . . , x n ) = (u 2 ,...,u n )≺(x 2 ,...,x n ) f (1, u 2 , . . . , u n ). Then (u 2 ,...,u n )≺(x 2 ,...,x n ) f (0, u 2 , . . . , u n ) = (u 2 ,...,u n )≺(x 2 ,...,x n ) (v 2 ,...,v n )≺(u 2 ,...,u n ) f (1, v 2 , . . . , v n ).
The above sum is equal to 0 because for any term f (1, v 2 , . . . , v n ), the number of its occurrences in the sum is equal to the number of (u 2 , . . . , u n ) such that (v 2 , . . . , v n ) ≺ (u 2 , . . . , u n ) ≺ (x 2 , . . . , x n ), and this is always an even number for any (v 2 , . . . , v n ) ≺ (x 2 , . . . , x n ). Hence for any (x 2 , . . . , x n ) ∈ GF (2) n-1 , we have

(u 2 ,...,u n )≺(x 2 ,...,x n ) f (0, u 2 , . . . , u n ) = 0. (K.20) Therefore, f (0, x 2 , . . . , x n ) + (u 2 ,...,u n )≺(x 2 ,...,x n ) f (0, u 2 , . . . , u n ) + (u 2 ,...,u n )≺(x 2 ,...,x n ) f (1, u 2 , . . . , u n ) = 0. (K.
(x) = 1 if (x 2 , . . . , x n ) = (u 2 , . . . , u n ) 0 otherwise
then the collection of these functions c (u 2 ,...,u n ) will form a basis for the vector space C n and

f = (u 2 ,...,u n )∈GF (2) n-1 f (1, u 2 , . . . , u n ) c (u 2 ,...,u n ) .
We need to show that c (u 2 ,...,u n ) = γ (u 2 ,...,u n ) .

Indeed, by Theorem K.4.6, γ (u 2 ,...,u n ) is a coincident function, so it suffices to show that γ (u 2 ,...,u n ) and c (u 2 ,...,u n ) agree on 2 n-1 points (1, x 2 , . . . , x n ). We have

δ (0,u 2 ,...,u n ) (1, x 2 , . . . , x n ) = 0 δ (1,u 2 ,...,u n ) (1, x 2 , . . . , x n ) = 1 if (x 2 , . . . , x n ) = (u 2 , . . . , u n ) 0 otherwise ρ (0,u 2 ,...,u n ) (1, x 2 , . . . , x n ) = ρ (1,u 2 ,...,u n ) (1, x 2 , . . . , x n ) Therefore, γ (u 2 ,...,u n ) (1, x 2 , . . . , x n ) = 1 if (x 2 , . . . , x n ) = (u 2 , . . . , u n ) 0 otherwise and thus, γ (u 2 ,...,u n ) = c (u 2 ,...,u n ) .
Example K.4.10. When n = 3, the following 4 coincident functions form a basis for the subspace of all coincident functions:

γ (0,0) = δ (0,0,0) + δ (1,0,0) + ρ (0,0,0) + ρ (1,0,0) = (x 1 + 1)(x 2 + 1)(x 3 + 1) + x 1 (x 2 + 1)(x 3 + 1) + 1 + x 1 = x 1 + x 2 + x 3 + x 2 x 3 γ (1,0) = δ (0,1,0) + δ (1,1,0) + ρ (0,1,0) + ρ (1,1,0) = (x 1 + 1)x 2 (x 3 + 1) + x 1 x 2 (x 3 + 1) + x 2 + x 1 x 2 = x 1 x 2 + x 2 x 3 γ (0,1) = δ (0,0,1) + δ (1,0,1) + ρ (0,0,1) + ρ (1,0,1) = (x 1 + 1)(x 2 + 1)x 3 + x 1 (x 2 + 1)x 3 + x 3 + x 1 x 3 = x 1 x 3 + x 2 x 3 γ (1,1) = δ (0,1,1) + δ (1,1,1) + ρ (0,1,1) + ρ (1,1,1) = (x 1 + 1)x 2 x 3 + x 1 x 2 x 3 + x 2 x 3 + x 1 x 2 x 3 = x 1 x 2 x 3 .
These 4 functions can be seen to be coincident in the following table

γ (0,0) γ (1,0) γ (0,1) γ (1,1) (0, 0, 0) 0 0 0 0 (0, 1, 0) 1 0 0 0 (0, 0, 1) 1 0 0 0 (0, 1, 1) 1 1 1 0 (1, 0, 0) 1 0 0 0 (1, 1, 0) 0 1 0 0 (1, 0, 1) 0 0 1 0 (1, 1, 1) 0 0 0 1 Theorem K.4.11. For each f ∈ C n define f δ = (u 2 ,...,u n )∈GF (2) n-1 f (1, u 2 , . . . , u n ) (δ (0,u 2 ,...,u n ) + δ (1,u 2 ,...,u n ) ).
and

f ρ = (u 2 ,...,u n )∈GF (2) n-1 f (1, u 2 , . . . , u n ) (ρ (0,u 2 ,...,u n ) + ρ (1,u 2 ,...,u n ) ). then f = f δ + f ρ = (1 + I) * f δ = (1 + I) * f ρ .
Proof. By Theorem K.4.9, f = f δ + f ρ and by Theorem K.3.18,

f δ * 1 = f ρ , f ρ * 1 = f δ , therefore, f = (1 + I) * f δ = (1 + I) * f ρ .
Theorem K.4.12. A function f ∈ B n is a coincident function if and only if f = (1 + I) * g for some function g ∈ B n .

Proof. Suppose that f = (1 + I) * g. Then, using Theorem K.4.5, we get

(1 + I) * f = (1 + I) * (1 + I) * g = 0 * g = 0, so f is a coincident function.
Conversely, suppose that f is a a coincident function. Then by Theorem K.4.11, we have f = (1 + I) * g with g = f δ .

K.5 Conclusion and Future Work

In this paper, we have introduced a new notion, called Dirichlet product for boolean functions. We have intensively studied the arithmetical and the algebraic structures of the set of all boolean functions under this Dirichlet product. We have presented the affects of the Dirichlet product on a boolean function and its Möbius transform. We have applied the Dirichlet product to coincident boolean functions and exhibited new properties and characterizations of such functions.

The results presented in this paper on the new notion of Dirichlet product for boolean functions are not exhaustive. They are only the first steps toward further applications of the Dirichlet product, especially in cryptography. We leave it as future work to investigate possible applications of the Dirichlet product to find useful results to compute the algebraic degree of a boolean function and to characterize cryptographic properties such as nonlinearity, balancedness, correlation immunity and algebraic immunity.

cryptosystems.

In 1978, Rivest, Shamir, and Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] proposed RSA, the most widely used public-key cryptosystem. The public parameters in RSA are the modulus N = pq and the public exponent e satisfying gcd(e, (p-1)(q-1)) = 1 where p, q are large prime numbers of the same bit-size. The decryption exponent is the integer d such that ed ≡ 1 (mod (p -1)(q -1)).

In 1985, Koblitz [START_REF] Koblitz | Elliptic Curve Cryptosystems[END_REF] and Miller [START_REF] Miller | Uses of elliptic curves in cryptography[END_REF] independently suggested the use of elliptic curves in cryptography, mainly for the Diffie-Hellman [START_REF] Diffie | New directions in cryptography[END_REF] key exchange protocol and the El Gamal cryptosystem [START_REF] Gamal | A public key cryptosystem and signature scheme based on discrete logarithms[END_REF]. Let p > 3 be a prime number and a, b be two integers such that gcd(4a 3 + 27b 2 , p) = 1. The elliptic curve E p (a, b) over the field F p is the set of points P = (x, y) such that y 2 ≡ x 3 + ax + b (mod p) together with the point at infinity. The number of points in E p (a, b) is #E p (a, b) = p + 1 -t p where t p is an integer satisfying the Hasse bound |t p | ≤ 2 √ p. Elliptic curves can be extended over the ring Z/nZ where n is a composite integer. Such elliptic curves can serve to find small prime factors of n as in the Elliptic Curve Method (ECM) for factorization [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF].

In 1994, Demytko [START_REF] Demytko | A new elliptic curve based analogue of RSA[END_REF] developed a cryptosystem using an elliptic curve E N (a, b) over the ring Z/N Z where N = pq is an RSA modulus. In the Demytko system, the public parameters are N , a, b together with a public exponent e satisfying gcd e, p 2 -t 2 p q 2 -t 2 q = 1. The decryption exponent is an integer d satisfying ed ≡ 1 (mod lcm(p + 1 ± t p , q + 1 ± t q )) where t p = p + 1 -#E p (a, b) and t q = q + 1 -#E q (a, b).

The RSA cryptosystem is deployed in many commercial systems for providing privacy and authenticity. If RSA is deployed in a device with small computing power, it is desirable to use a small public exponent e or a small private exponent d. Unfortunately, in 1990, Wiener [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] showed that RSA is insecure if d < 1 3 N 1 4 . In 1999, Boneh and Durfee [17] improved this bound up to d < N 0.292 . Their method is based on Coppersmith's method [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] for solving modular polynomial equations and uses the RSA key equation ed -k(p -1)(q -1) = 1. Afterwards, many attacks on RSA or variants of RSA have been presented using Coppersmith's method or other techniques (see [START_REF] Hinek | Cryptanalysis of RSA and its Variants[END_REF], [START_REF] May | Using LLL-reduction for solving RSA and factorization problems: a survey[END_REF], [13]).

√ N < p < √ 2 √ N .

L.2.1 Coppersmith's method

In 1996, Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] describes a technique to find small modular roots of univariate polynomials and small integer roots of bivariate polynomials. This method has been extended to more variables and has many surprising results in cryptanalysis. A typical example is the following result [START_REF] May | New RSA Vulnerabilities Using Lattice Reduction Methods[END_REF].

Theorem L.2.2 (Coppersmith). Let N = pq be an RSA modulus with q < p < 2q. Let S be an approximation of an unknown multiple pr of p with r = q and |pr -S| < N 1 4 . Then one can factor N in polynomial time.

Let h(x, y, z) ∈ Z[x, y, z] be a polynomial with ω monomials of the form h(x, y, z) = i,j,k a i,j,k x i y j z k .

The Euclidean norm of h(x, y, z) is defined as

h(x, y, z) = i,j,k a 2 i,j,k .
Under some conditions, a modular polynomial equation can be solved over the integers as presented in the following result [START_REF] Howgrave-Graham | Finding small roots of univariate modular equations revisited[END_REF].

Theorem L.2.3 (Howgrave-Graham). Let e be a positive integer and h(x, y, z) ∈ Z[x, y, z] be a polynomial with at most ω monomials. Suppose that h (x 0 , y 0 , z 0 ) ≡ 0 (mod e m ) and h(xX, yY, zZ) < e m √ ω ,

where |x 0 | < X, |y 0 | < Y , |z 0 | < Z. Then h (x 0 , y 0 , z 0 ) = 0 holds over the integers.

To find polynomials with small coefficients that can be used in Howgrave-Graham's Theorem L.2.3, Coppersmith's method uses a lattice and a lattice reduction algorithm such as the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF]. This reduction algorithm can be applied to find a basis of lattice vectors with relatively small norms (see [START_REF] May | New RSA Vulnerabilities Using Lattice Reduction Methods[END_REF]).

Theorem L.2.4 (LLL). Let L be a lattice spanned by a basis (u 1 , . . . , u ω ), then the LLL algorithm produces a new basis

(b 1 , . . . , b ω ) satisfying b 1 ≤ . . . ≤ b i ≤ 2 ω(ω-1) 4(ω+1-i) det(L) 1 ω+1-i , i = 1, . . . , ω -1.
Under the condition of Howgrave-Graham's Theorem, some modular polynomial equations derived from the reduced basis can be transformed to polynomial equations over the integers. For multivariate modular equations, solving the system of these polynomials is heuristic and depends on some extra assumptions such as the following one.

Assumption L.2.5. Let h 1 , h 2 , h 3 ∈ Z[x, y, z] be the polynomials that are found by Coppersmith's method. Then the ideal generated by the polynomial equations h 1 (x, y, z) = 0, h 2 (x, y, z) = 0, h 3 (x, y, z) = 0 has dimension zero.

Under this assumption, a system of polynomials sharing the root can be solved by using Gröbner basis computation or resultant techniques (see [8] for more details).

L.2.2 Elliptic curves

Let N = pq be an RSA modulus and let a and b be two integers such that gcd(4a

3 + 27b 2 , N ) = 1. An elliptic curve E N (a, b) is the set of points (x, y) such that y 2 ≡ x 3 + ax + b (mod N ),
together with the point at infinity O. It is well known that chord-and-tangent method in the case of elliptic curves E p (a, b) defined over the finite filed F p still hold for E n (a, b) unless the inversion of a non-zero number Q does not exist modulo N . This case would lead to find a factor of N by computing gcd(Q, N ). When the prime factors p, q in N = pq are large, then with overwhelming probability the inversion of a non-zero number will exist modulo N .

Let p be a prime number. Under modulo p, the cardinality of E p (a, b) is denoted #E p (a, b) and satisfies the following result (see [START_REF] Silverman | The Arithmetic of Elliptic Curves[END_REF], p. 131).

Theorem L.2.6 (Hasse). The order of an elliptic curve E p (a, b) over F p is given by

#E p (a, b) = p + 1 -t p , where |t p | ≤ 2 √ p.
When the prime number p and the elliptic curve E p (a, b) are given, one can find the value of t p using computational methods such the Schoof-Elkies-Atkin algorithm (SEA) (see [START_REF] Schoof | Counting points on elliptic curves over finite fields[END_REF]

p (a, b) is #E p (a, b) = p + 1 + t p .

L.2.3 Demytko's elliptic curve cryptosystem

In 1994, Demytko [START_REF] Demytko | A new elliptic curve based analogue of RSA[END_REF] proposed a new cryptosystem defined over the field Z/N Z where N = pq is an RSA modulus such that p ≡ q ≡ 2 (mod 3). Demytko's scheme uses fixed integers a and b and a fixed modulus N . Demytko's scheme uses only the x-coordinate of a point P = (x, y) ∈ E N (a, b) to compute a multiple eP ∈ E N (a, b) (see Lemma 2 in [START_REF] Kurosawa | Low exponent attack against elliptic curve RSA, Low exponent attack against elliptic curve RSA[END_REF]). Demytko's scheme can be summarized as follows.

1. Key Generation:

• Choose two distinct prime numbers p and q of similar bit-length.

• Compute N = pq.

• Select two integers a, b < p such that gcd n, 4a 3 + 27b 2 = 1.

• Choose e such that gcd e, p 2 -t 2 p q 2 -t 2 q = 1.

• Keep p, q secret and publish N, e, a, b.

Encryption:

• Transform the message m as the x-coordinate of a point P = (m x , m y ) on the elliptic curve E N (a, b).

• Compute the ciphertext point C = eP = (c x , c y ) = e(m x , m y ) on the elliptic curve y 2 = x 3 + ax + b (mod N ).

Decryption:

• Compute u = c 3 x + ac x + b (mod N ). • Compute the Legendre symbols u p = u p and u q = u q . • If (u p , u q ) = (1, 1), then compute d ≡ e -1 (mod lcm(p + 1 -t p , q + 1 -t q )).

• If (u p , u q ) = (1, -1), then compute d ≡ e -1 (mod lcm(p + 1 -t p , q + 1 + t q )).

• If (u p , u q ) = (-1, 1), then compute d ≡ e -1 (mod lcm(p + 1 + t p , q + 1 -t q )).

• If (u p , u q ) = (-1, -1), then compute d ≡ e -1 (mod lcm(p+1+t p , q + 1 + t q )).

• Compute m as the x-coordinate of dC = deP = P = (m x , m y ) on the elliptic curve y 2 = x 3 + ax + b (mod N ).

A variant of Demytko's scheme is to consider d ≡ e -1 (mod (p + 1 ± t p , q + 1 ± t q )) instead of modulo lcm(p + 1 ± t p , q + 1 ± t q ). Then e and d satisfy an equation of the form

ed -k (p -s) (q -r) = 1, s = ∓t p -1, r = ∓t q -1.
This equation matches the RSA variant key equation that will be studied in this paper.

L.2.4 The Elliptic Curve Method

An integer m is said to be B-smooth if all the prime factors of m are less than or equal to B. Smooth numbers are used in cryptography by many factoring and discrete logarithm algorithms (see [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] and [START_REF] Lenstra | The number field sieve[END_REF]). The counting function of B-smooth numbers in an interval [1, x] is defined as

ψ(x, B) = # {m : 1 ≤ m ≤ x, m is B-smooth} .
In the particular case x = B u , Hildebrand [START_REF] Hildebrand | On the number of positive integers ≤ x and free of prime factors >[END_REF] gave the asymptotic formula ψ(x, B) = xρ(u) where ρ(u) is the Dikman rho-function defined as the solution of the differential equation uρ (u) = -ρ(u -1) for u ≥ 1 with the initial condition ρ(u) = 1 for 0 ≤ u ≤ 1. For 1 ≤ u ≤ 2, the Dikman function satisfies ρ(u) = 1 -log u so that ψ(x, B) = x(1 -log u). The Elliptic Curve method (ECM) is a probabilistic method for integer factorization and was discovered by H.W. Lenstra [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] in 1987. It is a fast partially factoring algorithm, especially for finding small prime factors p, in a heuristic running time O exp c(log p) 1/2 log log p) 1/2 , for some constant c > 0. The ECM algorithm is based on the property of the Chinese Remainder Theorem, that is, for any elliptic curve

E(a, b), if n = p e 1 1 p e 2 2 • • • p e k k , then E (Z/nZ) = E (Z/p e 1 1 Z) × E (Z/p e 2 2 Z) × • • • × E (Z/p e k k Z) .
Suppose that the order of E (Z/p e 1 1 Z) is B-smooth and let m be a multiple of |E (Z/p e 1 1 Z)|, typically m = lcm(2, . . . , B). Then, for every P ∈ E (Z/nZ), we have mP = (0 : 1 : 0) (mod p 1 ). Consequently, computing mP where P ∈ E (Z/nZ), using the addition formulas on E (Z/nZ), we must get mP = (x : y : z) = (0 : 1 : 0) (mod p 1 ). This implies that z ≡ 0 (mod p 1 ) and that gcd(z, n) = p r 1 for some positive integer r which will reveal p 1 .

of the matrix, the determinant of L is in the form det(L) = e n e X n X Y n Y Z n Z . For m = 2 and t = 1, the coefficient matrix for L is presented in Table L.1. The non-zero elements are marked with an ' '. To find the values of the exponents, define S(x) to be

S(x) = m k=0 m i 1 =k k i 2 =k m-i 1 i 3 =m-i 1 x + m k=0 k i 1 =k i 1 +t i 2 =k+1 m-i 1 i 3 =m-i 1 x.
Using the construction of the polynomials G and H, we get

n e = S(m -k) = 1 6 m(m + 1)(2m + 3t + 4), n X = S(i 1 ) = 1 6 m(m + 1)(2m + 3t + 4), n Y = S(i 2 ) = 1 6 (m + 1) m 2 + 3mt + 3t 2 + 2m + 3t , n Z = S(i 3 ) = 1 6 m(m + 1)(m + 3t + 2), ω = S(1) = 1 2 (m + 1)(m + 2t + 2). (L.1)
Let t = τ m for some positive τ to be optimized later. The dominant terms of the exponents in (L.1) are

n e ≈ 1 6 (3τ + 2)m 3 + o(m 3 ), n X ≈ 1 6 (3τ + 2)m 3 + o(m 3 ), n Y ≈ 1 6 3τ 2 + 3τ + 1 m 3 + o(m 3 ), n Z ≈ 1 6 (3τ + 1)m 3 + o(m 3 ), w ≈ 1 6 (6τ + 3)m 2 + o(m 2 ). (L.2)
Applying the LLL algorithm L.2.4 to the lattice L, we get a reduced basis where the three first vectors h i , i = 1, 2, 3 satisfy

h 1 ≤ h 2 ≤ h 3 ≤ 2 ω(ω-1) 4(ω-2) det(L) 1 ω-2 .
To apply Howgrave-Graham's Theorem L.2.3 to h 1 , h 2 and h 3 , we set 2 ω(ω-1)

4(ω-2) det(L) 1 ω-2 < e m √ ω . Remark L.3.2. If r = s = w = 1, then the equation eu -(p -s)(q -r)v = w
is the classical RSA key equation ed -(p -1)(q -1)k = 1 with d < N δ . Using α = 0, β = 1 and γ = 0, the bound of Theorem L.3.1 gives δ < 7 6 -√

3 . This retrieves the classical bound on the private exponent d (see [17]).

Theorem L.3.3. Let N = pq be an RSA modulus and e = N β be a public exponent. Suppose that e satisfies the equation eu -(p -s)(q -r)v = w with |r|, |s| < N α < N 1 4 , u < N δ and |w| < N γ . Let B be an ECM-efficiency bound for the Elliptic Curve Method. If (p -s) or (q -r) is B-smooth and

δ < 7 6 + 1 3 α -γ - 1 3 (2α + 1)(2α + 6β -6γ + 1),
then one can find p and q in polynomial time.

Proof. Suppose that, in the equation eu

-(p -s)(q -r)v = w, the parameters satisfy |r|, |s| < N α < N 1
4 , e = N β , u < N δ , |w| < N γ and that the exponent parameters satisfy δ < 7 6 + 1 3 α -γ -1 3 (2α + 1)(2α + 6β -6γ + 1). Then, by applying Theorem L.3.1, we can find the exact value of (p -s)(q -r). Next, suppose that (p -s) is B-smooth where B is a bound for the efficiency of the Elliptic Curve Method (ECM). Hence, ECM will reveal a partial factorization of (p -s)(q -r) as

(p -s)(q -r) = M • ω((p-s)(q-r)) i=1 p e i i ,
were ω(p -s) is the number of distinct prime factors of p -s and M is such that M = 1 or all prime factors of M are greater than B. The average order of the number of prime factors of an integer n is ω(n) ≈ log n log log n (see [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF], pp. 355). Since |r|, |s| < N α and √

N < p < √ 2N , then √ N -N α < p -s < √ 2N + N α . (L.4)
Hence, the average number of the prime factors of p -s satisfies

ω(p -s) ≈ log(p -s) log log(p -s) ≈ log N 2 log log N .
On the other hand, according to the factorization

(p -s) = ω((p-s)) i=1 p e i i ,
the number of distinct divisors of p -s is exactly ω(p-s) i=1

(e i + 1). However, the average number of divisors of an integer n is log n (see Theorem 319 of [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]). Hence, the average number of divisors of p -s is approximately log(p -s) ≈ 1 2 log N . Let d be a divisor of (p -s)(q -r) such that d = p -s. Then

d = ω(p-s) i=1 p x i i , 0 ≤ x i ≤ e i .
Using (L.4), we get log

√ N -N α < ω(p-s) i=1 x i log p i < log √ 2N + N α .
The former inequalities can be solved by applying linear programming algorithms such as PSLQ [START_REF] Ferguson | A polynomial time, numerically stable integer relation algorithm[END_REF] and LLL [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF], and using a solution (x 1 , . . . , x ω(p-s) ), we compute d = ω(p-s) i=1 p x i i which is then a candidate for p -s. Since |s| < N α < N 1 4 , then d is an approximation of the prime factor p of N with an error term less than N 1 4 . Hence, using Theorem L.2.2, this leads to the exact value of p if d is the good candidate. Repeating this process sequentially for the factors d of (p -s)(q -r) in the range √ N -N α < d < √ 2N + N α , we will find p and then get q = N p . This achieves the factorization of the RSA modulus.

L.3.2 A numerical example

Consider the following RSA 265 bit-size modulus N with the public exponent e, N =431152655066872264361967287569597072664021583942612947594581

39340520129183826747, e =442910968337832163537316435435954401939549665933793683113289 7706681971178351139.

L.4.1 The attack on Demytko's Scheme

In Demytko's scheme, the RSA modulus is N = pq and the elliptic curve E N (a, b) is such that #E p (a, b) = p + 1 -t p and #E q (a, b) = q + 1 -t q where, according to Hasse Theorem, |t p | < 2 √ p and |t q | < 2 √ q. Also, the public exponent e and the private exponent d satisfy one of the four equations

eu -(p + 1 ± t p )(q + 1 ± t q )v = w.
These equations can be transformed into one of the form eu-(p-s)(q-r)v = w where s = ∓t p -1 and t = ∓t q -1, which can be studied using the technique of Theorem L. 4 , u < N δ and |w| < N γ . Let B be an ECM-efficiency bound for the Elliptic Curve Method. If p + 1 ± t p or q + 1 ± t q is B-smooth and

(p + 1 ± t p )(q + 1 ± t q )v = w with | ± t p -1|, | ± t q -1| < N α < N 1
δ < 7 6 + 1 3 α -γ - 1 3 (2α + 1)(2α + 6β -6γ + 1),
then one can find p and q in polynomial time.

Proof. Since the equation eu-(p+1±t p )(q +1±t q )v = w can be transformed into eu -(p -s)(q -r)v = w with s = ∓t p -1 and t = ∓t q -1, then this equation can be solved under the conditions of Theorem L. with the elliptic curve E N (a, b) with equation y 2 ≡ x 3 + 9 (mod N ). We suppose that e satisfies the equation eu -(p + 1 ± t p )(q + 1 ± t q )v = w with t p , t q < N α = N 0.1 . Then applying the method of Theorem L.3.1 to solve the equation eu -(p -s)(q -r)v = w where s = ∓t p -1 and r = ∓t p -1, we get for e

= N β ≈ N , u < N δ = N 0.1 , |w| < N γ = N 0.1 v =6889077569105, w =2916646, pr + qs -rs =7843579993396182200943116363500139031658267071337633, 244222164466922717093026565590439040792, Then N -(pr + qs -rs) = (p -s)(q -r) = 244564152049718837289391032953867582433145492152016 3900426562385790838533501393481306799929916082238016 192469362991030638071771761892645334186224971050825.
Applying the Elliptic Curve Method for factorization with the bound B = 2 80 ≈ N 0.16 , we get the factorization

(p -s)(q -r) =3 6 • 5 2 • 7 2 • 13 3 • 43 2 • 103 2 • 277 • 674 2 • 1021 • 4177 • 15061 • 21737 2 • 27109 2 • 52291 2 • 84991 • 90841 • 132661 • 347329 2 • 3834631 • 29327821 • 69689551 • 30404961633073956301 • 305196537135675591605491.
Any divisor d of (p -s)(q -r) is a candidate for p -s or q -r. Using the divisor

d =3 3 • 13 2 • 277 • 1021 • 15061 • 21737 2 • 27109 2 • 52291 2 • 90841 • 305196537135675591605491,
as a candidate for p -s in Coppersmith's Theorem L.2.2, we get p and then q = N p as follows p =6859204255983061432517785834149052664712382794585028575 9827931818992553395171, q =3565488691146548938655947873912559573169857298248409258 0287175860557076482027, which completes the factorization of N .

L.5 Conclusion

In this paper, we consider an instance of RSA where the public exponent satisfies a generalized key equation with many unknown parameters. Under suitable conditions, we combine Coppersmith's method and the Elliptic Curve Method for factorization ECM, we solve the equation and find the prime factors of the RSA modulus. We apply the same technique to launch an attack on Demytko's Elliptic Curve Cryptosystem when the secret parameters are suitably small.

M.1 Introduction

In the last ten years, cloud computing has gained major importance and widespread. Yet, a very important concern of cloud computing remains the security and privacy of data. A useful solution to this concern is the use of fully homomorphic encryption (FHE) to encrypt data stored remotely. Indeed, a fully homomorphic encryption scheme supports the computation of arbitrary functions on encrypted data, possibly distributed across the cloud, without the need to resort to decryption. Unfortunately, not all encryption schemes are fully homomorphic. For example, RSA [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF]

= g m 1 r N 1 (mod N 2 ) and c 2 = g m 2 r N 2 (mod N 2 ), one can perform c 1 c 2 = g m 1 +m 2 (r 1 r 2 ) N (mod N 2
), which gives m 1 + m 2 without having to resort to the decryption of the ciphertexts c 1 and c 2 . Another example of an additively homomorphic scheme is the Goldwasser-Micali scheme [START_REF] Goldwasser | Probabilistic Encryption[END_REF].

In 2009, Gentry [START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF], presented the first construction of a FHE scheme. Gentry's scheme supports both addition and multiplication on ciphertexts and consists of three main steps. The first step constructs a somewhat homomorphic scheme, which is limited to evaluating low-degree polynomials over encrypted data. The second step slightly modifies the somewhat homomorphic scheme to make it bootstrappable, i.e., capable of evaluating its own decryption circuit (operations). The third step transforms the bootstrappable somewhat homomorphic encryption scheme into a fully homomorphic encryption through a recursive self-embedding. The security of Gentry's scheme has been determined to be based on the worst-case hardness of solving specific problems in an ideal lattice, namely the shortest independent vector problem (SIVP) over ideal lattices in the worst-case (see [START_REF] Gentry | Toward basing fully homomorphic encryption on worst-case hardness[END_REF]).

A key disadvantage of Gentry's scheme, however, is its computational inefficiency. Therefore, much effort has been made by the research community to find alternative efficient FHE schemes. In 2010, van Dijk, Gentry, Halevi and Vaikuntanathan [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF] presented DGHV, a computationally efficient FHE scheme over the integers. This scheme is based on a set of public integers, c i = pq i + r i , i = 1, . . . , m, where the parameters p, q i and r i are secrets with the following size constraints:

• p is a prime number.

• η is the bit-length of the secret key p.

• ρ is the bit-length of the secret noises r i .

• γ is the bit-length of the public integers c i .

In [START_REF] Coron | Fully homomorphic encryption over the integers with shorter public keys[END_REF][START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF][START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF], the security of DGHV has been studied against several attacks, which served the purpose of improving its security by defining optimal bounds for its parameter bit size (η, ρ, and γ). As reported in [START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF], these attacks can be categorized according to their underling techniques:

• Brute force search [START_REF] Chen | Faster algorithms for approximate common divisors: Breaking fully-homomorphic-encryption challenges over the integers[END_REF][START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF]: When c 1 = pq 1 , this technique consists in removing the noise, say r 2 from c 2 by trying all possibilities for r 2 ∈ (-2 ρ , 2 ρ ) and computing gcd(c 1 , c 2 -r 2 ) which gives p with overwhelming probability.

• Continued fractions [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF][START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF]: This consists on recovering q i /q j from c i /c j using continued fractions, which yields immediate calculation of p = c i /q i .

• Attacks on the Approximate-GCD assumption [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF][START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF]: The recovery of p through the recovery of r i or q i , i = 1, . . . , m, using a combination of lattice reduction and other techniques. These attacks include Coppersmith's technique [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF], the method for solving simultaneous diophantine equations [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] and the orthogonal lattice attacks [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF][START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF] (See Section M.3 for more on these attacks).

Yet, a more direct way to break the DGHV scheme when r 1 = 0 consists in finding p and q 1 by factoring c 1 = pq 1 . To date, the most efficient known methods to factor c 1 are the Number Field Sieve (NFS) [START_REF] Lenstra | The number field sieve[END_REF] and the Elliptic Curve Method (ECM) [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF]. As shown in [START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF] (p. 82, Table 7.1), the DGHV factorization problem of c 1 is considered as untractable if p > 2 261 and c 1 > 2 2911 .

M.1.1 Our Contribution

In this paper, we propose two new attacks on the DGHV scheme. The starting point of both attacks are the existance of two linear equations involving the public integers c i for i = 2, . . . , m and the secret parameter q 1 on the one hand, and the secret parameters q i , i = 1, . . . , m on the other.

In the first attack, we suppose that c 1 = pq 1 and that c i = pq i + r i with r i = 0 for i = 2, . . . , m. To avoid factoring attacks on c 1 , we also suppose that q 1 is prime. If q 1 is not coprime with one of the integers c i for 2 ≤ i ≤ m, then gcd(c 1 , c i ) = q 1 which will reveal p = c 1 q 1 . Hence, q 1 is coprime c i for i = 2, . . . , m. Therefore for any integers a 2 , . . . , a m-1 , the integer a m ≡ -(a 2 c 2 + . . . + a m-1 c m-1 )(c m ) -1 (mod q 1 )) exists and satisfies the linear integer relation a 2 c 2 + . . . + a m c m = a 1 q 1 for an integer a 1 . We will leverage this relationship and show that one can find the DGHV parameters p, q i and r i in polynomial time if the coefficients a i , i = 1, • • • , m are suitably small. The attack uses Coppersmith's method for solving multivariate linear modular equations, as presented by Herrmann and May in [START_REF] Herrmann | Solving linear equations modulo divisors: On factoring given any bits[END_REF].

In the second attack, we suppose that c i = pq i + r i for i = 1, . . . , m. Let G = gcd(q 1 , . . . , q m ). Then q m-1

G is coprime with one q i G , i = m -1. Assume that q m-1

G is coprime with q m G . Let a 1 , . . . , a m-2 be arbitrary integers. Define

a m-1 ≡ -a 1 q 1 G + . . . + a m-2 q m-2 G q m-1 G -1
(mod q m G ).

Then there exists an integer a m such that

a 1 q 1 G + . . . + a m-2 q m-2 G + a m-1 q m-1 G + a m q m G = 0,
or equivalently a 1 q 1 + . . . + a m q m = 0. This shows that the integers q 1 , . . . , q m are linked by infinitely many linear integer relations. We exploit this relation, and show that if the coefficients a i , i = 1, . . . , m are sufficiently small, then one can efficiently find all the DGHV parameters. Unlike the first attack, this attack is based solely on lattice reduction techniques, namely the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF].

For both attacks, we carry out experiments to verify the validity and the effectiveness of our methods. We also define the new bounds for DGVH secret parameters that resist our attacks, effectively improving on previously proposed optimal bounds [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF], [START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF].

M.1.2 Organization

The rest of this paper is organized as follows: In Section 2, we briefly review the preliminaries necessary for both our attacks. Section 3 is dedicated to leading attacks on the DGHV scheme. In Section 4, we present our first lattice-based attack on DGHV, that is when r 1 = 0 and the numbers c i satisfy a linear equation a 2 c 2 +. . .+a m c m = a 1 q 1 for suitably small integers a i , i = 2, . . . , m. In section 5, we present our second lattice-based attack, which is applicable when the integers q i satisfy a linear equation a 1 q 1 +. . .+a m q m = 0 for suitably small integers a i . We then conclude the paper in Section 6.

M.2 Preliminaries

In this section, we review the DGHV scheme parameters and the Approximate-GCD assumption upon which its security is based. We also recall Coppersmith's method for solving linear diophantine equations, and review the lattice reduction technique used in our new attacks on the DGHV scheme.

M.2.1 The DGHV Scheme over the Integers

In 2010, van Dijk, Gentry, Halevi and Vaikuntanathan [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF] proposed a fully homomorphic encryption scheme based on m public integers c i = pq i + r i where the secret parameters p, q i , r i are such that:

• For i = 1, . . . , m, c i is a public integer of bit-length γ.

• p is a private prime number of bit-length η.

• For i = 1, . . . , m, q i is a private integer of bit-length γ -η.

• For i = 1, . . . , m, r i is a private random integer with |r i | < 2 ρ .

In [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF], it is shown that the scheme is semantically secure under the Approximate-GCD assumption which states the following: Definition M.2.1 (Approximate-GCD assumption). Let γ, η, ρ be positive integers. For any η-bit prime number p, given m many positive integers c i = pq i + r i with m many (γ -η)-bit integers q i and m many integers r i satisfying |r i | < 2 ρ , it is hard to find p.

The hardness of the Approximate-GCD assumption has been studied by Howgrave-Graham [START_REF] Howgrave-Graham | Finding small roots of univariate modular equations revisited[END_REF], and used in the study of the security of the DHGV scheme in [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF] and [START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF], leading to the establishment of typical integer sizes that guarantee high security levels of DHGV. Therein, the values ρ ≈ √ η, γ = η 3 + η are considered secure (see [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF]).

M.2.2 Lattice reduction

Here we present some basics on lattice reduction techniques. Let Of interest to many applications and algorithms is the shortest non-zero vector in a lattice. Finding the shortest non-zero vector is a computationally hard problem known as the Shortest Vector Problem (SVP) that guarantees the security of many cryptographic schemes. However, Minkowski's theorem, which dates back to 1889, guarantees the existence of short vectors, i.e., non-zero vectors whose length is not too large as in the following theorem.

Theorem M.2.2 (Minkowski). Let L be a lattice. Then there exists a nonzero vector v ∈ L such that v ≤ dim(L) det(L)

1 dim(L) .
Given a lattice L and its original basis b 1 . . . , b d , lattice reduction consists in finding another basis, where a short non-zero vector is easily determined. This can be achieved through different algorithms, whose running time is usually at least exponential in the dimension of the lattice d. However, the LLL algorithm of Lenstra, Lenstra, and Lovász [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] can find, in polynomial time, short non-zero vectors in a lattice with reasonable dimension. Thus, finding a reduced basis using LLL leads to finding reasonably short vectors in polynomial time.

M.2.3 Coppersmith's method for solving linear diophantine equations

The LLL algorithm has many applications in cryptography, including solving diophantine equations. Using the LLL algorithm, Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] derived a method for finding small roots of univariate modular equations and bivariate equations. This strategy is know as Coppersmith's technique and has been heuristically generalized for finding small roots of multivariate linear equations. The following result by Herrmann and May [START_REF] Herrmann | Solving linear equations modulo divisors: On factoring given any bits[END_REF] gives a sufficient condition under which small roots of a modular linear equation can be found in polynomial time.

Theorem M.2.4 (Herrmann-May). Let N be a composite integer of unknown factorization with a divisor p ≥ N β . Let f (x 1 , . . . , x n ) ∈ Z[x 1 , . . . , x n ] be a linear polynomial in n variables. One can find in polynomial time all solutions x

M.3 Former attacks on the DGHV Scheme

We recall here the main existing attacks on the DGHV scheme. For more details, we refer to [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF] and [START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF]. Assume that we have an instance of DGHV with c 1 = pq 1 and c i = pq i + r i , i = 2, . . . , m where the parameters p, q i and r i are secret. The task is to recover p. We recall that p is a η-bit prime and 0 < r i < 2 ρ .

M.3.1 Brute force on the remainder

A simple way to recover p is to remove the noise, say from c 2 , by finding r 2 , and then compute p = gcd(c 1 , c 2 -r 2 ). This can be achieved by trying all integers r 2 with 0 < |r 2 | < 2 ρ . The complexity of this attack is obviously O (2 ρ ). However, applying the method of Chen and Nguyen [START_REF] Chen | Faster algorithms for approximate common divisors: Breaking fully-homomorphic-encryption challenges over the integers[END_REF], one can find p with complexity O 2 ρ/2 . As a consequence, removing the noise to recover p does not work in practice when ρ is sufficiently large.

M.3.2 Continued fractions

Using c 1 = pq 1 and c 2 = pq 2 + r 2 , and given that q 1 and q 2 are prime numbers, one gets c 2 c 1 -q 2 q 1 = |r 2 | c 1 .

To recover q 2 q 1 as a convergent of the continued fraction expansion of c 2 c 1 , we need

|r 2 | c 1 < 1 2q 2 1
, that is 2q 1 |r 2 | < p. This is not possible if q 1 is much larger than p as for the recommended values for the DGHV parameters where q 1 is η 3 -bit size while p is η-bit size.

M.3.3 Simultaneous Diophantine approximation

In [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF], it is shown that the LLL algorithm can find a solution for the simultaneous diophantine approximations. That is, given n rational numbers α 1 , • • • , α n and ε with 0 < ε < 1, one can efficiently find integers p 1 , . . . , p n , and q such that, for i = 1, . . . , n, |qα i -p i | ≤ ε, and 1 ≤ q ≤ 2 n(n+1) 4

ε -n .

This can be applied to the DHGV scheme. Using c 1 = pq 1 and c i = pq i + r i , we get for i = 2, . . . , m

q 1 c i c 1 -q i = |r i | p < 2 ρ-η .
This gives m -1 simultaneous diophantine approximations which can be solved by applying the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] to reduce a basis of a lattice of dimension m. The LLL algorithm will succeed under the condition:

q 1 ≤ 2 (m-1)m 4
• 2 -(ρ-η)(m-1) = 2

(m-1)m 4

+(η-ρ)(m-1) .

Since q 1 ≈ 2 γ-η , then γ -η ≤ m(m-1)

4

+ (η -ρ)(m -1), which can be achieved if m > -2η + 2ρ + 1 2 + 1 2 16η 2 -32ηρ + 16ρ 2 + 16γ -8η -8ρ + 1.

For secure DHGV parameters, such as γ = η 3 + η, ρ ≈ √ η with a sufficiently large η, this gives a large lower bound for m, and in this case lattice reduction will not recover the shortest vector. For example, for η = 200 we get m > 5297, which makes the lattice reduction totally inefficient according to the optimal complexity bound O m 4 log BM(m log(B)) where B is an upper bound of the Euclidean norms of the basis vectors and M(k) denotes the time required to multiply k-bit integers (see [START_REF] Nguyen | An LLL algorithm with quadratic complexity[END_REF]).

M.3.4 Orthogonal lattice attack

Another attack on DGHV is the orthogonal lattice attack [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF][START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF]. Let c 1 = pq 1 and c i = pq i + r i , for i = 2, . . . , m. Then there exist m -1 integers a i , i = 2, . . . , m such that a 2 c 2 + . . . + a m c m ≡ 0 (mod c 1 ). This can be rewritten as p(a 2 q 2 + . . . + a m q m ) + a 2 r 2 + . . . + a m r m ≡ 0 (mod pq 1 ).

M.4 Our First Lattice-based Attack on DGHV

In this section, we present our first attack on the DGHV scheme. We exploit the existence of a linear relation between the c 2 , . . . , c m and the factor q 1 of c 1 in the form a 2 c 2 + . . . + a m c m = a 1 q 1 , where a 1 , . . . , a m are integers (see section M.1.1). We derive a condition on the size of each |a i | under which the above equation can be solved leading to the cryptanalysis of the scheme. After presenting the attack, we will present a comparison with the orthogonal lattice attack [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF], and show that our attack significantly increases the bound of the parameters a i leading to more successful attacks. then, one can find p, q 1 , . . . , q m , r 2 , . . . , r m in polynomial time.

Proof. Suppose that c 1 = pq 1 and c i = pq i +r i for i = 2, . . . , m. Let a 1 , . . . , a m be m integers satisfying a 2 c 2 + . . . + a m c m = a 1 q 1 . Then a 2 c 2 + . . . + a m c m ≡ 0 (mod q 1 ), (M.1)

where q 1 is an unknown divisor of c 1 . Suppose that 2 η-1 < p < 2 η and 2 γ-1 < c 1 < 2 γ . Then, since q 1 = c 1 p , we get 2 γ-η-1 < q 1 < 2 γ-η+1 .

Define β = γ-η-1 γ . Then For i = 2, . . . , m, define α i = (γ -1)λ i . Then c λ i 1 > 2 (γ-1)λ i = 2 α i . Now, suppose that |a i | < 2 α i for i = 2, . . . , m. Then |a i | < c λ i 1 and plugging α i = (γ -1)λ i in equation (M.2), one can find the parameters a i , i = 2, . . . , m if

m i=2 α i < 1 -(1 -β) m m-1 -m 1 -m-1 1 -β (1 -β) (γ -1).
Using the recovered values of the parameters a i for i = 2, . . . , m, we compute q 1 = gcd(c 1 , a 2 c 2 + . . . + a m c m ), p = c 1 q 1 .

Next, for i = 2, . . . , m, we find r i ≡ c i (mod p) and q i = c i -r i p .

Let us summarize the whole method in Algorithm 7. Set q 1 = g and p = c 1 q 1 .

7:

for i = 2, . . . , m do 8:

Compute r i ≡ c i (mod p).

9:

Compute q i = c i -r i p .

10:

end for 11:

Output p, q i , i = 1, . . . , m, r i , i = 2, . . . , m.

12:

Halt 13:

end if 14: end for

M.4.2 Comparison with the orthogonal lattice attack

Let us now compare our method with the orthogonal lattice attack of [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF]. Suppose that c 1 = pq 1 and c i = pq i + r i for i = 2, . . . , m. Let a 2 , . . . , a m be m -1 integers satisfying a 2 c 2 + . . . + a m c m ≡ 0 (mod c 1 ) and |a i | < 2 α as required in the orthogonal attack. Then, since c 1 = pq 1 , we get a 2 c 2 + . . . + a m c m ≡ 0 (mod q 1 ) which means that the equation can be exploited in our attack. Using Theorem M.4.1, our attack can recover all the parameters p, q 1 , q i , r i for i = 2, . . . , m if

α < 1 m -1 1 -(1 -β) m m-1 -m 1 -m-1 1 -β (1 -β) (γ -1), (M.3)
where β = γ-η-1 γ . Recall that the orthogonal attack of [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF], as explained in Section M.3.4, will find p if 1) , for i = 2, . . . , m. So, define the bound for the orthogonal lattice attack of [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF] α 0 = η -1 -ρ -log 2 (m -1), and the bound for our attack

|a i | ≤ 2 η-1-ρ m -1 = 2 η-1-ρ-log 2 (m-
α new = 1 m -1 1 -(1 -β) m m-1 -m 1 -m-1 1 -β (1 -β) (γ -1).
Let us compare α 0 and α new in the optimal situation where η ≥ 200, γ = η 3 +η and ρ ≈ √ η as recommended by [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF]. These parameter sizes are believed to resist currently known attacks including factorization, diophantine and lattice-based attacks. In Table M

M.4.3 Deriving new parameter sizes

To avoid the new attack, it is sufficient to make the inequality (M.3) impossible or hard to occur. Since γ is large, this could be possible if

1 -(1 -β) m m-1 -m 1 -m-1 1 -β (1 -β) ≈ 0,
where β = γ-η-1 γ . Therefore, for m > 1, our attack will fail if β ≈ 0, or equivalently γ ≈ η. However, our attack is likely to be successful when β ≈ 1 and the number m of public integers c i , i = 1, . . . , m is not very large. In this situation, the inequality (M.3) reduces to α < γ-1 m-1 . Note that β ≈ 1 implies that γ is much larger than η which is the case for the currently recommended parameters. Therefore, for the recommended parameters γ = η 3 + η with large η, our attack will be successful as long as α < γ-1 m-1 .

M.4.4 Experimental Results

We implemented our attack and experimented it with 100 instances of DGHV. All the 100 attacks were successful. For efficiency reasons, we considered only instances of DGHV where the sizes of the parameters are small, typically η ≤ 60 and γ ≤ 200. The recommended DHGV parameters η ≥ 200 and γ = η 3 + η i.e., γ ≥ 8000200 are not suitable for experimentation using an off-the-shelf computer.

The following example is presented as a concrete illustration of our attack.

Consider the following situation with m = 4 public integers: where, for i = 2, 3, 4, c i < 2 γ with γ = 177. According to Theorem M.4.1, we can solve the linear equation a 2 c 2 + a 3 c 3 + a 4 c 4 = a 1 q 1 if the unknown parameters a 2 , a 3 and a 3 are suitably small. Combining the method of Herrmann and May [START_REF] Herrmann | Solving linear equations modulo divisors: On factoring given any bits[END_REF] for solving the equation a 2 c 2 + a 3 c 3 + a 4 c 4 ≡ 0 (mod q 1 ), and the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF], we get at least two polynomials sharing the solutions a 2 , a 3 , a 4 . Then applying Gröbner Basis computation for solving systems of polynomial equations, we get the solution Therefore, for our target vector v to be among the short vectors, the inequality σ(L ) > v must be satisfied. For this, it is sufficient that ρ satisfies √ m + 1 • C So, under condition M.10, applying lattice reduction to L recovers a short non zero vector v = (r 1 , . . . , r m , 0) which yields the r i 's. Next, using r 1 and r 2 , we get p = gcd(c 1 -r 1 , c 2 -r 2 ) and for i = 1, . . . , m, we get q i = c i -r i p . This terminates the proof.

We can summarize the whole method in Algorithm 8.

M.5.2 Application with the DGHV recommended parameters

Let us consider the recommended optimal parameters for a secure DGHV, as stated in [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF], that is γ = η 3 + η, ρ ≈ √ η and η ≥ 200. Then, the condition of Theorem M.5.1 becomes Compute a m = R-(c 1 a 1 +...+c m-1 a m-1 ) cm .

α < η 3 + η m + log 2 √ m m + 1 - √ η.

5:

Compute α = max i (log 2 (|a i |)).

6:

Compute ρ = 1 m log 2 (c m ) + log 2 √ m m+1 -α.

7:

Let C be the integral part of m m-1 2

• (m + 1) -m+1 2

• 2 mρ-α + 1. Apply the LLL algorithm to reduce the basis matrix. Compute q i = c i -r i p .

16:

end for Output p, q i , i = 1, . . . , m, r i , i = 1, . . . , m. Applying the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] for reduction, yields a reduced basis, where the first vector is (3991298341123,3713241313153,18196712614595893). From this, we deduce In this example, we have p < 2 η with η = 30. We notice that the dimensions of the underlying lattices are small and that the computation took less than 30 seconds using an off-the-shelf computer. Also, we notice that the condition of Theorem M.5.1 is satisfied since

α + ρ ≈ 1 m log 2 (c m ) + log 2 √ m m + 1 ≈ 58.
More importantly, this example shows that while our second attack was successful, the existing attacks of [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF], as described in Section M.3, fail to recover the parameter p: the continued fraction attack fails because we need

|r 2 | c 1 < 1 2q 2 1
, which is not the case in this example, the simultaneous diophantine approximation attack fails too, because the condition on m should be m > -2η + 2ρ + 1 2 + 1 2 16η 2 -32ηρ + 16ρ 2 + 16γ -8η -8ρ + 1 > 9, while m = 3 in this example. Finally, the orthogonal attack can not work since none of the r i = 0.

M.6 Conclusion

In this paper, we presented two new lattice-based attacks on the DHGV encryption scheme using Coppersmith's technique and the LLL algorithm for the first attack, and only the LLL algorithm for the second attack. The first attack is applicable when c 1 = pq 1 and the m -1 public integers c i , i = 2, . . . , m satisfy a linear equation a 2 c 2 + . . . + a m c m = a 1 q 1 for suitably small integers a i , i = 2, . . . , m. The second attack works even with c 1 = pq 1 + r 1 when the integers q i satisfy a linear equation a 1 q 1 +. . .+a m q m = 0 for suitably small integers a i , i = 1, . . . , m. We illustrated our attacks by providing experimental results and examples, and further computed the bounds for DGHV recommended parameters for which our attacks are applicable, thus effectively extending on previously proposed optimal parameter bounds for p, c i and r i , i = 1, . . . , m.

Definition 2 . 2 . 1 (

 221 Continued Fraction Expansion). A continued fraction is an expression of the form 0 , a 1 , . . . , a m , . . .],

Definition 2 . 3 . 1 (

 231 Lattice). Let n ≤ m be two positive integers and b 1 , • • • , b n ∈ R m be n linearly independent vectors. A lattice L spanned by {b 1 , • • • , b n } is the set of all integer linear combinations of b 1 , • • • , b n , that is

i 1 2 .

 2 Given a basis b 1 . . . , b n of the lattice L, the Gram-Schmidt process gives an orthogonal set b * 1 . . . , b * n . The determinant of the lattice is then det(L) = n i=1 b * i . The Gram-Schmidt procedure starts with b * 1 = b 1 , and then fori ≥ 2, i ≥ 2, b * i = b ij b * j , where µ i,j = b i , b * j b * j , b * j for 1 ≤ j < i.

Definition 2 . 3 . 2 (

 232 LLL Reduction). Let B = b 1 , . . . , b n be a basis for a lattice L and let B * = b * 1 , . . . , b * n be the associated Gram-Schmidt orthogonal basis. Let µ i,j = b i , b * j b * j , b * j for 1 ≤ j < i.

Theorem 2 . 3 . 3 .

 233 Let L be a lattice of dimension n. Let B = b 1 , . . . , b n be an LLL reduced basis and let B * = {b * 1 , . . . , b * n } be the associated Gram-Schmidt orthogonal basis. Then b 1 ≤ b 2 ≤ . . . ≤ b i ≤ 2 n(n-i)

1 4

 1 3 : |ap -bq| is large, i.e. |ap -bq| > aN

b ≤ 10 52 .

 52 Let e be a public exponent satisfying an equation eX -

Lemma 3 . 1 . 2 .

 312 Let p > 3 be a prime satisfying p ≡ 2 (mod 3) and 0 < b < p. Then #E p (0, b) = p + 1.

Theorem 5 . 4 . 1 (

 541 [START_REF] Nitaj | Lattice Attacks on the Homomorphic DGHV Scheme[END_REF], Theorem 5.1.). Let c i = pq i + r i , i = 1, . . . , m, be m positive integers with c 1 < . . . < c m and |r i | < 2 ρ for i = 1, . . . , m. Let a 1 , . . . , a m be m integers satisfying |a i | < 2 α for i = 1, . . . , m and a 1 q 1

1 4 .

 4 If p -

1 4 . 1 2

 41 Combining this with Lemma A.3.1, we obtain N

1 4 1 4 4 . 1 2

 1141 , medium, i.e. (abN ) < |ap -bq| < aN 1 4 , and large, i.e. |ap -bq| > aN 1 This corresponds approximately to b > 2 First we present a result based on continued fractions. Lemma B.4.1. Let N = pq be an RSA modulus with q < p < 2q. Let a, b be coprime positive integers such that ap + bq = N +α with α < 1 2

1 2

 1 +α X. Hence by Lemma B.4.1, Y X is one of the convergents of e N . Set M = N -eX Y . Starting with the equation eX -(N -(ap + bq))Y = Z, we get

1 4

 1 and b ≤ 10 52 . Let e be a public exponent satisfying an equation eX -

1 2 1 2 1 4 5 ) 4 . 4 ,

 111544 +α X. It follows, by Lemma B.4.1, that Y X is among the convergents of e N . Next, set M = N -eX Y . Using the equation eX -(N -(ap + bq))Y = Z, we get |ap + bq -M | = |Z| Y -α . Hence, by Lemma B.3.3, we find ab = M 2 4N and by Lemma B.3.2, we know that a and b are of equal bit-size. Hence, applying the Elliptic Curve Method with M 2 4N , we can efficiently find a and b assuming b ≤ 10 52 . From |ap + bq -M | < aN On the other hand, by assumption, |ap -bq| < aN 1 Then p -bq a < N 1 and combining with (B.5), we get

  then

5 :

 5 Apply ECM to find a and b such that N 0 = ab and a ≤ b ≤ 2a.

6 :

 6 Apply Coppersmith's algorithm (Theorem B.2.3) with n = N and M 2a as an approximation of y. If Coppersmith's algorithm outputs the factors p and q of N , then stop. 7: end if B.4.3 An Attack for Large Difference |ap -bq|

2

  and |Z| < 1 3 a|ap -bq|N -1 4 -α Y then, under ECM, N can be factored efficiently. Proof. Combining Proposition B.2.1 and Lemma B.3.1, we have |ap -

1 2

 1 +α X. Consequently, by Lemma B.4.1, Y X is a convergent of e N . Next, set M = N -eX Y . Using the equation eX -(N -ap -bq)Y = Z, we get

1 4 . 4

 44 Then M < ap + bq + aN 1 and ap + bq + M < 2(ap + bq) + aN 1 4 < 3(ap + bq) = 3N 1 2 +α .

  then

First

  , we show that our attacks will work for the exponents in E(a, b): given an exponent in E(a, b), it is possible to find the factorization of N according to Theorem B.4.2, Theorem B.4.3 or Theorem B.4.4. First, we start with a result for small difference |ap -bq|.

4 -α 2 ,

 42 then N can be factored in polynomial time. Proof. Set e 0 = (N -(ap + bq)) Y X , e = e 0 + z, Z = eX -(N -(ap + bq))Y . We want to show that the conditions of Theorem B.4.2 are satisfied. Assume that |z| < inf (abN )

1 2

 1 -α Y. It follows that the conditions of Theorem B.4.2 are fulfilled which leads to the factorization of N .

1 2

 1 +α . Let (X, Y, z), (X , Y , z ) ∈ P(a, b). Let e = (N -(ap + bq)) Y X + z, e = (N -(ap + bq)) Y X + z . If e = e then X = X , Y = Y and z = z . Proof. Let e 0 = (N -(ap + bq)) Y X , e 0 = (N -(ap + bq)) Y X . If e = e 0 + z and e = e 0 + z then

1 2

 1 +α and a p + b q = N 1 2 +α . Let (X, Y, z) ∈ P(a, b) and (X , Y , z ) ∈ P(a , b ). Let e = (N -(ap + bq)) Y X + z, e = (N -(a p + b q)) Y X + z . If e = e then X = X , Y = Y , a = a , b = b and z = z . Proof. Assume for contradiction that a = a , a < a say. Then b < b . Hence ap + bq < a p + b q and α < α . Combining with Lemma B.3.1, we get

1 2 , 2 (B. 10 )

 12210 which leads to N -(ap + bq) > N -(a p + b q) + N 1 Now, set e = (N -(ap + bq)) Y X + z, e = (N -(a p + b q)) Y X + z and assume e = e . Then, since |z| < N 1 4 -α 2 and |z

2 .

 2 Comparing with (B.11), we get a contradiction. Hence a = a and b = b . Now, we have (N -(ap + bq)) Y X + z = (N -(ap + bq)) Y X + z . By Lemma B.5.4, we conclude that X = X , Y = Y and z = z . This terminates the proof.

  106APPENDIX C. A NEW ATTACK ON RSA WITH TWO OR THREE DECRYPTION EXPONENTS

1 4 y 1 ,where S = N + 1 -e 1 x 1 y 1 and D = |S 2 -

 11112 4N |. Thus, the conditions of Lemma C.3.3 are satisfied which leads to the factorization of N .

  • 229 • 6079 • 103483 and b = 41 • 43 • 71 • 1693 • 14503 and we see that the largest prime factor is 103483 ≈ N 0.22 . Next, the decomposition a = x 2 y 1 = 71092821 • 54711, b = x 1 y 2 = 211917889 • 14503, gives x 1 = 211917889, y 1 = 54711, x 2 = 71092821 and y 2 = 14503. Using the equation e 1 x 1 -φ(N )y 1 = z 1 , we get p

112APPENDIX

  C. A NEW ATTACK ON RSA WITH TWO OR THREE DECRYPTION EXPONENTS Using the approximations S and D, we get p ≈ S+D 2 ≈ 412286285781. Finally, applying Coppersmith's Theorem C.2.2, we get p = 412286285849,

  D. AN ATTACK ON RSA USING LSBS OF MULTIPLES OF THE PRIME FACTORS

126APPENDIX

  D. AN ATTACK ON RSA USING LSBS OF MULTIPLES OF THE PRIME FACTORS Now suppose that γ = 1 and that a, b are small. Then α ≈ 0 and the boundary (D.5) becomes

128APPENDIX

  D. AN ATTACK ON RSA USING LSBS OF MULTIPLES OF THE PRIME FACTORS Next, define S = 2 m 0 (p 1 + q 1 ) + p 0 + q 0 = 124005844298295748786131327649328730. Then S is a candidate for ap + bq, and using Lemma D.2.3, we get ab = S 2 4N = 1560718201, |ap -bq| = D = S 2 -4abN = 1089287630585421413834056059092. Using S for ap + bq and D for |ap -bq|, we get 2ap = S -D, and finally p = gcd (N, S -D) = 2973592513804257910045501261169.

E. 2 . 2 x 1

 221 Lattice reduction Let us present some basics on lattice reduction techniques. Let b 1 . . . , b d be d linearly independent vectors of R n with d ≤ n. The set of all integer linear combinations of the b i forms a lattice L. Namely, i b i | x i ∈ Z . The integer n is the rank of the lattice L and d is its dimension. The set (b 1 , . . . , b d ) is called a basis of L. The determinant of L is defined as det(L) = √ B t B where B is the basis matrix, i.e., the matrix of the b i 's in the canonical basis of R n . The determinant is invariant under unimodular basis transformations of B and reduces to det(L) = | det(B)| when d = n. Let us denote by v the Euclidean norm of a vector v ∈ L. A central problem in lattice reduction is to find short non-zero vectors in L. Vectors with short norm can be computed by the LLL algorithm of Lenstra, Lenstra, and Lovász [86]. Theorem E.2.2 (LLL). Let L be a lattice spanned by a basis (u 1 , . . . , u d ). Then the LLL algorithm produces a new basis (b 1 , . . . , b d ) of L satisfying b

The set {u 1

 1 , . . . , u m } is called a lattice basis for L. The dimension (or rank) of the lattice L is dim(L) = m, and L is called full rank if m = n. It is often useful to represent the lattice L by the m × n matrix M whose rows are the coefficients of the vectors u 1 , . . . , u m . The determinant (or volume) of L is defined as det

2

 2 768 . Actually, weak Coppersmith's prime are of the form p = M 1 + u 0 or p = M 1 u 1 + M 0 with one unknown parameter u 0 or u 1 , while our weak primes for k = 1 are of the form p = M 1 u 1 + u 0 with two unknown parameters u 0 or u 1 . This shows that our weak prime factors are different from weak Coppersmith primes. F.4 The Attack with Two Weak Prime factors F.4.1 The Attack

k = 1 k

 1 = 2 k = 3 k = 4 k = 5 log 2 (N ) = 1024 0.332 0.199 0.141 0.109 0.089 log 2 (N ) = 2048 0.333 0.199 0.142 0.110 0.090 Table F.3: Upper bounds for δ with Theorem F.4.1.F.4.2 ExamplesExample F.4.2. Consider the 234 bits RSA modulus N = 18128727522177729435347634587168292968987318316812435932174117774340029.

d 1 -

 1 k 1 φ(N ) = 1 and e 2 d 2 -k 2 φ(N ) = 1 with e 1 > e 2 . Hence e 1 d 1 ≡ 1 (mod φ(N )) and e 2 d 2 ≡ 1 (mod φ(N )). Multiplying the first equation by e 2 and the second by e 1 and subtracting, we get e 1 e 2 (d 1 -d 2 ) ≡ e 2 -e 1 (mod φ(N )).

3 4 .2N 3 4

 43 Then, dk < 2N -4 √ and d, k fulfill the conditions of Theorem I.5.1 wich leads to the factorization of N in polynomial time in log(N ).

e N 2 4 √ 2N 3 4

 243 +1-9 4 N . Following the technique of Theorem I.5.1, for each convergent y x of e N 2 +1-9 4 N with xy < 2N -≈ 4.089 × 10 14 , we compute an approximation p of p using p apply Coppersmith's Theorem I.3.2 with p. Using the convergent y x = 16052 25478743725 , we get p ≈ 19126518. Coppersmith's Theorem outputs the prime factor p = 19126831 from which we deduce the second prime factor q = N p = 10699411. This completes the factorization of N .

2 )

 2 is µ * 1 = I, it means that the Möbius function µ is the Dirichlet inverse of the constant function 1 where 1(n) = 1. Similarly, Euler's totient function satisfies the following result. φ(n) = d|n µ(d) n d , (K.3)

Theorem K. 3 . 13 .

 313 For any function f ∈ B n , f has a Dirichlet inverse if and only if f (0) = 1, and in this case, f is the Dirichlet inverse of itself.Proof. Suppose that f is invertible with an inverse g. Then f * g = I and(f * g)(0) = f (0)g(0) = 1. Then f (0) = 1. Conversely, suppose that f (0) = 1, then f * f = f (0)I = I. Hence f is invertible and f is the Dirichlet inverse of itself.Next, we show that the set of Dirichlet invertible boolean functions is an Abelian group. Theorem K.3.14. Let B + n denote the set B + n = {f ∈ B n : f (0) = 1}. Then (B + n , * ) is an Abelian group.

3 . 15 .

 315 For any f, g ∈ B n , we havedeg(f ) + deg(g) ≥ deg(f * g * 1) and deg(f ) + deg( f ) ≥ n.Proof. To prove the first assertion, first, if deg(f ) + deg(g) ≥ n then this assertion is obviously true. We only need to prove it for the case deg(f) + deg(g) < n. If w H (x) > deg(f ) + deg(g), then for any u x, w H (u) + w H (xu) = w(x) > deg(f ) + deg(g), so w H (u) > deg(f ) or w H (x -u) > deg(g). If w H (u) > deg(f ) then f (u) = 0, and if w H (x -u) > deg(g) then ĝ(x -u) = 0, so in either case, we have f (u)ĝ(x -u) = 0. It follows that ( f * ĝ)(x) = u x f (u)ĝ(x -u) = 0 holds for any x ∈ GF (2) n such that w H (x) > deg(f ) + deg(g).Therefore, deg(( f * ĝ) * 1) ≤ deg(f ) + deg(g).

Finally

  , ( f * ĝ) * 1 = f * 1 * g * 1 * 1 = f * g * 1. This gives deg(f ) + deg(g) ≥ deg(f * g * 1). Next, we have deg(f ) + deg( f ) ≥ deg(f * f * 1). But f * f * 1 = f * f * 1 * 1 = f (0)I * I = f(0)I = I, so deg(f * f * 1) = deg(I) = n and we obtain the inequality deg(f ) + deg( f ) ≥ n.

4 . 5 .

 45 The boolean functions 1 + I, δ 1...1 and ρ 1...1 are coincident functions. Proof. Combining Theorem K.4.4 and Theorem K.3.8, we get (1 + I) * (1 + I) = 1 * 1 + I * I = I + I = 0. Hence 1+I is coincident. Next, combining Theorem K.4.4 and Lemma K.3.18, we get for any x ∈ GF (2) n , (1 + I) * δ 1...1 (x) = (1 * δ 1...1 )(x) + (I * δ 1...1 )(x) = ρ 1...1 (x) + δ 1...1 (x).

4 Table L. 1 :

 41 The coefficient matrix for the case m = 2, t = 1. 254APPENDIX L. NEW ATTACK ON RSA AND DEMYTKO'S ELLIPTIC CURVE CRYPTOSYSTEM

3 . 1 .

 31 Corollary L.4.1. Let (N, e, a, b) the public parameters of a Demytko's instance where N = pq. Suppose that e = N β satisfies an equation of the form eu -

  b 1 . . . , b d be d linearly independent vectors of R n with d ≤ n. The lattice L spanned by b 1 . . . , b d is the set of all integer linear combination x 1 b 1 + . . . + x d b d of b 1 . . . , b d with x 1 , . . . , x d ∈ Z. The set of vectors (b 1 . . . , b d ) is called a basis of L and d is its dimension. If B is the matrix of b 1 . . . , b d in the canonical basis of R n , then the determinant of L is det(L) = √ B t B, and the Euclidean norm of a vector v ∈ L is defined using the scalar product v = √ v • v.

Theorem M. 2 . 3 ( 1

 231 LLL). Let L be a lattice spanned by a basis (u 1 , . . . , u d ), then the LLL algorithm produces a new basis (b 1 , . . . , b d ) of L satisfying b

  f (x 1 , . . . , x n ) ≡ 0 (mod p) with x n if n i=1 λ i < 1 -(1 -β) n+1 n -(n + 1) 1 -n 1 -β (1 -β).

270APPENDIX

  M. LATTICE ATTACKS ON THE DGHV HOMOMORPHIC ENCRYPTION SCHEME

Hence a 2 r 2 +≤ 2 η- 1 .

 221 . . . + a m r m ≡ 0 (mod p), and when the integers a i , i = 2, . . . , m,satisfy |a i | ≤ 2 η-1-ρ m-1 , then |a 2 r 2 + . . . + a m r m | ≤ |a 2 ||r 2 | + . . . + |a m ||r m | ≤ (m -1) • max i |a i | • max i Since p > 2 η-1 , then |a 2 r 2 + . . . + a m r m | < p, that is a 2 r 2 + . . . + a m r m = 0.Finding many such a i 's, leads to recovering p using gcd(c 1 , a 2 c 2 +. . .+a m c m ) = p.

M. 4 . 1

 41 The attack Theorem M.4.1. Let c 1 = pq 1 and ci = pq i + r i , i = 2, . . . , m, be m positive integers with 2 η-1 < p < 2 η , 2 γ-1 < c i < 2 γ and |r i | < p for i = 2, . . . , m. Let a 1 , . . . , a m be m integers satisfying |a i | < 2 α i for i = 2, . . . , m and a 2 c 2 + . . . + a m c m = a 1 q 1 . Define β = γ-η-1 γ . If m i=2 α i < 1 -(1 -β) m m-1 -m 1 -m-1 1 -β (1 -β) (γ -1),

q 1 >

 1 2 γ-η-1 = 2 γβ > c β 1 .Using Herrman-May's Theorem M.2.4, we can solve the equation (M.1) if the unknown parameters a i satisfy|a i | < c λ i 1 for i = 2, . . . , m where m i=2 λ i < 1 -(1 -β) m m-1 -m 1 -m-1 1 -β (1 -β). (M.2)

274APPENDIX 1 : 2 : 4 :

 124 M. LATTICE ATTACKS ON THE DGHV HOMOMORPHIC ENCRYPTION SCHEME Algorithm 7 : The first attack Require: A set of public values c 1 = pq 1 , c i = pq i + r i , i = 2, . . . , m. Ensure: The set of private parameters p, q i , i = 1, . . . , m if the conditions of Theorem M.4.1 are fulfilled. Set f (x 2 , . . . , x m ) = c 2 x 2 + . . . + c m x m . Apply Coppersmith's technique and Herrman-May's Theorem M.2.4 to solve the polynomial equation f (x 2 , . . . , x m ) ≡ 0 (mod q 1 ). 3: for each solution (x 2 , . . . , x m ) do Compute g = gcd(c 1 , x 2 c 2 + . . . + x m c m ).

c 1 =

 1 pq 1 = 115681713396549343702207914242260837695350516124613657, c 2 = pq 2 + r 2 = 108225557677193859451749518166560930564055519997881978, c 3 = pq 3 + r 3 = 87008627993581418190653163120734875926757081732242410, c 4 = pq 4 + r 4 = 63900735072220368383452304843047856476842423469473333,

a 2 = 1 , a 2 c 2 + a 3 c 3 + a 4 c 4 ). 6 )c 1 a 1 + 2 < 2 2α (m - 1 ) + 2 α+ρ m 2 1 / 2 < 2 2 7 ), 1 m+1 • |c 1 a 1 + 1 m+1 • 2 α+ρ m 1 m+1 . (M. 9 )= m i=1 r 2 i 1 / 2 <

 2123461221122711119212 130722418993, a 3 = 16613347, a 4 = 27131339.Using these values, we get q 1 = gcd(c of p, we get r 2 ≡ c 2 ≡ 13835383 (mod p), r 3 ≡ c 3 ≡ 37261850 (mod p), r 4 ≡ c 4 ≡ 1283090 (mod p).Consider the m × m lattice L ⊂ Z m defined by the rows of the matrix The dimension of L is dim(L) = m and the determinant is det(L) = c m . Let v ∈ L be a target vector generated from the vector u = (a 1 , . . . , a m ) ∈ Z m , that is,v = uM = (a 1 , . . . , a m-1 , c 1 a 1 + . . . + c m a m ). (M.5)Minkowski's Theorem M.2.2 for L asserts that there exists short non-zero vectors of size at most σ(L) whereσ(L) = dim(L) det(L)For our target vector v to be among the shortest non-zero vectors of the lattice L, the inequality σ(L) > v must hold. Assume further that for i = 1, . . . , m, we have|a i | ≤ 2 α and |r i | ≤ 2 ρ . Using (M.5) with a 1 q 1 + . . . + a m q m = 0, we get . . . + c m a m ) (α+ρ) (m + 1) 2 1/2 = (m + 1)2 α+ρ . Therefore, the inequality σ(L) > v is fullfiled if √ mc 1 mm > (m+1)2 α+ρ , from which we deduce the following condition on α.If the condition (M.7) holds, then applying lattice reduction to L yields thevector v = (a 1 , . . . , a m-1 , c 1 a 1 + . . . + c m a m ) with c 1 a 1 + . . . + c m a m = a 1 r 1 + . . . + a m r m ,as in (M.4). Combining the obtained values from the reduction, that is a 1 , . . . , a m-1 and c 1 a 1 + . . . + c m a m , and the known public values c i , i = 1, • • • , m, one can calculate a m as follows:a m = (c 1 a 1 + . . . + c m a m ) -(c 1 a 1 + . . . + c m-1 a m-1 ) c m .The next step in the attack is to solve the equationa 1 r 1 + . . . + a m r m = c 1 a 1 + . . . + c m a m , (M.8)with the unknown parameters r 1 , . . . , r m with |r i | < 2 ρ for i = 1, . . . , m. To do so, we consider the (m + 1) × (m + 1) lattice L ⊂ Z m+1 defined by the rows of the matrix . . .0 C(c 1 a 1 + . . . + c m a m )where C is a given parameter to be optimized later. The determinant ofL is det(L ) = C|c 1 a 1 + . . . + c m a m | and its dimension is dim(L ) = m + 1.Let v ∈ L be a vector. Then there exists a vector u = (y 1 , . . . , y m+1 ) ∈ Z m+1 such thatv = u M = (y 1 , . . . , y m , C(a 1 y 1 + . . . + a m y m ) + C(c 1 a 1 + . . . + c m a m )y m+1 ).We set our target vector to be v = (r 1 , . . . , r m , 0), thereforey 1 =r 1 , . . . , y m = r m , (a 1 y 1 + . . . + a m y m ) + (c 1 a 1 + . . . + c m a m )y m+1 = 0. In addition, we need y m+1 = -1 so that a 1 r 1 + . . . + a m r m = c 1 a 1 + . . . + c m a m which provides a solution to equation (M.8). Now recall that Minkowski's Theorem M.2.2 asserts that there exist short non-zero vectors in the lattice L of size at most σ(L ) where σ(L ) = dim(L ) det(L ) . . . + c m a m | 1 m+1 . Since c 1 a 1 + . . . + c m a m = a 1 r 1 + . . . + a m r m with |a i | < 2 α and |r i | < 2 ρ , then, σ(L ) < √ m + 1 • C The norm of our target vector v = (r 1 , . . . , r m , 0) with |r i | < 2 ρ for i = 1, . . . , m, satisfies v 2 ρ √ m.

1 m+1 • 2 α+ρ m 1 m+1 > 2 ρ √ m which leads to the following condition on C C > m m-1 2 • 2 • 2

 11222 (m + 1) -m+1 mρ-α . (M.10)

Algorithm 8 : 1 : 2 :

 812 The second attack Require: A set of ciphertexts c i = pq i + r i , i = 1, . . . , m. Ensure: The set of private parameters p, q i , i = 1, . . . , m if the conditions of Theorem M.5.1 are fulfilled. Define the lattice L with the basis matrix Apply the LLL algorithm to reduce the basis matrix. 3: for each row (a 1 , . . . , a m-1 , R) of the reduced matrix do 4:

8 : 1

 81 Define the lattice L with the basis matrix Ca m 0 0 0 . . . 0 C(c 1 a 1 + . . . + c m a m )

10 :if r m+1 = 0 then 12 :

 1012 for each row (r 1 , . . . , r m+1 ) of the reduced matrix do 11:Compute p = gcd(c 1 -r 1 , c 2 -r 2 ).

13 : if p > 1 then 14 :

 1314 for i = 1, . . . , m do 15:

  end for 22: end for where ρ is the bit size of the noise r i , i = 1, 2, 3. Let L be the lattice spanned by the rows of the matrix

a 1 3 = - 6631296680887 .

 136631296680887 = 3991298341123, a 2 = 3713241313153,a 3 = 18196712614595893 -(a 1 c 1 + a 2 c 2 ) cIn this example, we have |a i | < 2 α for i = 1, 2, 3 with α = 43. Next, the aim is to solve the equationa 1 r 1 + a 2 r 2 + a 3 r 3 = a 1 c 1 + a 2 c 2 + a 3 c 3 = 18196712614595893,with the unknown coefficients r 1 , r 2 , and r 3 . Let C be a constant, and consider the lattice L spanned by the rows of the matrix C(a 1 c 1 + a 2 c 2 + a 3 c 3 ) C = 1 and applying the LLL algorithm, we get the following short vector (-23593, -18617, -21881, 0). This leads to the values ofr 1 = 23593, r 2 = 18617, r 3 = 21881.Hence, in this example, we have |r i | < 2 ρ for i = 1, 2, 3 with ρ = 15. We then deduce p = gcd(c 1 -r 1 , c 2 -r 2 ) = 706549229,

Table A .

 A 2: Table of values of ρ (γ) with p -√ p

					1 γ = B ecm = 10 50
	Number of bits of p γ = log p -√ p log B ecm ≈	256 1.5	512 3	1024 6.25	2048 12.50

ρ (γ) ≈(see

[START_REF] Granville | Smooth numbers: computational number theory and beyond[END_REF]

)

5.945 × 10 -1 4.861 × 10 -2 9.199 × 10 -6 1.993 × 10 -15

  3.3, ab = M 2 are of the same bit-size. Hence, if b ≤ 10 52 , then applying the Elliptic Curve Method with M 2

4N

and by Lemma B.3.2, we know that a and b 4N , we can find a and b.

Next, using |ap -bq| < 2N 1 2 , we can rewrite (B.7) as

  be one of the convergents of the continued fraction of e 1 e 2 . Moreover, if d 1 and d 2 are bounded, d 1 < N δ , d 2 < N δ say, then k 1 and k 2 are also bounded since for e i < φ(N ) we have

  1 2 S + |S 2 -4N | . Apply Coppersmith's algorithm (Theorem C.2.2) with P as an approximation of p.

	if Coppersmith's algorithm outputs the factorization of N , then
	stop.
	end if
	end for
	end for
	end for
	An Example for the New Attack with Two Exponents
	As an example, let us take
	N = 78783023222142579402299,
	e 1 = 20339472065400293617,
	e 2 = 16071808231974749459.
	The first 30 partial quotients of e 1 e 2 are
	[1, 3, 1, 3, 3, 1, 2, 59, 1, 2, 2, 2, 1, 1, 3, 1, 1,
	4, 3, 1, 7, 18, 10, 1, 13, 1, 1, 316, 4, 1,

  3

  1 y 1 and P = 1 2 S + |S 2 -4N | . Apply Coppersmith's algorithm (Theorem C.2.2) with P as an approximation of p. if Coppersmith's algorithm outputs the factorization of N , then stop.

	end if
	end for
	end for

Table D .

 D

	N	γ	β	α	δ	lattice parameters	LLL-time (sec)
	2048 0.999 0.219 0.008 0.340 m = 2, t = 1, dim=9	54
	2048 0.999 0.230 0.018 0.340 m = 3, t = 2, dim=18	2818
	2048 0.999 0.172 0.114 0.273 m = 2, t = 1, dim=9	22
	2048 0.999 0.150 0.096 0.272 m = 2, t = 1, dim=9	20
	2048 0.999 0.091 0.019 0.280 m = 2, t = 1, dim=9	16
	1024 0.999 0.326 0.123 0.368 m = 3, t = 2, dim=18	429
	1024 0.999 0.326 0.123 0.339 m = 2, t = 1, dim=9	7
	1024 0.998 0.229 0.050 0.326 m = 2, t = 1, dim=9	7
	1024 0.995 0.102 0.008 0.297 m = 2, t = 1, dim=9	4
	1024 0.999 0.131 0.123 0.239 m = 2, t = 1, dim=9	4

2: Experimental results.

Table E . 1 :

 E1 Applicability of the methods for k RSA moduli.

	Method	MSBs	LSBs
		k = 2 k ≥ 3 k = 2 k ≥ 3
	May, Ritzenhofen [94]	No	No	Yes	Yes
	Sarkar, Maitra [135]	Yes	No	Yes	No
	Faugère et al. [45]	Yes	Yes	No	No
	Kurosawa, Ueda [82]	No	No	Yes	No
	Our methods	Yes	Yes	Yes	Yes

Table E . 2 :

 E2 Comparison of the bounds on t for k RSA moduli in the MSB case.

	Method for MSBs	Number of RSA moduli k = 2	Number of RSA moduli k ≥ 3
	May, Ritzenhofen [94] Not studied	Not studied
	Sarkar, Maitra [135]

Table E .

 E 3: Comparison of the bounds on t for k RSA moduli in the LSB case.

	Method for LSBs	Number of RSA moduli k = 2	Number of RSA moduli k ≥ 3
	May, Ritzenhofen [94]

Table E .

 E 4: Experiments for k RSA moduli in the MSB and the LSB cases.

	Number Bit-size	Max	Used	Minimal	Experimental Experimental Number
	k	α of	bit-size	bit-size theoretical	bound	bound	of
	of	the	β of the	β of	bound	for t in	for t in	experi-
	moduli	q i 's	a i 's (E.9) the a i 's	for t	MSB case	LSB case	ments
	4	150	154	100	737	602		1000
	4	250	100	80	763	655		1000
	4	350	46	35	657	609		1000
	4	400	20	15	617	594		1000
	10	150	69	50	725	649		1000
	10	250	48	40	725	667		1000
	10	350	27	20	614	591		1000
	10	400	17	12	581	563		1000
	30	150	23	15	623	585		500
	30	250	17	12	634	596		500
	30	350	10	8	613	544		500
	30	400	6	4	541	533		500
	50	150	14	10	666	648		100
	50	250	10	7	615	597		100
	50	350	6	4	564	546		100
	50	400	4	3	564	556		100

Table F .

 F

	512	759	715	698	689	684	680	677
	n = 1 2 log 2 (N ) = 1024 1526	1438	1404	1386	1375	1368	1362
	n = 1 2 log 2 (N ) = 2048 3061	2885	2818	2782	2759	2744	2733

2: Lower bounds for η under Theorem F.3.7.

Table F .

 F 4: Lower bounds for η 2 under Theorem F.4.3.

	512	512	424	390	372	361	353	348
	n = 1024 1024	848	780	744	722	707	696
	n = 2048 2048	1696	1560	1489	1444	1414	1392

  Proof. A coincident function f ∈ B n is specified freely and uniquely by its values on 2 n-1 points (1, u 2 , . . . , u n ) ∈ GF (2) n . For each (u 2 , . . . , u n ) ∈ GF (2) n-1 , define the coincident function c (u 2 ,...,u n ) : GF (2) n → GF (2) as follows c (u 2 ,...,u n )

	21)
	Combining (K.20) and (K.21), we see that

u≺x f (u) = 0, that is (1 + I) * f = 0 and f is a coincident function.

  ). Conversely, let p be a prime number and t an integer with |t| < 2 where c 1 and c 2 are effectively computable positive constants. This shows that the number of elliptic curves with known cardinality is non negligible.Let p be a prime number and E p (a, b) be an elliptic curve with equationy 2 ≡ x 3 + ax + b (mod p) and cardinality #E p (a, b) = p + 1 -t p . The twist of E p (a, b) is the elliptic curve E p (a, b) defined by the equation cy 2 ≡ x 3 + ax + b (mod p) where c is a fixed quadratic non-residue modulo p. Then the cardinality of E

	c 1	√ p log p	< H(t 2 -4p) < c 2	√ p(log p)(log log p) 2 ,

√ p. Let H(d) denote the Kronecker class number (see Section 1.6 of

[START_REF] Lenstra | Factoring integers with elliptic curves[END_REF]

). Deuring's theory of CM-elliptic curves implies that there are H(t 2 -4p) elliptic curves on Z/pZ having p+1-t points. Note that when |t| < √ p, H(t 2 -4p) satisfies the following inequalities (see Proposition 1.9 of

[START_REF] Lenstra | Factoring integers with elliptic curves[END_REF]

)

  is only multiplicatively homomorphic: given two ciphertexts c 1 ≡ m e 1 (mod N ) and c 2 ≡ m e 2 (mod N ), one can compute the encrypted form of m 1 m 2 , that is (m 1 m 2 ) e (mod N ), without having to recover the plaintexts m 1 and m 2 , simply by applying c 1 c 2 ≡ m e 1 m e 2 ≡ (m 1 m 2 ) e (mod N ). Similarly, ElGamal [42] is multiplicatively homomorphic. By contrast, Paillier [124] is additively homomorphic: given two ciphertexts c 1

  .1, we show the maximal values of α 0 for which the orthogonal attack of[START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF] works, and the maximal values of α new for which our attack works. Clearly, our method significantly increases the bounds of the size of the unknown integers a i , i = 2, . . . , a m for which DGHV is vulnerable. × 10 6 183.8 3.9 × 10 6 182.8 1.9 × 10 6 181.6 8.8 × 10 5 181 5.7 × 300 284.8 2.6 × 10 7 283.8 1.3 × 10 7 282.8 6.7 × 10 6 281.6 2.9 × 10 6 281 1.9 × 400 384.8 6.3 × 10 7 383.8 3.1 × 10 7 382.8 1.5 × 10 7 381.6 7.1 × 10 6 381 4.5 × 500 484.8 1.2 × 10 8 483.8 6.2 × 10 7 482.8 3.1 × 10 7 481.6 1.3 × 10 7 481 8.9 × Table M.1: Comparison of α 0 and α new for certain values of η and m.

			m = 2		m = 3		m = 5		m = 10		m = 15
	η	α 0	α new	α 0	α new	α 0	α new	α 0	α new	α 0	α new
	200 184.8 7.9

-ε where ε is arbitrarily small for large N .

-ε . Using the notion of weak keys, as defined by Blömer and May[13], the results of this paper show that this set of RSA public keys is a class of weak keys.

Remerciements

Je tiens à remercier ici toutes les personnes qui m'ont aidé de près ou de loin dans l'accomplissement de ce travail.

Another Generalization of Wiener's Attack on RSA AFRICACRYPT 2008

This paper presents an attack on the RSA cryptosystem using a generalization of the key equation. The variant equation is in the form eX -(pu)(q -v)Y = 1. For suitably small parameters, the continued fraction algorithm and Coppersmith's technique are used to solve the equation and factor the RSA modulus N = pq.

Appendix B:

Cryptanalysis of RSA Using the Ratio of the Primes AFRICACRYPT 2009 In this paper, we consider the RSA cryptosystem with a modulus N = pq and a public exponent e satisfying an equation of the form eX -(N -(ap+bq))Y = Z with suitably small integers X, Y , Z, where a b is an unknown convergent of the continued fraction expansion of q p . We combine the continued fraction algorithm, Coppersmith's technique and the elliptic curve method for factorization (ECM) to solve the equation and factor the modulus.

Appendix J: Cryptanalysis of NTRU with two Public Keys International Journal of Network Security 2014

We consider an instance of NTRU with two public keys. We show that, if the private keys share an amount of coefficients, then one can apply lattice reduction to break the system. The attack on NTRU with two public keys extends the former attack of Coppersmith and Shamir when only one public key is available.

Appendix K: Dirichlet Product for Boolean Functions Journal of Applied Mathematics and Computing 2016

Boolean functions play a central role in symmetric cryptography. For security reasons, boolean functions are required to satisfy a certain number of cryptographic properties. In this paper, we introduce a new notion, called Dirichlet product and study various properties and applications.

Appendix A

Another Generalization of Wiener's Attack on RSA AFRICACRYPT 2008 [START_REF] Nitaj | Another generalization of Wiener's attack on RSA[END_REF] Abstract :

A well-known attack on RSA with low secret-exponent d was given by Wiener in 1990. Wiener showed that using the equation ed -(p -1)(q -1)k = 1 and continued fractions, one can efficiently recover the secret-exponent d and factor N = pq from the public key (N, e) as long as d < 1 3 N 1 4 . In this paper, we present a generalization of Wiener's attack. We show that every public exponent e that satisfies eX -(p -u)(q -v)Y = 1 with

and all prime factors of p-u or q -v are less than 10 50 yields the factorization of N = pq. We show that the number of these exponents is at least N 1 2 -ε .

55

A. 6 The number of exponents for the new method

In this section, we estimate the number of exponents for which our method works. Let N = pq be an RSA modulus with q < p < 2q. The principal object of investigation of this section is the set H(N ) = e : e < N, ∃u ∈ V (p), ∃X < 2 -1 4 N 1 4 , e ≡ X -1 (mod ψ(u, v)) ,

where

, p -u is B ecm -smooth , (A.9)

and v = -qu p-u . We will first show that every public exponent e ∈ H(N ) is uniquely defined by a tuple (u, X). We first deal with the situation when an exponent e is defined by different tuples (u, X) and (u, X ).

Lemma A.6.1. Let N = pq be an RSA modulus with q < p < 2p. Let u, v, X, X be integers with 1 ≤ X, X < 2 -1 4 N 1 4 and gcd(XX , ψ(u, v)) = 1 where v = -qu p-u . Define e ≡ X -1 (mod ψ(u, v)) and e ≡ X -1 (mod ψ(u, v)).

If e = e , then X = X .

Proof. Since e ≡ X -1 (mod ψ(u, v)), there exists a positive integer Y such that eX -ψ(u, v)Y = 1 with gcd(X, Y ) = 1. Similarly, e satisfies e Xψ(u, v)Y = 1 with gcd(X , Y ) = 1. Assume that that e = e . Then

Combining this with Lemma A.4.1, we get

Appendix B

Cryptanalysis of RSA Using the Ratio of the Primes AFRICACRYPT 2009 [START_REF] Nitaj | Cryptanalysis of RSA using the ratio of the primes[END_REF] Abstract :

Let N = pq be an RSA modulus, i.e. the product of two large unknown primes of equal bit-size. In the X9.31-1997 standard for public key cryptography, Section 4.1.2, there are a number of recommendations for the generation of the primes of an RSA modulus. Among them, the ratio of the primes shall not be close to the ratio of small integers. In this paper, we show that if the public exponent e satisfies an equation eX -(N -(ap + bq))Y = Z with suitably small integers X, Y , Z, where a b is an unknown convergent of the continued fraction expansion of q p , then N can be factored efficiently. In addition, we show that the number of such exponents is at least N

Appendix C

A New Attack on RSA with Two or Three Decryption Exponents

Journal of Applied Mathematics and

Computing 2013 [START_REF] Nitaj | A new attack on RSA with two or three decryption exponents[END_REF] Abstract :

Let N = pq be an RSA modulus, i.e. the product of two large unknown primes of equal bit-size. In this paper, we describe an attack on RSA in the presence of two or three exponents e i with the same modulus N and satisfying equations e i x i -φ(N )y i = z i , where φ(N ) = (p -1)(q -1) and x i , y i , z i are unknown parameters. The new attack is an extension of Guo's continued fraction attack as well as the Blömer and May lattice-reduction basis attack.

Appendix D

An Attack on RSA Using LSBs of Multiples of the Prime Factors

AFRICACRYPT 2013 [START_REF] Nitaj | An attack on RSA using LSBs of multiples of the prime factors[END_REF] Abstract :

Let N = pq be an RSA modulus with a public exponent e and a private exponent d. Wiener's famous attack on RSA with d < N 0.25 and its extension by Boneh and Durfee to d < N 0.292 show that using a small d makes RSA completely insecure. However, for larger d, it is known that RSA can be broken in polynomial time under special conditions. For example, various partial key exposure attacks on RSA and some attacks using additional information encoded in the public exponent e are efficient to factor the RSA modulus. These attacks were later improved and extended in various ways.

In this paper, we present a new attack on RSA with a public exponent e satisfying an equation ed -k(N + 1 -ap -bq) = 1 where a b is an unknown approximation of q p . We show that RSA is insecure when certain amount of the Least Significant Bits (LSBs) of ap and bq are known. Further, we show that the existence of good approximations a b of q p with small a and b

Appendix E

Implicit Factorization of Unbalanced RSA Moduli

Journal of Applied Mathematics and

Computing 2015 [START_REF] Nitaj | Implicit factorization of unbalanced RSA moduli[END_REF] with Muhammad Rezal Kamel Ariffin

Abstract :

Let N 1 = p 1 q 1 and N 2 = p 2 q 2 be two RSA moduli, not necessarily of the same bit-size. In 2009, May and Ritzenhofen proposed a method to factor N 1 and N 2 given the implicit information that p 1 and p 2 share an amount of least significant bits. In this paper, we propose a generalization of their attack as follows: suppose that some unknown multiples a 1 p 1 and a 2 p 2 of the prime factors p 1 and p 2 share an amount of their Most Significant Bits (MSBs) or an amount of their Least Significant Bits (LSBs). Using a method based on the continued fraction algorithm, we propose a method that leads to the factorization of N 1 and N 2 . Using simultaneous diophantine approximations and lattice reduction, we extend the method to factor k ≥ 3 RSA moduli N i = p i q i , i = 1, . . . , k given the implicit information that there exist unknown multiples a 1 p 1 , . . . , a k p k sharing an amount of their MSBs or their LSBs. Also, this paper extends many previous works where similar results were obtained when the p i 's share their MSBs or their LSBs.

E.1 Introduction

Research in determining pre-requisites for strong primes for the integer factorization problem (IFP) of a product of two primes N = pq has been intriguing and have captured the attention of researchers since IFP came into prominence via the RSA algorithm. The simplicity of the problem statement raised interest on whether such a simple problem statement describing the IFP could only be solved in exponential time for all cases, i.e. all types of primes. As can be found in the literature, this is not the case. So-called weak primes were identified by researchers and this caused an avalanche of research output on this matter. In this paper, we focus on IFP when N = pq is unbalanced, that is when q is much smaller than p.

In PKC 2009, May and Ritzenhofen [START_REF] May | Implicit factoring: On polynomial time factoring given only an implicit hint[END_REF] presented a method for factoring large integers with some implicit hints. More precisely, let N 1 = p 1 q 1 and N 2 = p 2 q 2 be two RSA moduli of the same bit-size such that q 1 and q 2 are α-bit primes and p 1 and p 2 share at least t least significant bits (LSBs). The method of May and Ritzenhofen is a lattice based method that allows to find the factorization of N 1 and N 2 when t ≥ 2α + 3. May and Ritzenhofen's method heuristically generalizes to a lattice based method to simultaneously factor k RSA moduli N 1 = p 1 q 1 , . . . , N k = p k q k when the p i 's share t ≥ k k-1 α many LSBs.

In [START_REF] Sarkar | Further results on implicit factoring in polynomial time[END_REF], Sarkar and Maitra reconsidered the method of May and Ritzenhofen for two RSA moduli. Sarkar and Maitra's method works when N 1 = p 1 q 1 and N 2 = p 2 q 2 are such that p 1 and p 2 share their LSBs or most significant bits (MSBs) as well as a contiguous portion of bits at the middle.

In PKC 2010, Faugère, Marinier and Renault [START_REF] Faugère | Implicit factoring with shared most significant and middle bits[END_REF] presented a new and rigorous lattice-based method that addresses the implicit factoring problem when p 1 and p 2 share t MSBs. Moreover, when N 1 = p 1 q 1 and N 2 = p 2 q 2 are two RSA moduli of the same bit-size and the prime factors q i are α-bit t many MSBs or t many LSBs. This provides practitioners tighter conditions for the primes that are generated for utilization with the RSA algorithm. On the other hand, our results also serve their purpose to provide a peace of mind for practitioners knowing that the generated RSA moduli does not fall into any of the categories mentioned in this work.

Appendix F

Factoring RSA Moduli with Weak Prime Factors C2SI 2015 [START_REF] Nitaj | Factoring RSA moduli with weak prime factors[END_REF] with Tajjeeddine Rachidi

Abstract :

In this paper, we study the problem of factoring an RSA modulus N = pq in polynomial time, when p is a weak prime, that is, p can be expressed as ap = u 0 + M 1 u 1 + . . . + M k u k for some k integers M 1 , . . . , M k and k + 2 suitably small parameters a, u 0 , . . . u k . We further compute a lower bound for the set of weak moduli, that is, moduli made of at least one weak prime, in the interval [2 2n , 2 2(n+1) ] and show that this number is much larger than the set of RSA prime factors satisfying Coppersmith's conditions, effectively extending the likelihood for factoring RSA moduli. We also prolong our findings to moduli composed of two weak primes.

F.2.3 Coppersmith's Method

In 1996, Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] presented two techniques based on LLL to find small integer roots of univariate modular polynomials or of bivariate integer polynomials. Coppersmith showed how to apply his technique to factorize an RSA modulus N = pq with q < p < 2q when half of the least or the most significant bits of p is known.

Theorem F.2.2. Let N = pq be an RSA modulus with q < p < 2q. Let M 0 and M 1 be two positif integers.

, then N can be factored in time polynomial in log N .

Coppersmith's technique extends to polynomials in more variables, but the method becomes heuristic. The problem of finding small roots of linear modular polynomials f (x 1 , . . . ,

for some unknown p that divides the known modulus N has been studied using Coppersmith's technique by Herrmann and May [START_REF] Herrmann | Solving linear equations modulo divisors: On factoring given any bits[END_REF]. The following result, due to Lu, Zhang and Lin [START_REF] Lu | New Results on Solving Linear Equations Modulo Unknown Divisors and its Applications[END_REF] gives a sufficient condition under which modular roots can be found efficiently.

Theorem F.2.3 (Lu, Zhang, Lin). Let N be a composite integer with a divisor p u such that p ≥ N β . Let f (x 1 , . . . , x n ) ∈ Z[x 1 , . . . , x n ] be a homogenous linear polynomial. Then one can find all the solutions (y 1 , . . . , y n ) of the equation f (x 1 , . . . , x n ) = 0 mod p v , v ≤ u with gcd(y 1 , . . . , y n ) = 1 and

The time complexity of the algorithm for finding such sulution (y 1 , . . . , y n ) is polynomial in log N .

Remark F.3.2. For a balanced RSA modulus, the prime factors p and q are of the same bit size. Then p > N β with β = 1 2 . Hence, the condition on δ becomes

In Table F.1, we give the bound for δ for given β and k. Remark F.3.3. We note that Coppersmith's weak primes correspond to moduli N = pq with q < p < 2q where one of the prime factors is of the

185744046801879577421186031638557426812962407688357511963709141, be a 412-bit RSA modulus with N = pq where q < p < 2q. Then p and q are balanced and p ≈ N 100 . For β = 0.5 and k = 2, Table (F.1) gives the bound δ < 0.069. Assume therefore that the parameters u i satisfy |u i | < N 0.069 ≈ 2 28 for i = 0, 1, 2. By applying sets of weak moduli -that is, moduli made of at least one or two weak prime respectively-in the interval [2 2n , 2 2(n+1) ] and showed that these sets are much larger than the set of RSA prime factors satisfying Coppersmith's conditions, which effectively extending the likelihood for factoring RSA moduli.

Appendix G

New attacks on RSA with Moduli N = p r q C2SI 2015 [START_REF] Nitaj | New attacks on RSA with moduli N = p r q. Codes[END_REF] with Tajjeeddine Rachidi Abstract :

We present three attacks on the Prime Power RSA with modulus N = p r q. In the first attack, we consider a public exponent e satisfying an equation ex -φ(N )y = z where φ(N ) = p r-1 (p -1)(q -1). We show that one can factor N if the parameters |x| and |z| satisfy |xz| < N r(r-1) (r+1) 2 thereby extending the recent results of Sakar [START_REF] Sarkar | Small secret exponent attack on RSA variant with modulus N = p r q, Designs[END_REF]. In the second attack, we consider two public exponents e 1 and e 2 and their corresponding private exponents d 1 and d 2 . We show that one can factor N when d 1 and d 2 share a suitable amount of their most significant bits, that is

The third attack enables us to factor two Prime Power RSA moduli N 1 = p r 1 q 1 and N 2 = p r 2 q 2 when p 1 and p 2 share a suitable amount of their most significant bits, namely,

The First Attack on Prime Power RSA with Modulus N = p r q

In this section, we present an attack on the Prime Power RSA when the public key (N, e) satisfies an equation ex -φ(N )y = z with small parameters x and |z|.

Theorem G.3.1. Let N = p r q be a Prime Power RSA modulus and e a public exponent satisfying the equation ex -φ(N )y = z with y ≡ 0 (mod pq), 1 < e < φ(N ) and gcd(e, φ(N )) = 1. Then one can factor N in polynomial time if

Proof. Suppose that e < N satisfies an equation ex-φ(N )y = z with |x| < N δ and |z| < N γ . Then, since φ(N ) = p r-1 (p -1)(q -1), we get ex -z ≡ 0 (mod p r-1 ). Applying Theorem G.2.1 with u = r, v = r -1 and β = 1 r+1 , we can solve the equation in polynomial time if

. Since e φ(N ) < 1, then, using x and z in the equation ex -φ(N )y = z, we get for sufficiently large N comparatively to r,

Hence, when y ≡ 0 (mod pq), we get gcd(ex -z, N ) = gcd(p r-1 (p -1)(q -1)y, p r q) = g,

g . This leads to the factorization of N .

Example G.3.2. For r = 2 and N = p r q, let us take for N and e the 55 digit numbers

Example G.5.2. We present here an example corresponding to Theorem G.5.1.

Consider

We applied the continued fraction algorithm to compute the first 40 convergents of N 2 N 1 . Every convergent is a candidate for the ratio q 2 q 1 of the prime factors. One of the convergents is 36443689 51698789 leading to q 2 = 36443689 and q 1 = 51698789. This gives the prime factors p 1 and p 2

G.6 Conclusion

In this paper, we have considered the Prime Power RSA with modulus N = p r q and public exponent e. We presented three new attacks to factor the modulus in polynomial time. The first attack can be applied if small parameters x, y and z satisfying the equation ex -φ(N )y = z can be found . The second attack can be applied when two private exponents d 1 and d 2 share an amount of their most significant bits. The third attack can be applied when two Prime Power RSA moduli N 1 = p r 1 q 1 and N 2 = p r 2 q 2 are such that p 1 and p 2 share an amount of their most significant bits.

Appendix H A New Attack on the KMOV Cryptosystem

Bulletin of the Korean Mathematical Society 2014 [START_REF] Nitaj | A new attack on the KMOV cryptosystem[END_REF] Abstract :

In this paper, we analyze the security of the KMOV public key cryptosystem. KMOV is based on elliptic curves over the ring Z n where n = pq is the product of two large unknown primes of equal bit-size. We consider KMOV with a public key (n, e) where the exponent e satisfies an equation ex -(p + 1)(q + 1)y = z, with unknown parameters x, y, z. Using Diophantine approximations and lattice reduction techniques, we show that KMOV is insecure when x, y, z are suitably small.

Next we present the main result.

Theorem H.3.5. Let n = pq be an RSA modulus with q < p < 2q. Suppose that e is an exponent satisfying an equation ex -(p + 1)(q + 1)y = z with gcd(x, y) = 1 and

.

Then n can be factored in polynomial time.

Proof. Suppose e satisfies an equation ex-(p+1

12 , then, by Theorem H.3.3, we find x and y among the convergents of e n . Next, put

Starting with the equation ex -(p + 1)(q + 1)y = z, we get

3(p + q) .

Hence

Dividing by p -q + V , we get

Observe that (H.5) implies

On the other hand, we have p -q + V > p -q. Plugging in (H.6), we get

Combining this with (H.5), we deduce

This implies that U +V 2 is an approximation of p up to an error term of at most n Applying the factorization algorithm with the convergent x y = 80479 19284641 , we get

Applying Coppersmith's Theorem with U +V 2 = 17607663822449 as an approximation for p, we get p = 17607663822197, q = 9849590944783, which leads to the factorization of N . Using p and q, we can compute the secret exponent d satisfying ed ≡ 1 (mod (p + 1)(q + 1)), namely d ≡ e -1 ≡ 70154311084917810813949567 (mod (p + 1)(q + 1)),

Observe that d ≈ n 0.985 . This explains why the attacks on KMOV with small secret exponents do not work in this example.

H.5 Conclusion

We have presented a new attack on the KMOV cryptosystem with a public key (n, e) where n = pq is an RSA modulus and e a public exponent satisfying gcd(e, (p + 1)(q + 1)) = 1 as required by KMOV. We prove that KMOV is insecure if there exist integers x, y and z with

.

and satisfying an equation ex -(p + 1)(q + 1)y = z. The attack combines the continued fraction algorithm and Coppersmith's lattice reduction based method and can be seen as an extension of Pinch's attack on small KMOV secret decryption exponents.

Appendix I

A Generalized Attack on RSA Type Cryptosystems

Theoretical Computer Science 2016 [START_REF] Bunder | A generalized attack on RSA type cryptosystems[END_REF] with Martin Bunder, Willy Susilo, Joseph Tonien

Abstract :

Let N = pq be an RSA modulus with unknown factorization. Some variants of the RSA cryptosystem, such as LUC, RSA with Gaussian primes and RSA type schemes based on singular elliptic curves use a public key e and a private key d satisfying an equation of the form ed -k p 2 -1 q 2 -1 = 1. In this paper, we consider the general equation ex -p 2 -1 q 2 -1 y = z and present a new attack that finds the prime factors p and q in the case that x, y and z satisfy a specific condition. The attack combines the continued fraction algorithm and Coppersmith's technique and can be seen as a generalization of the attacks of Wiener and Blömer-May on RSA.

and

4N 2 +4-9N < 1 2xy . Using this in (I.5), we get

Hence, if this condition is fulfilled, then one can find y x amongst the convergents of the continued fraction expansion of e N 2 +1- 9 4 N as stated in Theorem I.3.1. Moreover, since gcd(x, y) = 1, the values of x and y are the denominator and numerator of the convergent. Plugging x and y in (I.1), we get

Adding 2N to both sides of (I.6), we get

Similarly, subtracting 2N to both sides of (I.6), we get

Observe that (I.7) can be transformed into

from which we deduce

This means that (N + 1) 2 -ex y is an approximation of p + q with error term less than N 1 4 . In a similar way, using (I.8), we get

Using the assumption |z| < (p -q)N 1 4 y, we get

Hence, (N -1) 2 -ex y is an approximation of p -q with an error term less than N 1 4 . Combing the approximations of p + q and p -q, we get

This gives an approximation of p with an error term of at most N 1 4 . Hence, using Coppersmith's Theorem I.3.2, one can find p which leads to q = N p . Since every step in the proof can be done in polynomial time in log(N ), then the factorization of N can be obtained in polynomial time in log(N ).

We note that, when gcd ex, p 2 -1 q 2 -1 = 1, the diophantine equation ex -p 2 -1 q 2 -1 y = z is equivalent to the modular equation Appendix J

Cryptanalysis of NTRU with two Public Keys

International Journal of Network Security 2014 [START_REF] Nitaj | Cryptanalysis of NTRU with two Public Keys[END_REF] Abstract : NTRU is a fast public key cryptosystem presented in 1996 by Hoffstein, Pipher and Silverman. It operates in the ring of truncated polynomials. In NTRU, a public key is a polynomial defined by the combination of two private polynomials. In this paper, we consider NTRU with two different public keys defined by different private keys. We present a lattice-based attack to recover the private keys assuming that the public keys share polynomials with a suitable number of common coefficients.

J.1 Introduction

The NTRU Public Key Cryptosystem is a ring-based cryptosystem that was first introduced in the rump session at Crypto'96 [START_REF] Hoffstein | NTRU: A Ring Based Public Key Cryptosystem[END_REF]. It is one of the fastest 203 Any two bases of the same lattice L are related by some integral matrix of determinant ±1.

There are several natural computational problems relating to lattices. An important problem is the shortest vector problem (SVP): given a basis matrix B for L, compute a non-zero vector v ∈ L such that v is minimal.

In 1982, Lenstra, Lenstra and Lovász [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] introduced the LLL reduction algorithm which produces an LLL-reduced basis b 1 , . . . , b n of L with the following property

In comparison, a theorem of Minkowski asserts that any lattice L of dimension n contains a non-zero vector v with v ≤ 2n eπ det(L)

On the other hand, the Gaussian heuristic says that the length of the shortest non-zero vector is usually approximately σ(L) where

1 n .

J.3.4 The attack of Coppersmith and Shamir on NTRU

In [START_REF] Coppersmith | Lattice attacks on NTRU[END_REF] Coppersmith and Shamir presented a lattice attack on NTRU. They defined a lattice determined by the parameters N , q, h of the system and showed that recovering the secret key (f, g) from the public key h is reduced to finding a shortest vector of the lattice. Let h = (h 0 , h 1 , • • • , h N -1 ) be the public key. The NTRU lattice L is the lattice of dimension 2N generated by Appendix K

Dirichlet Product for Boolean Functions

Journal of Applied Mathematics and Computing 2016 [START_REF] Nitaj | Dirichlet Product for Boolean Functions[END_REF] with Willy Susilo and Joseph Tonien Abstract : Boolean functions play an important role in many symmetric cryptosystems and are crucial for their security. It is important to design boolean functions with reliable cryptographic properties such as balancedness and nonlinearity. Most of these properties are based on specific structures such as Möbius transform and Algebraic Normal Form. In this paper, we introduce the notion of Dirichlet product and use it to study the arithmetical properties of boolean functions. We show that, with the Dirichlet product, the set of boolean functions is an Abelian monoid with interesting algebraic structure. In addition, we apply the Dirichlet product to the sub-family of coincident functions and exhibit many properties satisfied by such functions.

In the language of Dirichlet product, the identity (K.3) is µ * N = φ where N is the function N (n) = n. In the language of group theory, it implies that

So under the notion of Dirichlet product, two isolated results, (K.3) and (K.4) are ultimately related: (K.3) means φ = µ * N , whereas (K.4) means

For two boolean functions f and g, we define the concept of Dirichlet product by setting for all x ∈ GF (2) n

where, for u = (u 1 , . . . , u n ) ∈ GF (2) n and x = (x 1 , . . . , x n ) ∈ GF (2) n , u x if and only if for each i ∈ {1, . . . , n}, u i ≤ x i . We show that the Dirichlet product for boolean functions is commutative, associative and that the set of all boolean functions is an Abelian monoid and has the identity function I satisfying

Moreover, we link a boolean function f to its Möbius transform f using the Dirichlet products f = f * 1 and f = f * 1 where 1 is the constant function 1(x) = 1. We show that the set of all boolean functions f such that f (0, 0, . . . , 0) = 1 under the Dirichlet product form an Abelian group and the inverse of any such function f is f itself.

Finally, we will study the set of coincident functions and its algebraic structure. A coincident function is a boolean function f such that f = f . Under the Dirichlet product, we show that the set of all coincident functions is a 2 n-1 subspace with cardinality 2 2 n-1 .

The rest of this paper is organized as follows. In Section 2, we review the basic properties of boolean functions. In Section 3, we introduce the new notion of Dirichlet product for boolean functions and study its arithmetic This is not accidental. The duality between (K.5) and (K.8) is explained by the fact that f = f * 1 and f = f * 1 as in Theorem K.3.9.

K.3 Dirichlet product for boolean functions

In this section, we define the Dirichlet product f * g for two boolean functions f and g and study several properties of the monoid (B n , * ). In the rest of this paper, the term (0, 0, . . . , 0) ∈ GF (2) n is often denoted as 0.

x where w H (x) is the Hamming weight of x.

Proof. Let x = (x 1 , x 2 , . . . , x n ). For each i with 1 ≤ i ≤ n, we have

It follows that the number of terms u ∈ GF (2) n satisfying u x is n i=1

Example K.3.2. Let n = 3 and x = (1, 0, 1) ∈ GF (2) 3 . Then the set of all u ∈ GF (2) 3 such that u x is {(0, 0, 0), (0, 0, 1), (1, 0, 0), (1, 0, 1)} . Now, we define the notion of Dirichlet product of two boolean functions.

Lemma K.3.6. For f, g ∈ B n , define addition operation f + g ∈ B n as

Then the Dirichlet product is distributive over this addition operation.

Proof. We have

The next result gives one of the basic properties of the Dirichlet product.

Lemma K.3.7. For any functions f, g ∈ B n ,

Proof. Since u 0 happens only for u = 0, we have

The next result defines the constant boolean function 1 and links it to the identity function I.

It means that 1 is its own inverse under Dirichlet multiplication.

With this addition operation, B n is a free Abelian group. There are two natural ways to choose a basis for B n . We will describe them in Theorem K.3.16 and Theorem K.3.17.

Theorem K.3.16. For each a ∈ GF (2) n , define the function δ a ∈ B n as follows

Then {δ a } a∈GF (2) n forms a basis for the vector space (B n , +). Each function f ∈ B n can be written as a linear combination of basis functions δ a as

Proof. If x = a, then for each i = 1, 2, . . . , n, x i + a i + 1 = 1 and δ a (x) = 1. If x = a, then x i = a i for some i. Hence x i + a i + 1 = 0 and δ a (x) = 0.

We have

Note that, δ 0 is the Dirichlet identity function I:

Theorem K.3.17. For each a ∈ GF (2) n , define the function ρ a ∈ B n as follows

Proof. Combining Theorem K.4.4 and Theorem K.3.18, we get

where u ≺ x means u x and u = x.

we have

Therefore, (1 + I) * f = 0 if and only if for any

Consider two cases, x 1 = 0 and x 1 = 1. When x 1 = 0, the condition becomes

The following theorem reveals a relationship between the set of coincident functions C n and the set of all boolean functions B n .

Theorem K.4.8. It holds that 1. A coincident function f ∈ C n is specified freely and uniquely by its values on 2 n-1 points (1, u 2 , . . . , u n ) ∈ GF (2) n .

2. There are exactly 2 2 n-1 coincident functions in total.

3.

Proof. To prove the first assertion, observe that by Theorem K.4.7, a coincident function f ∈ C n is specified freely by its values on 2 n-1 points (1, u 2 , . . . , u n ) ∈ GF (2) n , and its values on 2 n-1 other points (0, u 2 , . . . , u n ) ∈ GF (2) n are uniquely determined by (K.18). The second assertion follows since there are exactly 2 choices for choosing f (1, u 2 , . . . , u n ) ∈ {0, 1}, then there are exactly 2 2 n-1 coincident functions in total.

To prove the third assertion, observe that if f ∈ C n and g ∈ C n , then f + g ∈ C n . On the other hand, the relation (K.18) defines any coincident function f ∈ C n . It follows that (C n , +) is a 2 n-1 -dimensional linear subspace of (B n , +).

By Theorem K.4.8, we know that (C n , +) is a 2 n-1 -dimensional linear subspace of (B n , +). The following result gives an explicit basis for (C n , +).

Theorem K.4.9. For each

Then {γ (u 2 ,...,u n ) } (u 2 ,...,u n )∈GF (2) n-1 forms a basis for the subspace (C n , +), and each coincident function f ∈ C n can be written as a linear combination of basis functions as

Appendix L New Attack on RSA and Demytko's Elliptic Curve Cryptosystem

Mathematics in Computer Science, 2016 [START_REF] Nitaj | A New Attack on RSA and Demytko's Elliptic Curve Cryptosystem[END_REF] with Emmanuel Fouotsa Abstract :

Let N = pq be an RSA modulus and e a public exponent. We show how to factor the RSA modulus if e satisfies an equation of the form eu -(ps)(q -r)v = w with suitably small unknown integers u, v, w, r and s under the condition that p -s is factorable using the Elliptic Curve Method for factorization ECM. As an application, we propose an attack on Demytko's elliptic curve cryptosystem. Our method is based on Coppersmith's technique for solving multivariate polynomial modular equations.

L.1 Introduction

In 1976, Diffie and Hellman [START_REF] Diffie | New directions in cryptography[END_REF] invented the concept of the public-key cryptosystem. Since then, various schemes have been proposed as public-key

In this paper, using a variant RSA equation, we present a new attack on RSA by combining Coppersmith's method and the Elliptic Curve Method for factorization ECM. Let B be a positive integer. An integer n is said to be B-smooth if all prime factors are less than B. We say that B is an efficiency bound for ECM if every prime factor less than B of an integer n can be found by ECM.

Suppose that the public exponent e = N β satisfies a variant equation of the form eu -(p -s)(q -r)v = w with suitably small unknown integers u < N δ , |w| < N γ , |r| < N α and |s| < N α with α < 1 4 . We show that the RSA modulus N = pq can be factored under two conditions. The first condition is that p -s is B-smooth for some efficiency bound B of ECM and the second condition is that δ satisfies the following inequality

where ε is a small positive constant. Our method is based on combining Coppersmith's method and ECM. We use Coppersmith's method to find the small solutions (u, v, w, (p -s)(q -r)) of the equation eu -(p -s)(q -r)v = w and ECM to factor (p -s)(q -r) and to extract the value of p -s from the B-smooth part of (p -s)(q -r). Finally reusing Coppersmith's method, we can find p from the value of p -s.

We apply the new method to present a new attack on Demytko's scheme. In this scheme, the public exponent e and the private exponent d satisfy one of the four modular equations ed ≡ 1 (mod lcm(p + 1 ± t p , q + 1 ± t q )). This gives rise to an equation of the form eu -(p + 1 ± t p )(q + 1 ± t q )v = w. Let e = N β . Suppose that |u| < N δ , |w| < N γ , |t p | < N α and |t q | < N α with α < 1 4 and that p + 1 ± t p or q + 1 ± t q is B-smooth. Then applying the new method as for RSA, one can factor the RSA modulus N = pq.

The rest of this paper is organized as follows. In Section 2, we review Coppersmith's method, the theory of elliptic curves, Demytko's elliptic curve cryptosystem and the Elliptic Curve Method ECM for factorization. In Section 3, we present the new attack on RSA, and in Section 4, we present the new attack on Demytko's scheme. We conclude in Section 5.

L.3 The Attack on RSA

In this section, we present an attack on RSA when the public key (N, e) satisfies an equation eu -(p -s)(q -r)v = w with suitably small parameters u, v, w, r, s under the condition that one of the factors (p -s) or (q -r) is B-smooth for some ECM-efficiency bound B.

then one can find the product (p -s)(q -r) in polynomial time.

Proof. Suppose that N = pq is an RSA modulus and e is a public exponent satisfying eu -(p -s)(q -r)v = w. Since (p -s)(q -r) = N -pr -qs + rs, then -v(N -pr -qs + rs) -w ≡ 0 (mod e), which can be rewritten as v(pr + qs -rs) -N v -w ≡ 0 (mod e). Consider the polynomial f (x, y, z) = xy -N x + z, Then (x, y, z) = (v, pr + qs -rs, -w) is a solution of the modular polynomial equation f (x, y, z) ≡ 0 (mod e). The small solutions of this modular equation can be found by applying Coppersmith's method [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF]. Let m and t be two positive integers. Consider the polynomials

Let L denote the lattice spanned by the coefficient vectors of the polynomials G k,i 1 ,i 2 ,i 3 (Xx, Y y, Zz) and H k,i 1 ,i 2 ,i 3 (Xx, Y y, Zz). We can get a left triangular matrix if the ordering of the rows follows the ordering of the k's and the ordering of the the monomials of a polynomial follows the natural ordering following the i 1 's, then the i 2 's, then the i 3 's. Hence, using the triangular form This can be transformed to

On the other hand, since (p -s)(q -r) ≈ N and |w| < eu, we get

2 +α and Z = N γ . Then the target solution (x, y, z) satisfies |x| < X, |y| < Y and |z| < Z. Using the approximations of n e , n X , n Y , n Z and ω given in (L.2), the inequality e n e X n X Y n Y Z n Z < e mω can be transformed to (3τ +2)β+(3τ +2)(β+δ-1)+ 3τ 2 + 3τ + 1 1 2 + α +(3τ +1)γ < (6τ +3)β.

The optimal value for τ is

and, plugging this value in the former inequality, we obtain

and consequently

Under this condition, the LLL algorithm applied to the lattice L outputs three vectors v i , i = 1, 2, 3. These vectors represent the coefficients of three polynomials h i (Xx, Y y, Zz), i = 1, 2, 3 sharing the root (x, y, z) = (v, pr + qs + rs, -w). Then, applying Gröbner basis computations, we get the expected solution, from which we deduce (p-s)(q-r) = N -(pr+qs+rs). This terminates the proof.

Suppose that N = pq with unknown factorization and e satisfies an equation eu -(p -s)(q -r)v = w with the suitably small unknown parameters u, v, w, r and s. Then applying the method of Theorem L.3.1 to solve the equation eu -(p -s)(q -r)v = w, with the bounds

Then, using the Elliptic Curve Method with the bound B = N

Using the factorization of (p -s)(q -r), we can find the set of the factors d such that √ N -N α < d < √ 2N + N α . Such divisors are candidate for p -s, that is we p -s = d for one of these factors. Then by applying Coppersmith's Theorem L.2.2, we can find p using the correct candidate. For the divisor d = 6672224014662340178579721474326728185600, we apply Coppersmith's Theorem L.2.2 and find p = 6672224014662340178579721474326734152749.

Then q = N p = 6461903169309154483833797011785886506503.

L.4 Application to Demytko's Scheme

In this section, we show how to apply the technique of Theorem L.3.1 to break the Demytko scheme in some situations and provide a numerical example.

Appendix M

Lattice Attacks on the DGHV Homomorphic Encryption Scheme Mathematics in Computer Science, 2016 [START_REF] Nitaj | Lattice Attacks on the Homomorphic DGHV Scheme[END_REF] with Tajjeeddine Rachidi

Abstract :

In 2010, van Dijk, Gentry, Halevi, and Vaikuntanathan described the first fully homomorphic encryption over the integers, called DGHV. The scheme is based on a set of m public integers c i = pq i + r i , i = 1, • • • , m, where the integers p, q i and r i are secret. In this paper, we describe two lattice-based attacks on DGHV. The first attack is applicable when r 1 = 0 and the public integers c i satisfy a linear equation a 2 c 2 + . . . + a m c m = a 1 q 1 for suitably small integers a i , i = 2, . . . , m. The second attack works when the positive integers q i satisfy a linear equation a 1 q 1 + . . . + a m q m = 0 for suitably small integers a i , i = 1, . . . , m. We further apply our methods for the DGHV recommended parameters as specified in the original work of van Dijk, Gentry, Halevi, and Vaikuntanathan.

Finally, we get q 2 = c 2 -r 2 p = 2749849859281179089188599349348118845956161635,

The whole process, including Gröbner Basis computation, took less than one minute. Note that since a 2 c 2 +a 3 c 3 +a 4 c 4 ≡ 0 (mod p), the orthogonal attack of [START_REF] Van Dijk | Fully homomorphic encryption over the integers[END_REF] and [START_REF] Lepoint | Design and Implementation of Lattice-Based Cryptography[END_REF] is not applicable to this DGHV instance.

M.5 Our Second Lattice Attack on DGHV

In this section, we consider the situation where the DGHV public values are of the general form c i = pq i + r i , i = 1, . . . , m, and there exists a linear relation between the q i 's of the form a 1 q 1 + . . . + a m q m = 0. We show that it is possible to solve the equation and recover all the private parameters, when specific conditions on the size of the unknown coefficients a i , i = 1, . . . , m are fulfilled. then, one can find p, q 1 , . . . , q m , r 1 , . . . , r m in polynomial time.

Proof. Let c i = pq i + r i for i = 1, . . . , m with r i = 0. Then, there exist m integers a i , i = 1, . . . m such that a 1 q 1 + . . . + a m q m = 0. Combining the values of c i for i = 1, . . . , m, we get: • (m + 1) -m+1 2

• 2 m √ η-α .

In Table M.2, we present the upper bounds for α in terms of η and m under which our second method will solve the equation a 1 q 1 + . . . + a m q m = 0 and then find all the DGHV parameters. For all cases, we use C = 1, wich fullfils condition (M.10).

M.5.3 Experimental Results

For our second attack, we also experimented with 100 DHGV instances with various practical sizes of the parameters η, ρ, γ and m. When the conditions of Theorem M.5.1 are satisfied, we always succeeded in finding the solutions of our equations and recovered the secret parameters. We illustrate the steps of our attack through the following detailed example. Consider the following DHGV instance: