A method for modulus decomposition of an RSA variant cryptographic system

Abstract

The application discloses a modulus decomposition method of an RSA variant cryptosystem, and classifies and discusses a public-private key pair of the RSA variant cryptosystem. 2 <ed<N 3 When the public-private key pair satisfies N 3 <ed<N 4 , the modulus N of the RSA is decomposed by using an enumeration method to continuously test a candidate value, finding a suitable k value to calculate a key equation, and by using a lattice theory analysis skill, an LLL algorithm to find a short vector in a lattice, a variant of a Coppersmith method and a direct application of an approximate integer common factor of a Howgrave-Graham algorithm to transform a modulus equation solving problem into a short vector solving problem in a lattice, and the modulus N of the RSA is decomposed. 12 The time complexity of the method for decomposing a polynomial is O(2log N). The application enriches the application of lattice cryptography on the RSA algorithm and improves the security of the variant RSA algorithm.

Description

Technical Field

[0001] This invention relates to the field of variant algorithm security, and specifically to a modulo factorization method for an RSA variant cryptosystem. Background Technology

[0002] Security analysis of cryptographic algorithms is an indispensable and crucial step in the design process; every new cryptographic algorithm requires security analysis. However, this work is relatively complex and difficult, and the security of many practical cryptographic algorithms has not yet been rigorously proven. Therefore, to ensure security during use, all cryptographic algorithms have a lifecycle. Cryptographic designers and experts estimate a period within which the algorithm should be relatively secure based on relevant research and technological development trends.

[0003] From a cryptanalysis perspective, the analysis of attacks on the RSA algorithm has been continuously evolving since its invention. Simply put, finding a user's private key is one method of attacking the RSA algorithm. When an attacker obtains the private key, communication between the user and others becomes insecure. The attacker can intercept encrypted communications and decrypt them to obtain the original plaintext. On the other hand, the integer factorization problem is also related to the security of the RSA algorithm, especially when some side-channel information is known. If the integer factorization problem is effectively solved, it means that an attacker can factorize the user's public key modulo N into p and q, and then calculate the user's private key d. At this point, regardless of how the public and private key pairs are chosen, the RSA algorithm is completely insecure.

[0004] Security analysis of the RSA algorithm helps in designing more reliable and secure public-key cryptography algorithms and in developing new cryptanalysis methods. Since its introduction, lattice analysis has become the primary method for security analysis of the RSA algorithm. The foundation of lattice analysis is lattice reduction algorithms, a rich mathematical tool whose in-depth study can facilitate the analysis of other public-key cryptography algorithms.

[0005] In practice, other RSA variants exist in specific implementations, designed to improve encryption and decryption efficiency, distribute resource consumption between the encryption and decryption ends, or defend against some known attacks. Although cryptographers have previously studied the RSA algorithm and its special cases (including some RSA variants), extensive and in-depth analysis remains lacking. Furthermore, the mathematical problems extracted from the security analysis of the RSA algorithm also lack further research. Therefore, utilizing lattice analysis techniques to analyze the security of RSA and its variants in both breadth and depth is not only of theoretical guiding significance but also of practical application value. Summary of the Invention

[0006] To enrich the application of lattice ciphers in the RSA algorithm and improve the security of variant RSA algorithms, this invention discloses a modulo factorization method for RSA variant cryptosystems, comprising the following steps:

[0007] Step 1: Study and analyze the RSA variant cryptosystem in the Gaussian integer field; set the modulus as N = p·q, where p and q are two prime numbers of the same bit size, p = |P|, q = |Q|, P and Q are the product of two Gaussian prime numbers of the same bit size, and give the public-private key pair (e,d);

[0008] Step 2, for different public-private key pair scenarios, for public-private key pair N 2 <ed<N 3 Proceed to step 3, for public / private key pair N 3 <ed<N 4 Proceed to step 4;

[0009] Step 3, satisfy condition N 2 <ed<N 3 The enumeration method is used to continuously test candidate values ​​to find a suitable k value to calculate the key equation in order to recover the factorization of N;

[0010] Step 4, condition N is satisfied. 3 <ed<N 4 By combining the LLL algorithm, lattice analysis techniques, and an improved Coppersmith method, and by applying the approximate integer common factorization based on the Howgrave-Graham algorithm, the modular equation solving problem is transformed into a short vector solving problem on a lattice to complete the decomposition of the RSA modulus N, in O(2log n) time. 12 The factorization of N is recovered within a time interval of N.

[0011] Furthermore, in step 1, the key equation of the RSA variant cryptosystem is: ed-k(|P|-1)(|Q|-1)=1, and the Euler totient function is: The key equation for the variant RSA algorithm after model removal is: ed-k(p 2 -1)(q 2 -1)=1.

[0012] Further, in step 1, the RSA variant cryptosystem includes a key generation algorithm, an encryption process, and a decryption process, wherein;

[0013] Key generation algorithm: randomly select a key that matches the key of the key generation algorithm. The coprime 'e' is used as the public key, and the calculation is performed. As the private key, the public key (N, e) is finally published, while the private key (p, q, d) needs to be kept secret;

[0014] Encryption process: Let e and d be two integers such that exists. Then, in the RSA scheme over the Gaussian integers, for a plaintext m ∈ Z[i], it is encrypted as c ≡ m e (mod N) to obtain the ciphertext c;

[0015] Decryption process: Let e and d be two integers such that exists. For a ciphertext c ∈ Z[i], it is decrypted as m ≡ c d (mod N) to obtain the plaintext m.

[0016] Furthermore, in step 1, in the RSA variant cryptosystem, for the parameter requirement q < p, the following estimations are obtained:

[0017] From the modulus N = p·q, when and only when does p + q achieve the minimum value Since q < p, the following estimations are obtained:

[0018] Based on the Euler's totient function the following estimations are given:

[0019]

[0020] Furthermore, in step 3, the enumeration method specifically includes the following steps:

[0021] Step S3-1, the equation based on the modular Euler's totient function of the public-private key pair is Then the modular equation becomes ed = 1 + k(N 2 - p 2 - q 2 + 1), k ∈ N;

[0022] Step S3-2, since From the estimation equation, it is obtained that the order of magnitude of is N[[ID=​​​​​​​​​​​​​​​​​​​​One of the six values is equal to k, where (i = 0, 1,..., 5); continuously test six candidate values and select the correct k value. For this k value, calculate:

[0027]

[0028] Obtain the modulus N, from which the running time for factoring N can be obtained as O(2log 2 N).

[0029] Furthermore, in step 4, based on ed - 1 = k(p 2 - 1)(q 2 - 1), let U = e·d - 1, s = p 2 + q 2 - 1, express U in terms of N and s, that is, U = k(N 2 - s). First, recover s from N and U, and then directly recover the factorization of N through s; obtain the modular equation of the Euler's totient function with respect to U At this time, the Euler's totient function becomes

[0030] Furthermore, step 4 includes the following steps:

[0031] Step S4 - 1, assume that the high - order bit of the known s is s0, let X be some integer, for a given |x0| < X, such that s = s0·X + x0, let Then the Euler's totient function becomes Obtain the following system of congruence equations:

[0032]

[0033]

[0034] Step S4 - 2, for 0 ≤ j ≤ m, i = 0, and for j = m, 1 ≤ i ≤ k, based on the above formula, give a polynomial about x:

[0035] g ij (x) = x i (x - N 2 + s0X) j U m-j

[0036] Step S4 - 3, fix the parameters m and k. Then for all previous (i, j), since x0 is an integer, substitute x = x0 into the above formula to obtain:

[0037]

[0038] Step S4 - 4, give the polynomial g ijIf we have a linear combination h(x) of x, then for any h(x), we have:

[0039] The goal is to find a non-zero h(x) with very small coefficients. If the coefficients of h(x) are sufficiently small, then for any integer x0, h(x0) = 0 holds true. Then, a root-finding algorithm is used to recover the integer x0, ultimately obtaining the factorization of N from x0. Given the polynomial h(x) = ∑h... i x i Let ||h(x)|| denote its coefficient vector h. i The Euclidean norm;

[0040] Step S4-5, solve for the polynomial:

[0041] Let h(x)∈Z[x], where h(x) is the sum of at most ω monomials; for |x0|≤X, we give the assumption And give the Euclidean norm of h(xX) and The size relationship, that is Then h(x0) = 0, rounded to the nearest integer.

[0042]

[0043] because Given h(x0) = 0.

[0044] Steps S4-6, construct the lattice:

[0045] From polynomial g ij The coefficient vectors of (xX) form a lattice L, and these coefficient vectors form a triangular basis of a full-rank lattice with dimension ω = m + k + 1; the determinant of the lattice is the product of its diagonal elements, from which we can derive:

[0046]

[0047] Step S4-7: Using the LLL theorem, we obtain a non-zero vector b whose norm is guaranteed to satisfy:

[0048]

[0049] Let vector b be the coefficient vector of some polynomial h(xX), then ||h(xX)|| = ||b||; the polynomial h(x) is g ij For any integer linear combination polynomial of (x), this means Using the LLL theorem, we obtain:

[0050]

[0051] in ω - 1 = m + k ≥ m, from which the following sufficient condition is obtained:

[0052] det L ≤ N 2mω 2 -2ω(ω-1)

[0053] Step S4 - 8, from the lattice expression and the inequality U < N 4 obtain:

[0054]

[0055] give the following conditions for X:

[0056]

[0057] Step S4 - 9, the goal is to maximize x0, so bind X on x0 to reduce the bits of search; for k = m, the value of the function γ(m, k) is the largest, when k = m, the boundary corresponding to X is:

[0058]

[0059] Step S4 - 10, since the running time of the LLL algorithm is a polynomial algorithm related to the lattice dimension and the lattice boundary size, given s0, such that s = s0·X + x0 and 0 ≤ x0 < X, the original algorithm recovers the factorization of N in the time polynomial in (2logN, m);

[0060] Take the largest Gaussian integer X that satisfies the X - boundary condition formula, use s = p 2 +q 2 - 1 ≤ 3N, obtain:

[0061]

[0062] Then, take m = [logN], the upper bound of s0 is a constant; then run the previous algorithm for each possible value of s0 (whether it is to loop the above steps 4 - 1 to 4 - 9), the correct s0 can recover the factorization of N; the running time depends on the lattice with dimension ω = 2m + 1, the time spent running LLL is B = O(N 4m ), where, since the LLL time is restricted by O(ω 6 log 3 B), so the factorization of N is recovered in O(2log 12 N).

[0063] Furthermore, in the said Step 4, when using L 2 to replace LLL, a running time of O(2log 9 N) is obtained.

[0064] The effective effects achieved by this invention are as follows: compared with the standard RSA algorithm, the modulus factorization method in the Gaussian integer field has an exponential increase in prime factors, an increase in the time complexity of calculating the modulus, and a higher security of the variant RSA algorithm. Attached Figure Description

[0065] Figure 1 This is a flowchart illustrating the modular decomposition method described in an embodiment of the present invention.

[0066] Figure 2 The polynomial g described in the embodiments of the present invention ij A schematic table of full-rank L for (xX).

[0067] Figure 3 This is a table illustrating the running time of decomposing N as described in this embodiment of the invention. Detailed Implementation

[0068] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings.

[0069] This invention studies and analyzes a variant RSA algorithm within the Gaussian integer domain. A cryptographic system for this variant RSA algorithm is presented, with the modulus N = |P|·|Q|, where P and Q are the product of two Gaussian primes of equal bit size, and P = a + ib, Q = a' + ib' (where a, b and a', b' represent the real and imaginary parts, respectively). Given two ordinary primes p = |P| and q = |Q|, a scheme for the quadratic exponentiation of the modulus N = p·q for the variant RSA algorithm is given. In this RSA scheme, a public-private key pair (e, d) is provided, such that...

[0070] The key equation for the variant RSA algorithm at this point is: de-k(|P|-1)(|Q|-1)=1, and the Euler's totient function in this variant RSA algorithm is: The key equation for the variant RSA algorithm after model removal is: ed-k(p 2 -1)(q 2 -1)=1.

[0071] Key generation algorithm: randomly select a key that matches the key of the key generation algorithm. The coprime 'e' is used as the public key, and the calculation is performed. Use this as your private key. Finally, publish your public key (N, e), while keeping your private key (p, q, d) secret.

[0072] Encryption process: Let e ​​and d be two integers such that... Yes, it exists. Then, in the RSA scheme over the Gaussian integer field, for plaintext m∈Z[i], use c≡m eEncrypted by (mod N) to obtain the ciphertext c.

[0073] Decryption process: Let e and d be two integers such that exists, and the ciphertext c ∈ Z[i]. Decrypt using m ≡ c d (mod N) to obtain the plaintext m.

[0074] Parameter requirements of the variant RSA algorithm: In the Gaussian integer domain, the modulus of the variant RSA algorithm is N = p·q, where N is the product of two ordinary prime numbers p = |P| and q = |Q| of the same bit size. To ensure the security of the variant RSA cryptographic algorithm, the following assumptions are now given: q < p. Therefore, the following estimates can be obtained:

[0075] Since the modulus is N = p·q, then it can be obtained that when and only when p + q reaches the minimum value Because q < p, the following estimates can be obtained:

[0076] Because the Euler's totient function of the variant algorithm is Therefore, the following estimates are given:

[0077]

[0078] The decomposition method of the public-private key pair of a variant RSA cryptosystem under two different conditions is as follows:

[0079] (1) Public-private key pair N 2 <ed < N 3 Decomposition method of the variant RSA scheme under the condition

[0080] The modulus is set to N = p·q, where p and q are two prime numbers of the same bit size, p = |P|, q = |Q|. The public-private key pair (e, d) is given and satisfies the condition N 2 <ed < N 3 . It is proposed to use the enumeration method to continuously test candidate values to find a suitable k value to calculate the key equation, and the factorization of N can be recovered.

[0081] Step S1.1: Since the equation of the modular Euler's totient function for the RSA public-private key pair is Then the modular equation becomes ed = 1 + k(N 2 - p 2 - q 2 + 1), k ∈ N.

[0082] Step S1.2: Since At this time, as can be seen from (1) The order of magnitude of is N2 Therefore, we define an underestimation of k. Therefore, we can conclude that:

[0083]

[0084] Step S1.3: Using (1), the following conclusions can be drawn:

[0085]

[0086] Calculation process:

[0087] Due to ed <N 3 Then we can get therefore, Among the six values ​​in the set, there exists a value equal to k, where (i = 0, 1, ..., 5). This allows us to continuously test these six candidate values ​​and select the correct k value. For this k value, we can calculate:

[0088]

[0089] Obtaining the modulus N, this method only uses elementary arithmetic for integers of size O(2logN). Therefore, the running time for factoring N is O(2logN). 2 N).

[0090] (2) Public-private key pair N 3 <ed<N 4 Variant RSA scheme decomposition method under the condition

[0091] Based on the research of conclusions derived from lattice theory and the LLL algorithm, Coppersmith proposed a method for finding the smallest roots of modular equations of univariate polynomials, which has wide applications in the field of public-key cryptography. May, HowgraveGraham, and others studied, analyzed, and extended this method, reinterpreting and improving it to form a standardized approach. Later, the Coppersmith method became a heuristic, used in subsequent research on the RSA algorithm, and it can also be extended to multivariate cases.

[0092] The following is a decomposition of the polynomial modulus N = |P|·|Q| of the variant RSA algorithm in the Gaussian integer field. The algorithm for the decomposition process is to complete the decomposition of the RSA modulus N by using a variant of the Coppersmith method and the direct application of the approximate integer common factor of the Howgrave-Graham algorithm.

[0093] Let the RSA modulus be N = p·q, which is the product of two prime numbers of the same bit size, where p = |P| and q = |Q|. Given the key pair (e, d) such that Then a new condition N is given 3 <ed < N 4 , the factorization of N can be recovered in O(2log 12 N) time.

[0094] Since ed - 1 = k(p 2 - 1)(q 2 - 1), let U = e·d - 1 and s = p 2 + q 2 - 1. Then U can be expressed in terms of N and s, that is, U = k(N 2 - s). First, s can be recovered from N and U, and then the factorization of N can be directly recovered through s. From the above expressions, a modular equation of the Euler's totient function with respect to U can be obtained At this time, the Euler's totient function becomes In this way, the factorization of N can be recovered by first recovering s. The specific implementation steps are as follows:

[0095] Step S2.1: Assume that the high-order bits of s are s0. Let X be an integer. For a given |x0| < X such that s = s0·X + x0, let Then the Euler's totient function becomes So the following system of congruence equations can be obtained:

[0096]

[0097]

[0098] Step S2.2: For 0 ≤ j ≤ m, i = 0, and for j = m, 1 ≤ i ≤ k, based on (3) and (4), a polynomial about x can be given as follows:

[0099] g ij (x) = x i (x - N 2 + s0X) j U m-j

[0100] Step S2.3: Fix the parameters m and k. Then for all previous (i, j), since x0 is an integer, substituting x = x0, according to the conclusions from (3) and (4), we can get:

[0101]

[0102] Step S2.4: Give the polynomial g ij If we have a linear combination h(x) of x, then for any h(x), we have:

[0103] The goal is to find a non-zero h(x) with very small coefficients. If the coefficients of h(x) are sufficiently small, then for any integer x0, h(x0) = 0 holds true. Then, any standard root-finding algorithm can be used to recover the integer x0, ultimately obtaining the factorization of N from x0, given the polynomial h(x) = ∑h0 i x i Let ||h(x)|| denote its coefficient vector h. i The Euclidean norm.

[0104] Step S2.5: Solve the polynomial:

[0105] Let h(x)∈Z[x], where h(x) is the sum of at most ω monomials. For |x0|≤X, we give the assumption... And give the Euclidean norm of h(xX) and The size relationship, that is Then h(x0) = 0, keeping the integer part.

[0106]

[0107]

[0108] because Therefore, we can give h(x0) = 0 here.

[0109] Step S2.6, Constructing the Lattice:

[0110] From polynomial g ij If the coefficient vectors of (xX) form a lattice L, then these coefficient vectors form a triangular basis of a full-rank lattice with dimension ω = m + k + 1 (see...). Figure 2 The determinant of a lattice is the product of its diagonal elements, from which we can deduce:

[0111]

[0112] Step S2.7: Using the LLL theorem, we obtain a non-zero vector b whose norm is guaranteed to satisfy:

[0113]

[0114] If vector b is the coefficient vector of a polynomial h(xX), then we have: ||h(xX)|| = ||b||. The polynomial h(x) is g ij For any integer linear combination polynomial of (x), this means It can be obtained by using the LLL theorem that:

[0115]

[0116] where ω - 1 = m + k ≥ m, from which the following sufficient condition can be obtained:

[0117] det L ≤ N 2mω 2 -2ω(ω-1)

[0118] Step S2.8, from (5) and the inequality U < N 4 it can be seen that:

[0119]

[0120] Then the following conditions for X can be given:

[0121]

[0122] Step S2.9, the goal is to maximize x0, so bind X on x0, which can reduce the bits of search. For k = m, the value of the function γ(m, k) is the largest. When k = m, the corresponding boundary of X is:

[0123]

[0124] Calculation process:

[0125] Since the running time of the LLL algorithm is a polynomial algorithm related to the lattice dimension and the lattice boundary size, given s0, such that s = s0·X + x0 and 0 ≤ x0 < X, the original algorithm recovers the factorization of N in the time polynomial in (2logN, m).

[0126] Finally, take the largest Gaussian integer X that satisfies (6), and use s = p 2 +q 2 -1 ≤ 3N, to obtain:

[0127]

[0128] Then, take m = [logN], and the upper bound of s0 is a constant. Then run the LLL algorithm for each possible value of s0, and the correct s0 can recover the factorization of N. The running time depends on the lattice with dimension ω = 2m + 1, and the time spent on running LLL is B = O(N 4m ), where, since the LLL time is restricted by O(ω 6 log 3 B), so this algorithm is in O(2log 12The factorization of N was recovered in N). If L was used 2 When using a variable instead of LLL, an O(2log) value is obtained. 9 The running time for factoring N is O(2logN). This method only uses elementary arithmetic for integers of size O(2logN), therefore, the running time for factoring N is O(2logN). 2 N).

[0129] After a detailed description and security demonstration of the proposed solution, simulation analysis was performed. To test the computational cost of the method, it was implemented on both the Edison platform and a MacBook Pro. The implementation of the method is described below, along with performance analysis.

[0130] The modular decomposition method described above was implemented using Shoup's NTL library's LLL implementation. First, in Figure 2 The table describes experiments with prime factors of the same bit size, e·d≈N 4 Suppose there are l higher-order bits s = p 2 +q 2 The observed runtime is the single execution time t, and then the total runtime estimate of N is decomposed when T≈2. l ·t.

[0131] When e·d≈N 4 At this time, it is necessary to completely search for the number of bits and lattice dimension of N, observe the running time of a single LLL reduction t, and estimate the total running time T. The experiment was conducted on a 1.6GHz computer running Windows 2000 / Cygwin.

[0132] Depend on Figure 3 The table shows that, given a key pair (e, d), factoring N takes several days for a 512-bit modulus and several years for a 1024-bit modulus. This contrasts with Miller's algorithm, which takes only a fraction of the time for a 1024-bit modulus.

[0133] By analyzing the time complexity and security of the variant RSA cryptosystem in the Gaussian integer domain, it is found that the time complexity of factoring the modulus of the variant RSA is higher in the Gaussian integer domain. Therefore, it can be concluded that the variant RSA is more secure and more difficult to attack. Using the Coppersmith method, a deterministic polynomial-time algorithm for finding the smallest root of a univariate modular polynomial equation is presented. Combining the LLL algorithm and lattice analysis techniques, the modulus factorization of the variant RSA algorithm is completed when the public-private key pair is known. In the construction of the variant RSA algorithm, given the public-private key pair (e,d), when the boundary condition N is given... 2 <ed<N 3At that time, a suitable value of k is found based on the continued fraction calculation so that the modulus N = P·Q of the variant RSA can be decomposed within a certain time. When the boundary condition is N 3 <ed<N 4 In this case, the modification of the modulus of the variant RSA algorithm in polynomial time is accomplished through a variant of the Coppersmith method, and the Howgrave-Graham algorithm is directly applied to the approximate integer common factorization of N. Through rigorous proof under different constraints, it can be concluded that, in the Gaussian integer field, given a deterministic algorithm, the factorization of the modulus N of the variant RSA algorithm can be recovered in polynomial time.

[0134] The above description is only a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. Any equivalent modifications or changes made by those skilled in the art based on the content disclosed in the present invention should be included within the scope of protection set forth in the claims.

Claims

1. A method for modular factorization of a variant RSA cryptosystem, characterized in that: It includes the following steps: Step 1: Study and analyze the RSA variant cryptosystem within the Gaussian integer field; set the modulus to... Where p and q are two prime numbers of the same size. , P and Q are the product of two Gaussian primes of the same bit size, and the public-private key pair (e, d) is given. In step 1, the RSA variant cryptosystem includes a key generation algorithm, an encryption process, and a decryption process, where; Key generation algorithm: randomly select a key that matches the key of the key generation algorithm. The coprime 'e' is used as the public key, and the calculation is performed. As the private key, the public key (N, e) is finally published, while the private key (p, q, d) needs to be kept secret; Encryption process: Let e ​​and d be two integers such that... There exists, and then, in the RSA scheme over the Gaussian integer field, the plaintext m∈Z[i] is used... Encryption yields ciphertext c; Decryption process: Let e ​​and d be two integers such that... There exists a ciphertext c∈Z[i], using Decryption yields plaintext m; Step 2, for different public-private key pair scenarios, for the public-private key pair... Proceed to step 3, for the public / private key pair Proceed to step 4; Step 3, meet the conditions The enumeration method is used to continuously test candidate values ​​to find a suitable k value to calculate the key equation in order to recover the factorization of N; Step 4, conditions are met By combining the LLL algorithm, lattice analysis techniques, and an improved Coppersmith method, and by applying the approximate integer common factorization based on the Howgrave-Graham algorithm, the modular equation solving problem is transformed into a short vector solving problem on a lattice to complete the decomposition of the RSA modulus N, in O(2log n) time. 12 The factorization of N can be recovered in time N, and communication between the user and others is still guaranteed to be secure even when an attacker obtains the user's private key.

2. The modulus factorization method for an RSA variant cryptosystem according to claim 1, characterized in that: In step 1, the key equation of the RSA variant cryptosystem is: Euler's totient function is: The key equation for the variant RSA algorithm after model removal is: .

3. The modulus factorization method for an RSA variant cryptosystem according to claim 1, characterized in that: In step 1, the RSA variant cryptosystem has parameter requirements. The following estimates were obtained: ; From the modulus Obtain, if and only if hour, Get the minimum value ,because Therefore, the following estimate is obtained: ; Based on Euler's totient function The following estimates are given: 。 4. The modulus factorization method for an RSA variant cryptosystem according to claim 1, characterized in that: In step 3, the enumeration method specifically includes the following steps: Step S3-1, the equation based on the modulo Euler totient function of the public-private key pair is: Then the demodulation equation becomes ; Step S3-2, because From the estimation equation, we obtain The order of magnitude is N 2 Define an underestimation of k. Therefore, we can conclude that: In step S3-3, it is obtained by using the estimation equation: Step S3-4, since ed < N 3 ,get ,therefore, Among the six values ​​in the set, there exists a value equal to k, where (i = 0, 1, ..., 5); test six candidate values ​​consecutively, select the correct k value, and for this k value, calculate: Given the modulus N, we can deduce that the running time for decomposing N is O(2log N). 2 N).

5. The modulus factorization method for an RSA variant cryptosystem according to claim 1, characterized in that: In step 4, based on ,make , U is represented by N and s, that is First, recover s from N and U, and then directly recover the factorization of N through s; thus deriving the modular equation of U with respect to Euler's totient function. At this point, Euler's totient function becomes .

6. The modulus factorization method for an RSA variant cryptosystem according to claim 5, characterized in that: Step 4 includes the following steps: Step S4-1, let the higher-order bits of s be s0, let X be an integer, for a given |x0| < X, such that , let , then the Euler's totient function becomes , and the following system of congruence equations is obtained: In step S4-2, for 0 ≤ j ≤ m, i = 0, and for j = m, 1 ≤ i ≤ k, based on the above formula, a polynomial about x is given as follows: In step S4-3, when the parameters m and k are fixed, then for all previous (i, j), since x0 is an integer, substituting x = x0 into the above formula, we get: Step S4-4, give the polynomial g ij If we have a linear combination h(x) of x, then for any h(x), we have: ; The goal is to find a non-zero h(x) with very small coefficients. If the coefficients of h(x) are sufficiently small, then for any integer x0, h(x0) = 0 holds true. Then, a root-finding algorithm is used to recover the integer x0, ultimately obtaining the factorization of N from x0, given the polynomial. Let ||h(x)|| denote its coefficient vector h. i The Euclidean norm; In step S4-5, solve the polynomial: set up h(x) is the sum of at most ω monomials; for |x0|≤X, the following assumptions are given. And give the Euclidean norm of h(xX) and The size relationship, that is Then h(x0) = 0, rounded to the nearest integer. because Given h(x0) = 0; In step S4-6, construct a lattice: From polynomial g ij The coefficient vectors of (xX) form a lattice L, and these coefficient vectors form a triangular basis of a full-rank lattice with dimension ω = m + k + 1; the determinant of the lattice is the product of its diagonal elements, from which we can derive: In step S4-7, using the LLL theorem, a non-zero vector b is obtained, and its norm is guaranteed to satisfy: Let vector b be the coefficient vector of some polynomial h(xX), then ||h(xX)|| = ||b||; the polynomial h(x) is g ij For any integer linear combination polynomial of (x), this means ; Obtained by using the LLL theorem: in , ω−1=m+k≥m, from which we obtain the following sufficient condition: Step S4-8, based on the expression of the lattice and the inequality U <N 4 get: The following conditions for X are given: ， In step S4-9, the goal is to maximize x0, so the bound X on x0 is used to reduce the bits of search; for k = m, the value of the function γ(m, k) is the largest, and when k = m, the corresponding boundary of X is: In step S4-10, since the running time of the LLL algorithm is a polynomial algorithm related to the lattice dimension and the lattice boundary size, given s0, such that s = s0·X + x0 and 0 ≤ x0 < X, the original algorithm recovers the factorization of N in time polynomial in (2logN, m); Find the largest Gaussian integer X that satisfies the boundary condition formula for X, and use s=p 2 +q 2 -1 ≤ 3N, therefore: Then, taking m = [log N], we obtain an upper bound of s0 that is a constant; then, for each possible value of s0, we run the previous algorithm (i.e., loop through steps 4-1 to 4-9 above). A correct s0 can recover the factorization of N; the running time depends on the lattice with dimension ω = 2m + 1, and the time taken to run LLL is B = O(N). 4m ), where, due to the LLL time being affected by O(ω) 6 log 3 B) Restriction, therefore in O(2log 12 The factorization of N was recovered in N).

7. The modulus factorization method for an RSA variant cryptosystem according to claim 6, characterized in that: In step 4, L was used. 2 When replacing LLL, an O(2log) value is obtained. 9 The runtime of N).

Images