Factoring N = prqs for large r and s

Abstract

Boneh et al. showed at Crypto 99 that moduli of the form N = prq can be factored in polynomial time when r ≃ logp. Their algorithm is based on Coppersmith’s technique for finding small roots of polynomial equations. In this paper we show that N = pr qs can also be factored in polynomial time when r or s is at least (log p)3; therefore we identify a new class of integers that can be efficiently factored. We also generalize our algorithm to moduli with k prime factors N =∏ki=1 prii; we show that a non-trivial factor of N can be extracted in polynomial-time if one of the exponents ri is large enough.