Factoring unbalanced moduli with known bits

Abstract

Let n = pq > q 3 be an rsa modulus. This note describes a lll-based method allowing to factor n given 2log2 q contiguous bits of p, irrespective to their position. A second method is presented, which needs fewer bits but whose length depends on the position of the known bit pattern. Finally, we introduce a somewhat surprising ad hoc method where two different known bit chunks, totalling 3/2 log2 q bits suffice to factor n. The technique underlines the danger of using unbalanced moduli on leaky hardware implementations. © 2010 Springer-Verlag.