Implicit factorization of RSA moduli revisited (Short paper)

Abstract

In this paper, we revisit the problem of factoring RSA moduli with implicit hint, where primes of two RSA moduli share some number of middle bits. Suppose that for two n-bit RSA moduli N1 = p1q1 and N2 = p2q2, q1 and q2 are (αn)-bit primes, p1 and p2 share tn bits at positions from t1n to t2n = (t1 +t)n. Faugère et al. (PKC 2010) showed that when t ≥ 4α, one can factor N1 and N2 in polynomial time. In this paper, we improve this bound to t > 4α − 3α2 by presenting a new method of solving a homogeneous linear equation modulo unknown divisors. Our method is verified by experiments.