Implicit factoring: On polynomial time factoring given only an implicit hint

Abstract

We address the problem of polynomial time factoring RSA moduli N 1 = p1q1 with the help of an oracle. As opposed to other approaches that require an oracle that explicitly outputs bits of p1,weuse an oracle that gives only implicit information about p1. Namely, our oracle outputs a different N2 = p2q 2 such that p1 and p2 share the t least significant bits. Surprisingly, this implicit information is already sufficient to efficiently factor N1, N2 provided that t is large enough. We then generalize this approach to more than one oracle query. © International Association for Cryptologic Research 2009.