Finding small solutions of the equation $ \mathit{{Bx-Ay = z}} $ and its applications to cryptanalysis of the RSA cryptosystem

Abstract

<p style='text-indent:20px;'>In this paper, we study the condition of finding small solutions <inline-formula><tex-math id="M10">\begin{document}$ (x,y,z) = (x_0, y_0, z_0) $\end{document}</tex-math></inline-formula> of the equation <inline-formula><tex-math id="M11">\begin{document}$ Bx-Ay = z $\end{document}</tex-math></inline-formula>. The framework is derived from Wiener's small private exponent attack on RSA and May-Ritzenhofen's investigation about the implicit factorization problem, both of which can be generalized to solve the above equation. We show that these two methods, together with Coppersmith's method, are equivalent for solving <inline-formula><tex-math id="M12">\begin{document}$ Bx-Ay = z $\end{document}</tex-math></inline-formula> in the general case. Then based on Coppersmith's method, we present two improvements for solving <inline-formula><tex-math id="M13">\begin{document}$ Bx-Ay = z $\end{document}</tex-math></inline-formula> in some special cases. The first improvement pays attention to the case where either <inline-formula><tex-math id="M14">\begin{document}$ \gcd(x_0,z_0,A) $\end{document}</tex-math></inline-formula> or <inline-formula><tex-math id="M15">\begin{document}$ \gcd(y_0,z_0,B) $\end{document}</tex-math></inline-formula> is large enough. As the applications of this improvement, we propose some new cryptanalysis of RSA, such as new results about the generalized implicit factorization problem, attacks with known bits of the prime factor, and so on.