4 - Lattice-Based Integer Factorisation: An Introduction to Coppersmith’s Method

Summary

In Chapter 4, Lattice-Based Integer Factorisation: An Introduction to Coppersmith’s Method, Alexander May investigates the use of LLL to factor integers as pioneered by Coppersmith. Conceptually, Coppersmith’s method can be deceptively simple: given additional information about an integer to factor (e.g., the knowledge that an RSA key pair (N; e) has a small corresponding private exponent d), derive a system of equations with a small root that reveals the factorization and use LLL to find the small root. As a result, it becomes possible to explore exponentially sized search spaces, while preserving polynomial time by using the famous LLL lattice reduction algorithm. Yet, exploiting Coppersmith’s method in a cryptographic context optimally often involves a number of clever choices related to which system of equations to consider. At first, this is a tantalisingly annoying problem where the choice may appear obvious only in retrospect. May uses his extensive experience in improving the state of the art to explain the reasoning behind various applications in Chapter 4.