Algorithms for CRT-variant of Approximate Greatest Common Divisor Problem

Previous works

In order to solve the CCK-ACD problem, several naive methods are suggested. Their main idea was to exploit the feature of the problem that the error terms are relatively small and the product of the secret primes is given. In other words, one can try a brute-force attack to recover a secret prime p_i from a multiple N = ∏i=0np_i and an sample of CCK-ACD represented by b = p_i ⋅ q_i+ r_i for some fixed i, where an integer r_i ∈ (−2^ρ, 2^ρ) except i = 0. The method is to compute the greatest common divisor between (GCD) b − a and N for all integers a ∈ (−2^ρ, 2^ρ). It would have time complexity Õ(2^ρ), so ρ should be set to Ω(λ) for the security parameter λ. Furthermore, [3] and [7] that were proposed as the variants of exhaustive search to solve (P)ACD in Õ(2^ρ/2) time complexity, can be applied to solve the CCK-ACD problem for the feature mentioned previously. In addition, one can also use the factorization with the elliptic curve method to find a factor of N in 2O~(η) time complexity, where η is the log-size of p_i. Thus, η should be set to Ω(λ²) for the security parameter λ.

As another trial to solve CCK-ACD, authors in [14] considered well-known algorithms for solving PACD such as orthogonal lattice attack method (OLA) and simultaneous Diophantine approximation (SDA) [6, 12, 16, 19] in the context of CCK-ACD. The SDA and OLA make use of a lattice reduction algorithm for a specific lattice whose entries consist of the given PACD samples and a multiple N = ∏i=0np_i. If one can obtain a short vector from the lattice by the lattice reduction algorithm, it leads to a solution of the PACD problem which utilizes the coordinates of the vector. Since these algorithms for (P)ACD have time complexity depending on η and γ, one can expect that the expansion of the algorithms to the CCK-ACD problem will provide answers to the main question.

However, if a lattice as similar to SDA and OLA is being constructed to solve CCK-ACD, there exist several short vectors of similar length in the lattice due to the symmetry of p_i. Thus if short vector from the lattice by a lattice reduction algorithm is a short linear combination of some of these vectors, one cannot extract information on a certain prime p_i from the vector.

Independent work

Recently, Coron and Pereira [10] proposed an algorithm to solve the multi-prime ACD problem, which is the same as the ‘search’ CCK-ACD problem in this paper. The main idea of the attack is also the same as our SDA-style algorithm that combines the SDA with algebraic steps from the Cheon et al. [5]. In this paper, we also propose another OLA-style algorithm to solve ‘decisional’ CCK-ACD problem using OLA with a new distinguisher determinant.

1.1 Our Work

In this paper, we propose two mathematical algorithms to solve the CCK-ACD problem by extending the OLA and SDA methods that are well-known for solving the ACD problem using lattice technique. Both algorithms take the same time complexity 2Oγ(η−ρ)2 up to polynomial factors for the bit-size of samples γ, secret primes η and error ρ. Our algorithms are the first algorithms related to η and γ for solving the CCK-ACD problem.

Let b_j be a CCK-ACD sample of b_j ≡ r_ij mod p_i for 1 ≤ j ≤ k and 0 ≤ i ≤ n. Let b and r_i be a vector (b_j) and (r_ij), respectively. Technically, the first step of the classical OLA algorithm on input b_j is to compute a lattice ΛN⊥ (b), which is a set of orthogonal vectors to b over ℕ_N. Similarly, one can define a lattice Λ^⊥ ({r₀, ⋯, r_n}), which is a set of orthogonal vectors to r_i for all i over the integers. Then we have

It implies that the size of k − n − 1 shortest vectors of ΛN⊥ (b) is less than that of Λ^⊥ ({r₀, ⋯, r_n}). The classical OLA algorithm assumes that the k − n − 1 shortest vectors is a generator of Λ^⊥ ({r₀, ⋯, r_n}). Even more, the algorithm expects that k − n − 1 short vectors become a generator. So finding k − n − 1 short vectors is likely to lead us to recover the lattice Λ^⊥ ({r₀, ⋯, r_n}).

However, one problem might arise after finding those short vectors. In the case of PACD, (i.e n = 1), the recovered lattice has rank two and ∥r₁∥ ≪ ∥r₀∥. So we can obtain the vector r₁ easily. Then, the next step is to recover the secret integer p₁ by computing the GCD between b_j − r_j1} and N = p₀ ⋅ p₁. If the last step reveals a non-trivial factor of N, we can conclude that the b_j’s are PACD samples. Unfortunately, in the case of CCK-ACD, the classical OLA algorithm faces a hard task to recover the exact vector r_i except for small n since a short vector from the lattice would be a short linear combination of several r_i’s. Instead, we employ a determinant of the lattice as a new distinguisher to solve the decision CCK-ACD problem. We show that a sub-lattice of the output lattice of the classic OLA has determinant of a different-sized depending on the type of inputs. Then, computation of a determinant enables us to avoid the obstacle to find the exact vector r_i. The overall time complexity heavily depends on the cost of a lattice reduction to find a short vector. Therefore, the time complexity shall be asymptotically same to the classical one. For more details, please refer to Section 3.

We also propose a SDA-style algorithm to find all secret parameters in the CCK-ACD problem beyond the decision problem. The algorithm consists of two steps; find a short vector of certain lattice using a lattice reduction algorithm and then recover the factors p₁, ⋯, p_n by employing the Cheon et al.’s technique [5]. More precisely, we consider a column lattice generated by the following matrix:

According to the original SDA approach, this lattice includes a short vector of the form (N/p_i, r_1i ⋅ N/p_i, …, r_ki ⋅ N/p_i) for all i. In the case of n = 1, (i.e. PACD problem), the lattice has only one short vector and the first entry is a multiple of N/p₁. So it allows us to factorize N. When it comes to the CCK-ACD problem, any short vector is a linear combination of the vectors and it would not be a multiple of nontrivial factor of N. It means that the first entry of a short vector that we obtain is an integer of the form ∑i=1nc_i ⋅ N/p_i for some small integers c_i. In order to use the integer, we should factor in another well-known algorithm. Namely, we would like to cite a technique introduced in [5]. The reference we cite from [5] allows the linear summation of N/p_i to be called a dual instance. This instance allows to convert modulo equations into integer equations by exploiting the CRT properties of the CCK-ACD samples and its relation to dual instance. Therefore, it leads to recover N/p_i for all i. The complexity of the new algorithm primarily depends on the first step, so it takes time complexity as stated above. For more details, please refer to Section 4.

We provide experimental results to guarantee that our algorithms work well both in theoretical and experimental terms under the various parameters of CCK-ACD. We observe the OLA is more practical than SDA while the asymptotic complexities are the same.

Organization

In Section 2, we introduce preliminary information related to the lattice. Next, we revisit the OLA to solve the CCK-ACD problem in Section 3. Also, we extend the SDA algorithm in the context of CCK-ACD and propose the first algorithm which recovers all secret primes p_i’s of the CCK-ACD problem in Section 4. In addition, we present some experimental results for our algorithms in Section 5.

Notation

Throughout this paper, we use a ← A to denote the operation by uniformly choosing an element a from a finite set A or generating a sample according to a distribution A. We let ℤ_q denote the set ℤ ∩ (−q/2, q/2] for the positive integer q. We use the notation [t]_p to denote the integer in ℤ_p congruent to t mod p. We define CRT_{(p1,p2,…,pn)}(r₁, r₂, …, r_n) (or abbreviated as CRT_(pi) (r_i)) for pairwise co-prime integers p₁, p₂, …, p_n as the integer in −12∏i=1npi,12∏i=1npi congruent to r_i in the modulus p_i for each i ∈ {1, 2, …, n}.

We use bold letters to denote vectors or matrices and denote the set of all m × n matrices over ℤ by ℤ^m×n. For matrix A, we denote the transpose of A by A^T and denote the i-th row vector of A by [A]_i. When A = (a_i,j) ∈ ℤ^m×n is given, we define the infinite norm ∥A∥_∞ as max1≤j≤n∑i=1n∣ai,j∣ and use the notation A mod N to denote the matrix ([a_i,j]_N) ∈ ℤ^m×n. We denote by diag(a₁, …, a_n) the diagonal matrix with diagonal coefficients a₁, …, a_n. When b is an integral matrix, we define size(b) as the logarithm of the largest entries of b.

For a vector v = (v₁, …, v_n), we define the ℓ₂-norm ∥v∥₂ (or abbreviated as ∥v∥) and ℓ₁-norm ∥v∥₁ as ∑i=1nvi2  and  ∑i=1n∣vi∣, respectively.

2.1 Lattices

A lattice Λ is a discrete additive subgroup of ℝⁿ. We call a set of linearly independent vectors b = {b₁, b₂, ⋯, b_m} ⊂ ℝⁿ a basis of a lattice Λ if Λ is the set of all ℤ-linear combinations of the vectors b₁, b₂, ⋯, b_m. We denote such lattice Λ generated by the basis b by Λ(b). We sometimes use the notation Λ as abbreviated, instead of Λ(b). In particular, when a lattice Λ is a subset of ℤⁿ, it is called an integral lattice. In this work, we only take into account the integral lattice and regard a lattice as an integral lattice without special mention. If we regard a basis b = {b₁, b₂, ⋯, b_m} of lattice Λ as a matrix whose column vectors consist of vectors b_i for 1 ≤ i ≤ m, b is called a basis matrix of Λ. The rank and determinant of lattice Λ is defined as m and det(Λ)=det(bTb) for any basis matrix b, respectively. When n = m, this lattice is called a full-rank lattice and det (Λ) = det (b) holds. Throughout this paper, we denote lattice Λ whose basis vectors are b₁, b₂, ⋯, b_m as Λ = 〈b₁, b₂, ⋯, b_m〉.

It is known that for a lattice Λ = Λ(b) ∈ ℝⁿ with basis b = {b₁, b₂, ⋯, b_m}, the following premise holds:

In addition, when a set of column vectors u = {u₁, u₂, ⋯, u_k} ⊂ ℤⁿ is given, we define the orthogonal lattices

Successive Minima

Let Λ be a lattice of rank n. The successive minima of Λ are λ₁, ⋯, λ_n ∈ ℝ and λ_i is minimal for any 1 ≤ i ≤ n such that there exist i linearly independent vectors v₁, …, v_i ∈ Λ with ∥v_j∥ ≤ λ_i for 1 ≤ j ≤ i.

In order to reduce the size of successive minima, the Gaussian Heuristic [1] is deemed effective.

Gaussian Heuristic

Let Λ be a rank-n lattice. The Gaussian Heuristic states that the size of successive minima of Λ is approximately as follows.

Ajtai showed that the above equation holds for a random lattice with overwhelming probability [1].

Finding a short vector of a lattice is essential in our attack. There are some algorithms to find a short vector of a lattice, which is called lattice reduction algorithms.

Lattice Reduction Algorithm

The LLL algorithm [17] and the BKZ algorithm [15] are well-known lattice reduction algorithms. We mainly use BKZ algorithms to find an approximately short vector of a lattice. According to [15], the block size β of the BKZ algorithm determines how short should the output vector of the BKZ algorithm be. With the BKZ algorithm to the rank-n lattice Λ with basis matrix b, we can achieve a short vector v in poly(n, size(b)) ⋅ 𝓒_HKZ(β) times which satisfies the following

where γ_β ≤ β is the Hermite constant of a rank-β lattice and 𝓒_HKZ(β) denotes the time spent to get the shortest vector of a rank-β lattice and can be regarded as 2^O(β).

In the case of LLL algorithm, according to [17], the LLL algorithm upon the rank-n lattice Λ with basis matrix B gives an LLL-reduced basis {b₁, ⋯, b_n in poly(n, size(b)) times which satisfies the following

In particular, it is known that a LLL-reduced basis {b₁, b₂, ⋯, b_m} ⊂ ℝⁿ with δ = 1/4 + 1/2 ≈ 0.957 for a lattice Λ, the following holds

when we let {b₁^*, ⋯ b_m^*} be the Gram-Schmidt orthogonalization.

For the convenience of calculation, throughout this paper, we use 𝓐_δ to denote a lattice reduction whose output contains a short vector v with Euclidean norm less than δⁿ ⋅ det(Λ)^1/n or δ²ⁿ ⋅ λ₁ (Λ) for an n-dimensional lattice Λ instead of 2(γβ)n−12(β−1)+32⋅(detΛ)1/n or 4(γβ)n−1β−1+3⋅λ1(Λ), respectively. In this case, the root Hermite factor δ is achieved in time 2^O(1/logδ) ⋅ poly(k) by the BKZ algorithm with block size β=Θ(1log⁡δ).

From now on, we would like to present the formal definition of the CCK-ACD problem, which is a major concern of this paper.

In the CCK-ACD problem, we use r_0,j to denote b_j mod p₀ for each j ∈ {1, ⋯, k}, where b_j ∈ 𝓓_γ,η,ρ,n(p_i)’s are given as CCK-ACD samples. We remark that r_0,j may not be small, unlike other r_i,j for i ∈ {1, ⋯, n}.

3.0.1 Analysis of CCK-ACD instances

Assume that we have k CCK-ACD samples {b_j = CRT_(pi) (r_i,j)}_1≤j≤k with N = ∏i=0np_i, and let b = (b₁, ⋯, b_k)^T, r_i = (r_i,1, ⋯, r_i,k)^T for 0 ≤ i ≤ n.

The first step of OLA, which is described in [9, Section 5.1], is to find the set of short vectors {u₁, ⋯, u_k−n−1} in a k-dimensional lattice

Since b_j ≡ r_i,j mod N, we observe the relations using the CRT structure

If a vector u ∈ ℤ^k satisfies 〈u, r_i〉 = 0 in integers for all i = 0, ⋯, n, then 〈u, b〉 ≡ 0 mod N because of the above relations. Thus, it holds that

Moreover, we observe λi(ΛN⊥(b))≤λi(Λ⊥({r0,⋯,rn})) by the definition of successive minima for all 1 ≤ i ≤ k − n − 1.

We assume the Gaussian heuristic holds on the lattice Λ^⊥ (r₀, ⋯, r_n) since all components of r_i with 0 ≤ i ≤ n are uniformly chosen from each set. Therefore, it holds that

for all i = 1, 2, ⋯, k − n − 1. Note that we omit the small values including log k for the convenience of writing.

We aim at recovering generators of Λ^⊥ (r₀, ⋯, r_n). To obtain such vectors u_j’s, we run a lattice reduction algorithm 𝓐_δ with root Hermite factor δ on the lattice ΛN⊥ (b). By the approximate factor δ of a lattice reduction algorithm 𝓐_δ, the j-th output vector u_j of 𝓐_δ on the lattice ΛN⊥ (b) satisfies ∥u_j ∥ ≤ δ^2k ⋅ λ_j (ΛN⊥ (b)). Thus, for all j = 1, 2, ⋯, k − n − 1, w_j is bounded as follows

We now argue that the vector u_j is in Λ^⊥ (r₀, ⋯, r_n) under some condition. Since we know ∥ r_i∥ ≤ k ⋅ 2^ρ, it holds for 1 ≤ i ≤ n, 1 ≤ j ≤ k − n − 1

The last value of the equation includes log k, which is however much smaller than the current value. Therefore, for simplicity purposes, we omit this term.

By the CRT construction, we have 〈u_j, b〉 ≡_pi 〈u_j, r_i〉 and it is zero in modulo p_i for all i. Since p_i’s are η-bit primes, we can therefore ensure the vector u_j ∈ ΛN⊥ (b) if |〈u_j, r_i〉| < p_i/2 for all i. This condition can be written as

When we choose k − n − 1 = γ2log⁡δ and apply the AM-GM inequality, it is enough to satisfy log δ as following inequality

Therefore, when we obtain k = n + 1 + γ2log⁡δ CCK-ACD samples and choose δ satisfying log δ < (η−ρ)28γ, |〈u_j, r_i〉| ≤ p_i /2 is established for any 1 ≤ i ≤ n. Thus, {u_j}_{1≤j≤k−n−1} are the generator set of Λ^⊥ (r₀, ⋯, r_n) under the condition.

The overall time complexity to recover the generator of Λ^⊥ (r₀, ⋯, r_n) is 2Oγ(η−ρ)2 ⋅ poly(k) = 2Oγ(η−ρ)2 up to polynomial factors.

As the second step, we construct a new lattice that is orthogonal to the lattice generated by {u_j}, instead of opting in direct calculation of r_i. More precisely, let Ũ denote a matrix (u₁ |⋯ | u_k−n−1) and consider the orthogonal lattice

Due to the CRT-structure of CCK-ACD samples, {r_i}_1≤i≤n are short linearly independent vectors that belong to Λ^⊥ (Ũ).^[2] The lattice Λ^⊥ (Ũ) ⊂ ℤ^k has rank n + 1. We apply the LLL algorithm on the lattice Λ^⊥ (Ũ) to obtain b′={b1′,⋯,bn+1′}, the LLL-reduced basis. In this case, the time complexity is poly(n, size(Λ^⊥ (Ũ))), which is dominated by 2Oγ(η−ρ)2.

We now show that determinant of Λ({b1′,…,bn′}) is bounded. Since {r_i}_1≤i≤n are n linearly independent vectors in Λ^⊥(Ũ), there exists a vector bj′ such that {r₁, ⋯, r_n, bj′} are n + 1 linearly independent vectors in Λ^⊥(Ũ). Additionally, ∥r_i∥ is smaller than k ⋅ 2^ρ for all i, we note that λ_n (Λ^⊥(Ũ)) ≤ 2^ρ+logk. Let b~′={b1′∗,⋯,bn+1′∗} be Gram-Schmidt basis of b′. Then we calculate the determinant of lattice Λ′ spanned by {b1′,⋯,bn′}.

According to the analysis above, the log-size of determinant of the rest n column vectors after LLL algorithm is smaller than n+14 + n(ρ + logk) with k−n−1=γ2log⁡δ=2γη−ρ.

3.0.2 Heuristic analysis of random instances

Assume that we have k random samples and run the same algorithm on the random samples. To analyze the size of determinant heuristically, we first assume that the logarithm of determinant of rank-n lattice is approximately n log B, when each entry of a basis matrix is uniformly sampled from [−2^B, 2^B]. This approximation agrees the bound from Hadamard inequality, and for square matrix it is known to hold up to difference Θ(n log n) assuming that entries are uniform [18]. In our case, n log n is negligibly small compared to other terms.

1. Random instances: As a former cases, we consider a lattice

   ΛN⊥(b)={u∈Zk | 〈u,b〉≡0 modN}

   with random integers b_i. Next we run a lattice reduction algorithm on ΛN⊥ (b). The expected size of u_j, the j-th output of the lattice reduction algorithm, are δ^k ⋅ N^1/k for all 1 ≤ j ≤ k − n − 1. We may suppose these vectors are random, given that the instances are random. Then, the logarithm of the determinant of a lattice Λ(Ũ) generated by {u₁, …, u_k − n − 1} is approximately

   k−n−1klog⁡N+(k−n−1)klog⁡δ≈k−n−1k⋅γ.

   Since the second term is relatively smaller than the first term, we will only handle the last term. The assumption that the basis vector of Λ(Ũ) is random also allows that det(Λ(Ũ)) and det(Λ^⊥ (Ũ)) are the same. Then we obtain the desired result that the logarithm of determinant of Λ^⊥ (Ũ) is approximately γ⋅k−n−1k. Then, the expected size of vectors obtained as a result of the LLL algorithm shall be 2n/4⋅det(Λ⊥(U~))1n+1. Then the logarithm of determinant of the matrix composed by any n vectors is approximately

   nn+1⋅k−n−1k⋅γ+n24.

In summary, under Gaussian Heuristic and assumption from Hadamard inequality, we show that the logarithm of the determinant is less than n+14 + n(ρ + logk) = O(n ⋅ ρ) if the given instances are the CCK-ACD instances whereas it is asypmtotically γ⋅k−n−1k⋅nn+1=Ω(γ) for the random instances. Hence, if those two values do not overlap, we can solve the CCK-ACD problem in 2Oγ(η−ρ)2 time complexity. We will later see if the experimental results fit well with this approximation in Section 5. From the analysis, we have the following result,

The following is our extended OLA algorithm.

4.1 Revisiting the Algorithm of Cheon et al.

In this section, we revisit the Cheon et al.’s algorithm in [5] to solve the CCK-ACD problem. In the original paper, the authors presented an algorithm when an auxiliary input CRT_(pi)(pi^)=∑i=1np^i is given.

However, in order to use an instance d = ∑i=1nd_i ⋅ p̂_i in Cheon et al.’s algorithm, all of d_i’s does not necessarily be 1. If d_i’s are sufficiently small, d = ∑i=1nd_i ⋅ p̂_i can also play the same role as an auxiliary input. From this, we define a dual instance for the CCK-ACD problem, which is a generalization of an auxiliary input and introduce a polynomial-time algorithm to solve the CCK-ACD problem when two dual instances are given instead of one auxiliary input by slightly modifying Cheon et al.’s algorithm.

An algorithm to generate a dual instance when given polynomially many CCK-ACD samples will be described in Section 4.2.

For an integer d = ∑i=0nd_i ⋅ p̂_i and CCK-ACD samples b_j = CRT_(pi)(r_i,j) and b_l = CRT_(pi)(r_i,l), one can see the followings

Under the condition in which each size of d_i is sufficiently small for 1 ≤ i ≤ n and d₀ = 0, the above equations hold over the integers, not modulo N. In other words, for a dual instance d = ∑i=1nd_i ⋅ p̂_i defined as above, the following inequalities hold

Thus, we observe the right of the three equations (3), (4) and (5) have the size less than N/2 so that those equations hold over the integer. Now we show how to solve the CCK-ACD when given polynomially many CCK-ACD samples and two distinct dual instances d=∑i=0ndi⋅p^i  and  d′=∑i=0ndi′⋅p^i. This computation is quite similar to the Cheon’s algorithm [5]. More precisely, we are 2n CCK-ACD samples: b_j = CRT_(pi)(r_i,j) and bℓ′=CRT(pi)(ri,ℓ′) for 1 ≤ j, ℓ ≤ n. We denote w_j, ℓ and wj,ℓ′ as [d⋅bj⋅bℓ′]N and [d′⋅bj⋅bℓ′]N, respectively. Thanks to the dual instance properties, then it can be written as

By collecting the above values of several 1 ≤ j, ℓ ≤ n, we can construct two matrices w = (w_j,ℓ) and w′ = (wj,ℓ′) ∈ ℤ^n×n, which can be written as

for r = (r_j,i) and r′ = (ri,ℓ′) ∈ ℤ^n×n. By computing (w′)⁻¹ over ℚ, we obtain the matrix Y as following form

whose eigenvalues are exactly the set {d1/d1′,⋯,dn/dn′}⊂Q. We can compute those rational eigenvalues in polynomial-time of η, n and ρ from Y. Since the modular equations d ≡ d_i ⋅ p̂_i (mod p_i and d′ ≡ di′ ⋅ p̂_i (mod p_i) hold, one can check that p_i divides d ⋅ di′ − d′ ⋅ d_i for each i. Thus, by computing gcd(N, d ⋅ di′ − d′ ⋅ d_i), we can find the p_i for each 1 ≤ i ≤ n. Considering the required cost of the computations required, we obtain the following theorem.

4.2 Generating a Dual Instance from SDA

In this section, we present an algorithm to generate a dual instance from polynomially many given CCK-ACD samples b_j = CRT_(pi)(r_ij) and N = ∏i=0np_i.

Consider the column lattice Λ generated by the following basis matrix.

We confirm that any lattice vector c ∈ Λ with ∥c∥ ≤ N2 can be written in the form of ([d]_N, [d ⋅ b₁]_N, ⋯, [d ⋅ b_k]_N)^T, where d = ∑i=0nd_i ⋅ p̂_i for some d_i’s and the modular equation [d ⋅ b_j]_N ≡ ∑i=0nr_i,j ⋅ [d_i]_pi ⋅pi^ (mod N) holds for each j. In the next theorem, we prove that if c ∈ Λ is a sufficiently short vector for a proper integer k, the first entry of the vector c, ∑i=1n [d_i]_pi ⋅ p̂_i is a dual instance. Then we will be able to solve the CCK-ACD problem by combining it with the Theorem 4.

Taking logarithm to both sides of the inequality, we obtain the following:

In particular, when applying the AM-GM inequality on the left side of (6), we obtain the following inequality

where equality holds if and only if (k+1)2=γ2log⁡δ  and  γ⋅log⁡δ=(η−ρ)28.

Thus, when we choose δ satisfying log⁡δ<(η−ρ)28γ  and  k=2γη−ρ=O(γη), we can conclude that output vector c of 𝓐_δ can be written as c = ∑i=1nd_i ⋅ v_i for some d_i’s. If we denote the first entry of c as d, the vector c is the form of (d, [d ⋅ b₁]_N, ⋯, [d ⋅ b_k]_N)^T. Then d = ∑i=1nd_i ⋅ p̂_i and [d ⋅ b_j]_N = ∑i=1nr_i,j ⋅ d_i ⋅ p̂_i hold for each j. In this case, d is a multiple of p₀ so that one can recover the factor p₀ by computing gcd(d, N). Since the root Hermite factor δ is achieved in time poly(k) ⋅ 2^O(β) times by the BKZ algorithm with β = Θ(1/log δ), we conclude that one can recover the factor p₀ in 2Oγ(η−ρ)2 time up to polynomial factors using the BKZ algorithm with β≈Oγ(η−ρ)2.

Next, we propose the condition for terms d_i’s to be sufficiently bounded so that it can be regarded as a dual instance. We denote c̃ as k-dimensional vector which can be obtained by removing the first coordinate of c (i.e. c̃ = ([d ⋅ b₁]_N, ⋯, [d ⋅ b_k]_N)^T). Using the property [d ⋅ b_j]_N = ∑i=1nr_i,j ⋅ d_i ⋅ p̂_i for each j, c̃ can be decomposed as follows:

where d = (d₁, ⋯, d_n), P̂ = diag(p̂₁, …, p̂_n), and R = (r_i,j) ∈ ℤ^n×k.

We will later show that there is a right inverse R^* ∈ ℤ^k×n such that R ⋅ R^* = I_n, where I_n is the n × n identity matrix. Then, for each i, |d_i ⋅ p̂_i| can be bounded as follows:

If there is a matrix R^* which satisfies ∥c∥ ⋅ ∥R^*∥_∞ ≤ N ⋅ 2^{−2ρ−logn−1}, it implies that each d_i is smaller than N ⋅ 2^{−2ρ−logn−1}/p̂_i. Thus, under the above condition, the integer d = ∑i=1nd_i ⋅ p̂_i, the first entry of output vector c, can be regarded as a dual instance.

Thus, it is enough to show the existence of matrix R^* which ensures that the size of ∥c∥ ⋅ ∥ r^*∥_∞ is less than N ⋅ 2^{−2ρ−logn−1} with ∥c∥ ≤ δ^2(k+1) ⋅ k+1 ⋅ N ⋅ 2^−η+ρ+1 to obtain a dual instance by using the lattice reduction algorithm.

Construction of R^*