Factoring RSA modulo N with high bits of p known revisited

Abstract

The factorization problem with knowledge of some bits of prime factor p of RSA modulo N is one of the earliest partial key exposure attacks on RSA. The result proposed by Coppersmith [8] is still the best, i.e., when some of p's higher bits is known as p̃assume the unknown part of p and q is and q0, respectively (say, p=p̃+p0, q=+q̃q0), if the upper bounds of them, say X and Y separately, satisfy XY = N^0.5, then N can be factored in polynomial time. Our method shows improved bounds that when RSA private key d≪N^0.483, knowing a smaller fraction of p is sufficient in yielding the factorization of N in polynomial time.