Algorithms for CRT-variant of Approximate Greatest Common Divisor Problem

Abstract The approximate greatest common divisor problem (ACD) and its variants have been used to construct many cryptographic primitives. In particular, the variants of the ACD problem based on Chinese remainder theorem (CRT) are being used in the constructions of a batch fully homomorphic encryption to encrypt multiple messages in one ciphertext. Despite the utility of the CRT-variant scheme, the algorithms that secures its security foundation have not been probed well enough. In this paper, we propose two algorithms and the results of experiments in which the proposed algorithms were used to solve the variant problem. Both algorithms take the same time complexity 2O~(γ(η−ρ)2) $\begin{array}{} \displaystyle 2^{\tilde{O}(\frac{\gamma}{(\eta-\rho)^2})} \end{array}$ up to a polynomial factor to solve the variant problem for the bit size of samples γ, secret primes η, and error bound ρ. Our algorithm gives the first parameter condition related to η and γ size. From the results of the experiments, it has been proved that the proposed algorithms work well both in theoretical and experimental terms.


Introduction
Howgrave-Graham had defined and studied the approximate greatest common divisor (ACD) problem in [16]. The ACD problem and its variant problems have been used to construct cryptographic schemes such as fully homomorphic encryption (FHE) and cryptographic multilinear map [4,6,9,19].
As the first variant problem, the partial approximate common divisor (PACD) problem was suggested. This variant problem has allowed increasing efficiency of ACD-based homomorphic encryption scheme [7]. As the series of work, in the paper [4], another variant of the ACD problem was introduced to suggest a new FHE scheme, which is called CCK-FHE scheme, over the integers. This scheme utilizes Chinese remainder theorem to encrypt multiple messages in one ciphertext. Informally, for integers , n, η, and ρ such that ≫ n · η and η ≫ ρ, the -bit ciphertext integer b of this scheme is characterized by satisfying modulo equations b ≡ r i mod p i for 1 ≤ i ≤ n, where r i 's are ρ-bit integers and p i 's are η-bit fixed secret primes. The problem that distinguishes between ciphertexts of CCK-FHE scheme and uniform samples of -bit integer, in which the -bit integer N = ∏︀ n i=0 p i is given as the product of secret primes, is called the CCK-ACD. ¹ In case n = 1, the problem is called PACD problem.
On the other hand, algorithms to directly solve the CCK-ACD problem have garnered less attention. Galbraith, Gebregiyorgis and Murphy said that an algorithm to solve the CCK-ACD problem exploiting CRT struc-ture is an open problem [13]. In fact, there has been no algorithms for solving the CCK-ACD problem so far except for the method of Chen and Nguyen [3], which depends only on ρ. Instead, in order to provide the evidence of CCK-FHE's security, authors in [4] suggested a reduction from PACD to CCK-ACD.
However, while the current CCK-FHE parameters are set to be secure for the Chen and Nguyen's attack, the authors in [4] did not use the parameter settings obtained from the reduction for known PACD parameters. Therefore, it is necessary to determine whether the CCK-FHE parameters satisfies the desired security even under the current conditions of η and . In sum, one can naturally pose the following question: Is it possible to present the time complexity for solving CCK-ACD by using a mathematical algorithm that depends on η and ?

Previous works
In order to solve the CCK-ACD problem, several naive methods are suggested. Their main idea was to exploit the feature of the problem that the error terms are relatively small and the product of the secret primes is given.
In other words, one can try a brute-force attack to recover a secret prime p i from a multiple N = ∏︀ n i=0 p i and an sample of CCK-ACD represented by b = p i · q i + r i for some fixed i, where an integer r i ∈ (−2 ρ , 2 ρ ) except i = 0. The method is to compute the greatest common divisor between (GCD) b−a and N for all integers a ∈ (−2 ρ , 2 ρ ). It would have time complexityÕ(2 ρ ), so ρ should be set to Ω(λ) for the security parameter λ. Furthermore, [3] and [7] that were proposed as the variants of exhaustive search to solve (P)ACD inÕ(2 ρ/2 ) time complexity, can be applied to solve the CCK-ACD problem for the feature mentioned previously. In addition, one can also use the factorization with the elliptic curve method to find a factor of N in 2Õ ( √ η) time complexity, where η is the log-size of p i . Thus, η should be set to Ω(λ 2 ) for the security parameter λ.
As another trial to solve CCK-ACD, authors in [14] considered well-known algorithms for solving PACD such as orthogonal lattice attack method (OLA) and simultaneous Diophantine approximation (SDA) [6,12,16,19] in the context of CCK-ACD. The SDA and OLA make use of a lattice reduction algorithm for a specific lattice whose entries consist of the given PACD samples and a multiple N = ∏︀ n i=0 p i . If one can obtain a short vector from the lattice by the lattice reduction algorithm, it leads to a solution of the PACD problem which utilizes the coordinates of the vector. Since these algorithms for (P)ACD have time complexity depending on η and , one can expect that the expansion of the algorithms to the CCK-ACD problem will provide answers to the main question.
However, if a lattice as similar to SDA and OLA is being constructed to solve CCK-ACD, there exist several short vectors of similar length in the lattice due to the symmetry of p i . Thus if short vector from the lattice by a lattice reduction algorithm is a short linear combination of some of these vectors, one cannot extract information on a certain prime p i from the vector.

Independent work
Recently, Coron and Pereira [10] proposed an algorithm to solve the multi-prime ACD problem, which is the same as the 'search' CCK-ACD problem in this paper. The main idea of the attack is also the same as our SDAstyle algorithm that combines the SDA with algebraic steps from the Cheon et al. [5]. In this paper, we also propose another OLA-style algorithm to solve 'decisional' CCK-ACD problem using OLA with a new distinguisher determinant.

Our Work
In this paper, we propose two mathematical algorithms to solve the CCK-ACD problem by extending the OLA and SDA methods that are well-known for solving the ACD problem using lattice technique. Both algorithms take the same time complexity 2 up to polynomial factors for the bit-size of samples , secret primes η and error ρ. Our algorithms are the first algorithms related to η and for solving the CCK-ACD problem.
Let b j be a CCK-ACD sample of b j ≡ r ij mod p i for 1 ≤ j ≤ k and 0 ≤ i ≤ n. Let b and r i be a vector (b j ) and (r ij ), respectively. Technically, the first step of the classical OLA algorithm on input b j is to compute a lattice Λ ⊥ N (b), which is a set of orthogonal vectors to b over Z N . Similarly, one can define a lattice Λ ⊥ ({r 0 , · · · , rn}), which is a set of orthogonal vectors to r i for all i over the integers. Then we have It implies that the size of k − n − 1 shortest vectors of Λ ⊥ N (b) is less than that of Λ ⊥ ({r 0 , · · · , rn}). The classical OLA algorithm assumes that the k − n − 1 shortest vectors is a generator of Λ ⊥ ({r 0 , · · · , rn}). Even more, the algorithm expects that k − n − 1 short vectors become a generator. So finding k − n − 1 short vectors is likely to lead us to recover the lattice Λ ⊥ ({r 0 , · · · , rn}).
However, one problem might arise after finding those short vectors. In the case of PACD, (i.e n = 1), the recovered lattice has rank two and ‖r 1 ‖ ≪ ‖r 0 ‖. So we can obtain the vector r 1 easily. Then, the next step is to recover the secret integer p 1 by computing the GCD between b j − r j1 and N = p 0 · p 1 . If the last step reveals a non-trivial factor of N, we can conclude that the b j 's are PACD samples. Unfortunately, in the case of CCK-ACD, the classical OLA algorithm faces a hard task to recover the exact vector r i except for small n since a short vector from the lattice would be a short linear combination of several r i 's. Instead, we employ a determinant of the lattice as a new distinguisher to solve the decision CCK-ACD problem. We show that a sub-lattice of the output lattice of the classic OLA has determinant of a different-sized depending on the type of inputs. Then, computation of a determinant enables us to avoid the obstacle to find the exact vector r i . The overall time complexity heavily depends on the cost of a lattice reduction to find a short vector. Therefore, the time complexity shall be asymptotically same to the classical one. For more details, please refer to Section 3.
We also propose a SDA-style algorithm to find all secret parameters in the CCK-ACD problem beyond the decision problem. The algorithm consists of two steps; find a short vector of certain lattice using a lattice reduction algorithm and then recover the factors p 1 , · · · , pn by employing the Cheon et al.'s technique [5]. More precisely, we consider a column lattice generated by the following matrix: According to the original SDA approach, this lattice includes a short vector of the form (N/p i , r 1i ·N/p i , . . . , r ki · N/p i ) for all i. In the case of n = 1, (i.e. PACD problem), the lattice has only one short vector and the first entry is a multiple of N/p 1 . So it allows us to factorize N. When it comes to the CCK-ACD problem, any short vector is a linear combination of the vectors and it would not be a multiple of nontrivial factor of N. It means that the first entry of a short vector that we obtain is an integer of the form ∑︀ n i=1 c i · N/p i for some small integers c i . In order to use the integer, we should factor in another well-known algorithm. Namely, we would like to cite a technique introduced in [5]. The reference we cite from [5] allows the linear summation of N/p i to be called a dual instance. This instance allows to convert modulo equations into integer equations by exploiting the CRT properties of the CCK-ACD samples and its relation to dual instance. Therefore, it leads to recover N/p i for all i. The complexity of the new algorithm primarily depends on the first step, so it takes time complexity as stated above. For more details, please refer to Section 4.
We provide experimental results to guarantee that our algorithms work well both in theoretical and experimental terms under the various parameters of CCK-ACD. We observe the OLA is more practical than SDA while the asymptotic complexities are the same.

Organization
In Section 2, we introduce preliminary information related to the lattice. Next, we revisit the OLA to solve the CCK-ACD problem in Section 3. Also, we extend the SDA algorithm in the context of CCK-ACD and propose the first algorithm which recovers all secret primes p i 's of the CCK-ACD problem in Section 4. In addition, we present some experimental results for our algorithms in Section 5.

Preliminaries Notation
Throughout this paper, we use a ← A to denote the operation by uniformly choosing an element a from a finite set A or generating a sample according to a distribution A. We let Zq denote the set Z ∩ (−q/2, q/2] for the positive integer q. We use the notation [t]p to denote the integer in Zp congruent to t mod p. We define CRT (p1,p2,...,pn) (r 1 , r 2 , . . . , rn) (or abbreviated as CRT (p i ) (r i )) for pairwise co-prime integers p 1 , p 2 , . . . , pn as the integer in ]︀ congruent to r i in the modulus p i for each i ∈ {1, 2, . . . , n}. We use bold letters to denote vectors or matrices and denote the set of all m × n matrices over Z by Z m×n . For matrix A, we denote the transpose of A by A T and denote the i-th row vector of A by [A] i . When A = (a i,j ) ∈ Z m×n is given, we define the infinite norm ‖A‖∞ as max 1≤j≤n ∑︀ n i=1 |a i,j | and use the notation A mod N to denote the matrix ([a i,j ] N ) ∈ Z m×n . We denote by diag(a 1 , . . . , an) the diagonal matrix with diagonal coefficients a 1 , . . . , an. When b is an integral matrix, we define size(b) as the logarithm of the largest entries of b.

Lattices
A lattice Λ is a discrete additive subgroup of R n . We call a set of linearly independent vectors b = {b 1 , b 2 , · · · , bm} ⊂ R n a basis of a lattice Λ if Λ is the set of all Z-linear combinations of the vectors b 1 , b 2 , · · · , bm. We denote such lattice Λ generated by the basis b by Λ(b). We sometimes use the notation Λ as abbreviated, instead of Λ(b). In particular, when a lattice Λ is a subset of Z n , it is called an integral lattice. In this work, we only take into account the integral lattice and regard a lattice as an integral lattice without special mention. If we regard a basis b = {b 1 , b 2 , · · · , bm} of lattice Λ as a matrix whose column vectors consist of vectors b i for 1 ≤ i ≤ m, b is called a basis matrix of Λ. The rank and determinant of lattice Λ is defined as m and det(Λ) = √︀ det(b T b) for any basis matrix b, respectively. When n = m, this lattice is called a full-rank lattice and det(Λ) = det(b) holds. Throughout this paper, we denote lattice Λ whose basis vectors are b 1 , b 2 , · · · , bm as Λ = ⟨b 1 , b 2 , · · · , bm⟩.
It is known that for a lattice Λ = Λ(b) ∈ R n with basis b = {b 1 , b 2 , · · · , bm}, the following premise holds: In addition, when a set of column vectors u = {u 1 , u 2 , · · · , u k } ⊂ Z n is given, we define the orthogonal lattices

Successive Minima
Let Λ be a lattice of rank n. The successive minima of Λ are λ 1 , · · · , λn ∈ R and λ i is minimal for any 1 ≤ i ≤ n such that there exist i linearly independent vectors v 1 , In order to reduce the size of successive minima, the Gaussian Heuristic [1] is deemed effective.

Gaussian Heuristic
Let Λ be a rank-n lattice. The Gaussian Heuristic states that the size of successive minima of Λ is approximately as follows.
Ajtai showed that the above equation holds for a random lattice with overwhelming probability [1].
Finding a short vector of a lattice is essential in our attack. There are some algorithms to find a short vector of a lattice, which is called lattice reduction algorithms.

Lattice Reduction Algorithm
The LLL algorithm [17] and the BKZ algorithm [15] are well-known lattice reduction algorithms. We mainly use BKZ algorithms to find an approximately short vector of a lattice. According to [15], the block size β of the BKZ algorithm determines how short should the output vector of the BKZ algorithm be. With the BKZ algorithm to the rank-n lattice Λ with basis matrix b, we can achieve a short vector v in poly(n, size(b)) · C HKZ (β) times which satisfies the following where β ≤ β is the Hermite constant of a rank-β lattice and C HKZ (β) denotes the time spent to get the shortest vector of a rank-β lattice and can be regarded as 2 O(β) .
From now on, we would like to present the formal definition of the CCK-ACD problem, which is a major concern of this paper.
In the CCK-ACD problem, we use r 0,j to denote b j mod p 0 for each j ∈ {1, · · · , k}, where b j ∈ D ,η,ρ,n(pi)'s are given as CCK-ACD samples. We remark that r 0,j may not be small, unlike other r i,j for i ∈ {1, · · · , n}.

OLA for the CCK-ACD Problem
In this section, we revisit the orthogonal lattice attack method (OLA) and explain how to guarantee the upper bound of the OLA proposed in [9] for the CCK-ACD problem in time 2 Our extended OLA algorithm outputs a determinant of certain lattice, which is constructed by CCK-ACD samples or random integers. In this section, for the CCK-ACD samples, we show that the size of determinant is bounded by 2 n+1 4 +n(ρ+log k) , where k denotes the optimized number of CCK-ACD samples, under the Gaussian Heuristic. In the case of random elements, our algorithm outputs a determinant larger than the value. From the results, we can solve the CCK-ACD problem by checking the determinant. The full details of our OLA algorithm shall be given in full in the below.
The first step of OLA, which is described in [9, Section 5.1], is to find the set of short vectors Since b j ≡ r i,j mod N, we observe the relations using the CRT structure If a vector u ∈ Z k satisfies ⟨u, r i ⟩ = 0 in integers for all i = 0, · · · , n, then ⟨u, b⟩ ≡ 0 mod N because of the above relations. Thus, it holds that We assume the Gaussian heuristic holds on the lattice Λ ⊥ ({r 0 , · · · , rn}) since all components of r i with 0 ≤ i ≤ n are uniformly chosen from each set. Therefore, it holds that log |λ i (Λ ⊥ ({r 0 , · · · , rn}))| = − nη + nρ k − n − 1 for all i = 1, 2, · · · , k − n − 1. Note that we omit the small values including log k for the convenience of writing. We aim at recovering generators of Λ ⊥ ({r 0 , · · · , rn}). To obtain such vectors u j 's, we run a lattice reduction algorithm A δ with root Hermite factor δ on the lattice Λ ⊥ N (b). By the approximate factor δ of a lattice reduction algorithm A δ , the j-th output vector ). Thus, for all j = 1, 2, · · · , k − n − 1, w j is bounded as follows We now argue that the vector u j is in Λ ⊥ ({r 0 , · · · , rn}) under some condition. Since we know The last value of the equation includes log k, which is however much smaller than the current value. Therefore, for simplicity purposes, we omit this term.
By the CRT construction, we have ⟨u j , b⟩ ≡p i ⟨u j , r i ⟩ and it is zero in modulo p i for all i. Since p i 's are η-bit primes, we can therefore ensure the vector u j ∈ Λ ⊥ N (b) if |⟨u j , r i ⟩| < p i /2 for all i. This condition can be written as When we choose k − n − 1 = √︁ 2 log δ and apply the AM-GM inequality, it is enough to satisfy log δ as following inequality 2 √︀ 2 log δ ≤ η − ρ.
According to the analysis above, the log-size of determinant of the rest n column vectors after LLL algorithm is smaller than n+1

Heuristic analysis of random instances.
Assume that we have k random samples and run the same algorithm on the random samples. To analyze the size of determinant heuristically, we first assume that the logarithm of determinant of rank-n lattice is approximately n log B, when each entry of a basis matrix is uniformly sampled from [−2 B , 2 B ]. This approximation agrees the bound from Hadamard inequality, and for square matrix it is known to hold up to difference Θ(n log n) assuming that entries are uniform [18]. In our case, n log n is negligibly small compared to other terms.
-Random instances: As a former cases, we consider a lattice with random integers b i . Next we run a lattice reduction algorithm on Λ ⊥ N (b). The expected size of u j , the j-th output of the lattice reduction algorithm, are δ k · N 1/k for all 1 ≤ j ≤ k − n − 1. We may suppose these vectors are random, given that the instances are random. Then, the logarithm of the determinant of a lattice Λ(Ũ) generated by {u 1 , . . . , u k−n−1 } is approximately Since the second term is relatively smaller than the first term, we will only handle the last term. The assumption that the basis vector of Λ(Ũ) is random also allows that det(Λ(Ũ)) and det(Λ ⊥ (Ũ)) are the same.
Then we obtain the desired result that the logarithm of determinant of Λ ⊥ (Ũ) is approximately · k−n−1 k . Then, the expected size of vectors obtained as a result of the LLL algorithm shall be 2 n/4 · det(Λ ⊥ (Ũ)) 1 n+1 . Then the logarithm of determinant of the matrix composed by any n vectors is approximately In summary, under Gaussian Heuristic and assumption from Hadamard inequality, we show that the logarithm of the determinant is less than n+1 4 + n(ρ + log k) = O(n · ρ) if the given instances are the CCK-ACD instances whereas it is asypmtotically · k−n−1 k · n n+1 = Ω( ) for the random instances. Hence, if those two values do not overlap, we can solve the CCK-ACD problem in 2 )︁ time complexity. We will later see if the experimental results fit well with this approximation in Section 5. From the analysis, we have the following result, Theorem 2 (Heuristic). Let n, η, ρ be parameters of the CCK-ACD problem and k = n + 1 + √︁ 2 log δ CCK-ACD samples are given with log δ < (η−ρ) 2 8 . When the following equation holds The following is our extended OLA algorithm.

SDA Algorithm for the CCK-ACD problem
In this section, we first describe a lattice-based algorithm to solve the CCK-ACD problem by applying the Simultaneously Diophantine approximation (SDA) algorithm which has served as a useful method to solve the ACD problem. Compared to the OLA algorithm, SDA algorithm allows us to recover all secret primes p i of CCK-ACD problem. Therefore, in this section, we will take into account a search CCK-ACD problem instead of decisional one. In the paper [14], Galbraith et al. try to apply the SDA algorithm in the context of CCK-ACD and comment that this attack is not directly applicable to the CCK-ACD problem. In order to review this work, one can con-
for all 1 ≤ i ≤ n and these all have similar lengths. Once we computep i from the first entry of the vector, we can recover the prime factors p i = N/p i . But if u = (u 0 , u 1 , · · · , u k ) ∈ Λ is a short linear combination of several of these vectors, (i.e., u = ∑︀ n i=1 e i · v i ), we cannot expect that ⌊N/u 0 ⌉ is one of the primes of N, where u 0 = ∑︀ n i=1 e i ·p i . That is why the origianl SDA algorithm is not directly applicable to the CCK-ACD problem. However, an instance of the form d = ∑︀ n i=1 d i ·p i with small d i 's has a special property. This integer is called dual instance in this paper. More precisely, if we can ensure that d i 's are sufficiently small, the instance d = ∑︀ n i=1 d i ·p i allows the below modular equations to be established without modulus N due to the CRTstructure of CCK-ACD samples.
This property plays a crucial role in solving the CCK-ACD problem and even recovering the secret primes in our algorithm. In Section 4.1, we give a formal definition of a dual instance to give a standard for how small d i 's should be in an instance d = ∑︀ n i=1 d i ·p i . Once we obtain such dual instances, we modify Cheon et al.'s algorithm in [5] to solve the CCK-ACD problem using the dual instances, which is the second step of our algorithm for solving the CCK-ACD problem. All in all, we first obtain a dual instance from the original SDA algorithm. Next we recover any secret primes p i by applying the modified Cheon's algorithm. For convenience purposes, the second step will be firstly described and the first step will be suggested later. In the below, the full details of an extended SDA algorithm will be explained.

Revisiting the Algorithm of Cheon et al.
In this section, we revisit the Cheon et al.'s algorithm in [5] to solve the CCK-ACD problem. In the original paper, the authors presented an algorithm when an auxiliary input CRT (p i ) (p i ) = ∑︀ n i=1p i is given. However, in order to use an instance d = Definition 3 (Dual Instance). Let n, η, ρ be positive integers. For given η-bit primes p 1 , · · · , pn and p 0 ∈ Z ∩ An algorithm to generate a dual instance when given polynomially many CCK-ACD samples will be described in Section 4.2.
For an integer d = Under the condition in which each size of d i is sufficiently small for 1 ≤ i ≤ n and d 0 = 0, the above equations hold over the integers, not modulo N. In other words, for a dual instance d = ∑︀ n i=1 d i ·p i defined as above, the following inequalities hold Thus, we observe the right of the three equations (3), (4) and (5) have the size less than N/2 so that those equations hold over the integer. Now we show how to solve the CCK-ACD when given polynomially many CCK-ACD samples and two distinct dual instances d = ∑︀ n i=0 d i ·p i and d ′ = ∑︀ n i=0 d ′ i ·p i . This computation is quite similar to the Cheon's algorithm [5]. More precisely, we are 2n CCK-ACD samples: b j = CRT (p i ) (r i,j ) and b ′ ℓ = CRT (p i ) (r ′ i,ℓ ) for 1 ≤ j, ℓ ≤ n. We denote w j,ℓ and w ′ j,ℓ as [d · b j · b ′ ℓ ] N and [d ′ · b j · b ′ ℓ ] N , respectively. Thanks to the dual instance properties, then it can be written as By collecting the above values of several 1 ≤ j, ℓ ≤ n, we can construct two matrices w = (w j,ℓ ) and w ′ = (w ′ j,ℓ ) ∈ Z n×n , which can be written as for r = (r j,i ) and r ′ = (r ′ i,ℓ ) ∈ Z n×n . By computing (w ′ ) −1 over Q, we obtain the matrix Y as following form whose eigenvalues are exactly the set {d 1 /d ′ 1 , · · · , dn /d ′ n } ⊂ Q. We can compute those rational eigenvalues in polynomial-time of η, n and ρ from Y. Since the modular equations , we can find the p i for each 1 ≤ i ≤ n. Considering the required cost of the computations required, we obtain the following theorem.

Generating a Dual Instance from SDA
In this section, we present an algorithm to generate a dual instance from polynomially many given CCK-ACD Consider the column lattice Λ generated by the following basis matrix.
We confirm that any lattice vector c ∈ Λ with ‖c‖ ≤ N 2 can be written in the form of ( holds for each j. In the next theorem, we prove that if c ∈ Λ is a sufficiently short vector for a proper integer k, the first entry of the vector c, ∑︀ n i=1 [d i ]p i ·p i is a dual instance. Then we will be able to solve the CCK-ACD problem by combining it with the Theorem 4. Proof. Suppose that k > n CCK-ACD samples b j = CRT (p i ) (r i,j ) and N = n ∏︀ i=0 p i are given. We denote r 0,j as [b j ]p 0 .
Consider the column lattice Λ generated by the following basis matrix b where b j 's are given CCK-ACD samples and N = n ∏︀ i=0 p i . Note that any vector v in the lattice Λ can be represented for some integers a i 's. We denotep i ·(1, r i,1 , r i,2 , · · · , r i,k ) T by v i for each i. Then, v i 's are linearly independent and ‖v i ‖ ≤ B := We apply Gaussian Heuristic to estimate λ n+1 (Λ) which is approximately √︁ k+1 2πe · (det Λ) 1 k+1 . Suppose the size of a vector c ∈ Λ obtained by the lattice reduction algorithm A δ is shorter than δ 2(k+1) · λ 1 (Λ) ≤ δ 2(k+1) · B < √︁ k+1 2πe · (det Λ) 1 k+1 ≈ λ n+1 (Λ). Then, we conclude c ∈ ⟨v 1 , · · · , vn⟩ and p 0 divides gcd (N, d), where d is the first entry of the vector c. Hence, it is required that the length of vector c, the first output of the lattice reduction algorithm, is shorter than √︁ k+1 2πe · (det Λ) 1 k+1 . It can be written as Taking logarithm to both sides of the inequality, we obtain the following: In particular, when applying the AM-GM inequality on the left side of (6), we obtain the following inequality where equality holds if and only if (k + 1) 2 = 2 log δ and · log δ = (η−ρ) 2  )︁ . Next, we propose the condition for terms d i 's to be sufficiently bounded so that it can be regarded as a dual instance. We denotec as k-dimensional vector which can be obtained by removing the first coordinate r i,j · d i ·p i for each j,c can be decomposed as follows:c = (d 1 ·p 1 , · · · , dn ·pn) · ⎛ ⎜ ⎜ ⎜ ⎜ ⎝ r 1,1 r 1,2 · · · r 1,k r 2,1 r 2,2 · · · r 2,k . . . . . . . . . . . . r n,1 r n,2 · · · r n,k where d = (d 1 , · · · , dn),P = diag(p 1 , . . . ,pn), and R = (r i,j ) ∈ Z n×k . We will later show that there is a right inverse R * ∈ Z k×n such that R · R * = In, where In is the n × n identity matrix. Then, for each i, |d i ·p i | can be bounded as follows: If there is a matrix R * which satisfies ‖c‖ · ‖R * ‖∞ ≤ N · 2 −2ρ−log n−1 , it implies that each d i is smaller than N · 2 −2ρ−log n−1 /p i . Thus, under the above condition, the integer d = n ∑︀ i=1 d i ·p i , the first entry of output vector c, can be regarded as a dual instance.
Thus, it is enough to show the existence of matrix R * which ensures that the size of ‖c‖·‖r * ‖∞ is less than N · 2 −2ρ−log n−1 with ‖c‖ ≤ δ 2(k+1) · √ k + 1 · N · 2 −η+ρ+1 to obtain a dual instance by using the lattice reduction algorithm.

Construction of R *
Now, we construct the right inverse matrix R * and estimate the size of ‖r * ‖∞ using Babai's nearest plane algorithm [2] and Gaussian Heuristic assumption.
More precisely, let q 1 be a prime integer, which is independent from n ∏︀ i=1 p i , and z 1 ∈ Z k be any vector with r · z 1 ≡ e 1 (mod q 1 ), where e 1 is a n-dimensional standard vector. Consider a full rank lattice Λ 1 = {x ∈ Z k : r · x ≡ 0 (mod q 1 )}, whose determinant is q n 1 and the set of linearly independent vectors {x i } 1≤i≤k ⊂ Z k such that ‖x i ‖ ≤ λ k (Λ 1 ) for each i. We accept Gaussian heuristic to estimate λ k (Λ 1 ) ≈ Using the Babai's nearest plane algorithm on vector z, we obtain the vector we obtain the following: For the modular equation n k is less than 1 2 q 1 for all i (i.e. q 1 > (k 3 2 · 2 ρ ) k k−n ), the equation r · z 1 ′ = e 1 holds over the integers.
By setting the size of prime q 1 to be similar with (k 3 2 · 2 ρ ) k k−n , we can conclude that there exists a vector z 1 ′ which satisfies the equation r · z 1 ′ = e 1 and the following condition Similarly, we can also apply it to other z i 's to construct r * = (z 1 ′ , · · · , z k ′ ) with the vectors z i ′ satisfying r · z i ′ = e i , so we can bound ‖r * ‖∞ as follows Hence, we can obtain the upper bound of ‖c‖ · ‖R * ‖∞ as follows We remind that the size of ‖c‖ · ‖R * ‖∞ needs to be less than N · 2 −2ρ−log n−1 . Therefore the following inequality should be satisfied: Taking logarithm to both sides of the inequality, we obtain as follows Since we set k = 2 η−ρ > 2n, the condition k k−n = O(1) holds so we can rewrite the above equality and obtain the following condition for n, k, η, and ρ The left side of the above inequality 2(k + 1) log δ is approximated as 4 η−ρ · (η−ρ) 2 8 = η−ρ 2 so that the equality holds with our optimized parameters k = 2 η−ρ and log δ < (η−ρ) 2 8 for the condition (6). Thus we can conclude that using the lattice reduction A δ with log δ < (η−ρ) 2 8 and about 2 η−ρ CCK-ACD samples to construct the lattice Λ satisfies the conditions (6) and (7). In other words, we can obtain a dual instance from the first entry of )︁ up to polynomial factors required for the above algorithm does not depend on the number of secret primes n and bit-length of the multiple of n secret primes n · η but depends on the bit-length of CCK-ACD samples .

Experiments
In this section, we provide the experimental results of OLA, SDA for the CCK-ACD problem. All experiments were carried out on a single Intel Core i5 running at 2.1GHz processor and 16GB memory.
We remark that we use a few simplifications for the experiments to run our algorithm; we run fplll algorithm [11] instead of BKZ algorithm. For the efficiency of the experiment, we choose the number of samples, k, to satisfy the required conditions for attack instead of the asymptotic optimum.
According to our experiments in Table1, from various parameters, we can see that the determinant of the orthogonal lattice is very similar to our prediction. Thus, our assumptions of OLA are reasonable for CCK-ACD and random instances. Particularly in the actual use of parameters, the difference of determinant between CCK-ACD and random is more stark because n and ρ are set much smaller than .
Experimental results of OLA refer that our expectation of the condition for OLA is accurate. OLA works well even when the ρ is quite large as long as the condition (2) is satisfied.
We also experimented with a toy parameter in [8]. OLA is slower than conventional attacks, GCD attack in [3], in toy parameters. Since conventional attacks that are the GCD algorithms in [3] areÕ(2 ρ/2 ) polynomialtime operation, they largely depend on the size of ρ unlike OLA. If ρ is larger than current parameters, then OLA can be the faster than other direct algorithms for the CCK-ACD problem.
When the number of secret primes, n, is small, OLA can even find the exact some r i through LLL algorithm on Λ ⊥ (Ũ). But if n is more than 100, the outputs of the LLL algorithm are linear combinations of r i 's with a high probability. For the above reason, we find it difficult to find out an exact r i when n is large.
In Table2, we can see SDA experimental results with regards to the CCK-ACD problem. According to our results, we have confirmed that experimental results of SDA are above our expectation, even in parameters that do not satisfy our condition. In SDA, we cannot only distinguish them from a uniform distribution but also find the factor of N and recover the secret primes. Table 1: Experiments about OLA on the CCK-ACD problem. Random means that we do the OLA with random instances whose size is −bits. Parameters* is the toy parameters in [8] with λ = 42 and our attack cost is 2 47 . Parameters** is increasing the size of ρ to withstand the GCD attack in [3], although our attack cost is almost the same.