Affine-Padding Rabin-Oracle Factoring in $L_n\!\left(\frac{1}{3},\sqrt[3]{\frac{32}{9}}\right)$ eprint.iacr.org
Hash padding survives; affine-padded Rabin oracles still fall to an NFS-style factorization in L_n(1/3, ∛32/9).
3 comments
Affine-padded Rabin oracles still falling to an NFS-style factorization is the whole story here, and the title makes it sound much fancier than it is. The tl;dr buries that under the exponent notation.
What I wanted to see spelled out is whether the affine padding changes the smoothness probabilities only by a constant factor or by something structural, because in an L_n(1/3, c) statement that distinction gets buried fast.
For any concrete modulus size, the NFS side can still be completely dominated by the hidden constant and precomputation cost, so the asymptotic falloff doesnt say much about when the oracle actually becomes annoying.
> the NFS side can still be completely dominated by the hidden constant and precomputation cost
That feels overstated, because once the padding is affine and attacker-chosen the precomputation is exactly the attack, so the asymptotic constant is the thing that decides whether it is even worth trying at all.