Tag Info

I imagine that it would be most efficient to leak bits of an appropriate sigma which describes an elliptic curve of smooth order which would lead to a factorization after a tolerable amount of work

I don't believe a lower bound has ever been proven for the "fewest" number of bits needed. Coppersmith showed, however, how given either the $n/4$ least or $n/4$ most significant bits of $p$ where $n$ is the size of the modulus $N=pq$, $N$ can be efficiently factored. Additionally, given the $n/4$ least significant bits of $d$, one can reconstruct $d$ (and ...