用Maxima學密碼學-Lattice Reduction應用2-找出同餘方程式較小的解(頁 1) - 數學軟體

bugmens 發表於 2021-4-15 10:20

用Maxima學密碼學-Lattice Reduction應用2-找出同餘方程式較小的解

[table][tr][td][align=center]方法[/align][/td][td][align=center]範例[/align][/td][/tr]
[tr][td=2,1][b][align=center]問題敘述[/align][/b][/td][/tr]
[tr][td]設同餘方程式為$f(x)=a_d x^d+a_{d-1}x^{d-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}$
利用LLL方法可以找出比邊界$X$還小的解$x_0$($ |\;x_0|\;<X=N^{\displaystyle \frac{2}{d(d+1)}}$)
使得$f(x_0)\equiv 0 \pmod{N}$[/td]
[td]設同餘方程式為$f(x)=1131x^3+14531x^2+116024x+57592\equiv 0 \pmod{123107}$
$\displaystyle d=3,X=N^{\frac{2}{3\cdot 4}}=7.0531$
利用LLL方法可以找出比邊界$X=7$還小的解
使得$f(x_0)\equiv 0 \pmod{123107}$[/td][/tr]
[tr][td=2,1][b][align=center]步驟1.產生lattice證明向量線性組合方程式的解和原方程式相同。[/align][/b][/td][/tr]
[tr][td]將$f(x)$各項係數取lattice如下
$B=\matrix{\matrix{常數項&1次方&2次方&\ldots&d-1次方&d次方&} \cr \left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right]}$
該lattice的向量線性組合為
$\matrix{\matrix{s\cr -s_0 \cr -s_1 \cr -s_2 \cr \vdots \cr -s_{d-1}\cr -s_d}&\left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right]}$
$=\left[\matrix{sa_0&sa_1X&sa_2X^2&\ldots&sa_{d-1}X^{d-1}&sa_dX^d&\frac{s}{d+1}\cr
-s_0N&0&0&0&0&0&0\cr
0&-s_1NX&0&0&0&0&0\cr
0&0&-s_2NX^2&0&0&0&0\cr
0&0&0&\ddots&0&0&0\cr
0&0&0&0&-s_{d-1}NX^{d-1}&0&0\cr
0&0&0&0&0&-s_dNX^d&0}\right]$
$=[(sa_0-s_0N),(sa_1-s_1N)X,\ldots,(sa_{d-1}-s_{d-1}N)X^{d-1},(sa_d-s_dN)X^d,\frac{s}{d+1}]$

將向量線性組合前$d+1$個分量除以$X^i$為係數的方程式
$h(x)=(sa_0-s_0N)+(sa_1-s_1N)x+\ldots+(sa_{d-1}-s_{d-1}N)x^{d-1}+(sa_d-s_dN)x^d$
　$=s(a_0+a_1x+\ldots+a_{d-1}x^{d-1}+a_d x^d)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)$
　$=sf(x)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)$
得到$h(x)\equiv sf(x)\pmod{N}$
若$x=x_0$是$h(x)\equiv 0 \pmod{N}$的解，那$x=x_0$也會是$f(x)\equiv 0 \pmod{N}$的解。[/td][td]$B=\left[\matrix{57592&116024\cdot 7^1&14531\cdot 7^2&1131\cdot 7^3& \frac{1}{4}\cr
123107&0&0&0&0\cr
0&123107\cdot 7^1&0&0&0\cr
0&0&123107\cdot 7^2&0&0\cr
0&0&0&123107\cdot 7^3&0}\right]$

　　$\left[\matrix{57592&812168&712019&387933&\frac{1}{4}\cr
123107&0&0&0&0\cr
0&861749&0&0&0\cr
0&0&6032243&0&0\cr
0&0&0&42225701&0}
\right]$[/td][/tr]
[tr][td=2,1][b][align=center]步驟2.經LLL化簡得到短向量所形成的方程式不需再同餘$N$。[/align][/b][/td][/tr]
[tr][td]lattice經LLL化簡後第一行為整個lattice中較短向量
取前$d+1$個分量$(c_0,c_1X,\ldots,c_{d-1}X^{d-1},c_dX^d)$將每個分量除以$X^i$得到係數$c_i$
將係數$c_i$組成新方程式$\displaystyle h(x)=\sum_{i=0}^d c_ix^i$
若每個係數$\displaystyle |\;c_i|\;<\frac{N}{(d+1)X^i}$，要求的解$x$小於邊界$X$($|\;x|\;<X$)。
$\displaystyle |\;h(x)|\;= |\;\sum_{i=0}^d c_i x^i|\;\le \sum_{i=0}^d |\;c_i|\; |\;x|\;^i<\sum_{i=0}^d \frac{N}{(d+1)X^i} X^i$
$\displaystyle =\sum_{i=0}^d \frac{N}{d+1}=\frac{N}{d+1}\cdot (d+1)=N$，得到$|\;h(x)|\;<N$
原本要解同餘方程式$h(x)\equiv 0\pmod{N}$，因為$|\;h(x)|\;<N$，變成解一般方程式$h(x)=0$。
[/td][td]$B=\left[\matrix{-9310&13671&-4704&343&5905\cr
9310&-13671&4704&-343&\frac{99487}{4}\cr
85867&54684&-18816&1372&-\frac{28627}{4}\cr
-28932&-96173&-263424&19208&-\frac{31457}{4}\cr
44745&-4151&-100499&-432523&\frac{3537}{2}}\right]$
$\displaystyle h(x)=-9310+\frac{13671}{7^1}x-\frac{4704}{7^2}x^2+\frac{343}{7^3}x^3$
　　$=-9310+1953x-96x^2+x^3$
其中各項係數符合
$\displaystyle |\;-9310|\;<\frac{123107}{4\cdot 7^0}=30776.75$
$\displaystyle |\;1953|\;<\frac{123107}{4\cdot 7^1}=4396.68$
$\displaystyle |\;-96|\;<\frac{123107}{4\cdot 7^2}=628.10$
$\displaystyle |\;1|\;<\frac{123107}{4\cdot 7^3}=89.73$[/td][/tr]
[tr][td=2,1][b][align=center]步驟3.解一般方程式得到小於$X$的解$x=x_0$。[/align][/b][/td][/tr]
[tr][td][/td][td]$h(x)=(x-7)(x-19)(x-70)=0$
$x=7,19,70$，也是$f(x)\equiv 0 \pmod{123107}$的解。
驗算
$f(7)=1969712\equiv 0\pmod{123107}$
$f(19)=15265268\equiv 0\pmod{123107}$
$f(70)=467314172\equiv 0\pmod{123107}$[/td][/tr][/table]

[b]步驟4.計算邊界$X$的範圍[/b]
計算行列式值$\displaystyle det(B)$
$=\left|\ \matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right|$
以第$d+2$行降階，0降階後仍是0，只剩下$\displaystyle \frac{1}{d+1}$再乘上餘因子
$\displaystyle =\frac{1}{d+1}\left|\matrix{N&0&0&0&0&0\cr
0&NX&0&0&0&0\cr
0&0&NX^2&0&0&0\cr
&&&\ddots&&\cr
0&0&0&0&NX^{d-1}&0\cr
0&0&0&0&0&NX^d} \right|$
行列式只有對角線有值，其餘為0，行列式值由對角線元素相乘
$\displaystyle =\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}$

經LLL化簡後的第一列向量$\vec{b_1}$是整個lattice中較短的向量，向量長度符合不等式$\Vert\;\vec{b_1}\Vert\;\le 2^{(n-1)/4}\cdot (det(B))^{1/n}$
[url]https://en.wikipedia.org/wiki/Lenstra%E2%80%93Lenstra%E2%80%93Lov%C3%A1sz_lattice_basis_reduction_algorithm[/url]

其中lattice有$d+2$列，$n=d+2$。將$\displaystyle det(B)=\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}$代入得到$\displaystyle \Vert\;\vec{b_1}\Vert\;\le 2^{\frac{d+1}{4}}\left(\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\right)^{\frac{1}{d+2}}$

若想找到邊界$X$的範圍，需要第一列向量長度再小於$\displaystyle \frac{N}{d+1}$和需要$\displaystyle 2^{\frac{d+1}{4}}\left(\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\right)^{\frac{1}{d+2}}<\frac{N}{d+1}$
不等式兩邊$d+2$次方，$\displaystyle 2^{\frac{(d+1)(d+2)}{4}}\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}<\frac{N^{d+2}}{(d+1)^{d+2}}$
重新整理不等式，$\displaystyle 2^{\frac{(d+1)(d+2)}{4}}(d+1)^{d+1}X^{\frac{d(d+1)}{2}}<N$
令$\epsilon(d)=2^{\frac{(d+1)(d+2)}{4}}(d+1)^{d+1}$僅和$d$有關的函數，當$d$固定時$\epsilon(d)$是常數
$\epsilon(d)X^{\frac{d(d+1)}{2}}<N$，得到邊界$\displaystyle X<N^{\frac{2}{d(d+1)}}$

參考資料
Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
[url]http://www.csc.kth.se/~johanh/rsalowexponent.pdf[/url]
[url]http://citeseerx.ist.psu.edu/viewdoc/download;jsessionid=84578E15DEED9F65A7EFFCC2121C0412?doi=10.1.1.185.1713&rep=rep1&type=pdf[/url]
註：
原本論文以$n$代表邊界，但之後的資料改以$X$表示，本文章也以$X$表示能找到小於$X$的解$x_0$。

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

[color=green]同餘方程式$f(x)$[/color]
[color=red](%i2)[/color]　[color=blue]fx:1131*x^3+14531*x^2+116024*x+57592;[/color]
[color=red](fx)[/color]　$1131x^3+14531x^2+116024x+57592$

[color=green]$f(x)\equiv 0\pmod{N}$[/color]
[color=red](%i3)[/color]　[color=blue]N:123107;[/color]
[color=red](N)[/color]　$123107$

[color=green]$f(x)$的次數d[/color]
[color=red](%i4)[/color]　[color=blue]d:hipow(fx,x);[/color]
[color=red](d)[/color]　$3$

[color=green]希望能找到$|\;x|\;<X=N^{2/d(d+1)}$，$f(x)\equiv 0\pmod{N}$[/color]
[color=red](%i5)[/color]　[color=blue]X:floor(N^(2/(d*(d+1))));[/color]
[color=red](X)[/color]　$7$

[color=green]定義lattice產生方式[/color]
[color=red](%i7)[/color]
[color=blue]kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(fx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/[/color]

[color=green]根據$f(x)$係數，產生lattice[/color]
[color=red](%i8)[/color]　[color=blue]latticeB:genmatrix(genlattice,d+2,d+2);[/color]
[color=red](latticeB)[/color]　$\left[\matrix{\displaystyle 57592&812168&712019&387933&\frac{1}{4}\cr
123107&0&0&0&0\cr
0&861749&0&0&0\cr
0&0&6032243&0&0\cr
0&0&0&42225701&0}\right]$

[color=green]經LLL化簡後的lattice B[/color]
[color=red](%i9)[/color]　[color=blue]latticeB: LLL(latticeB);[/color]
[color=red](latticeB)[/color]　$\left[\matrix{\displaystyle -9310&13671&-4704&343&5905\cr
9310&-13671&4704&-343&\frac{99487}{4}\cr
85867&54684&-18816&1372&-\frac{28627}{4}\cr
-28932&-96173&-263424&19208&-\frac{31457}{4}\cr
44745&-4151&-100499&-432523&\frac{3537}{2}}\right]$

[color=green]lattice第一行是整個lattice中較短的向量$\vec{b_1}$[/color]
[color=red](%i10)[/color]　[color=blue]b1:latticeB[1];[/color]
[color=red](b1)[/color]　$[-9310,13671,-4704,343,5905]$

[color=green]取$\vec{b_1}$前$d+1$個分量除以$X^i$乘上$x^i$形成$h(x)$[/color]
[color=red](%i11)[/color]　[color=blue]hx:sum(b1[i+1]/X^i*x^i,i,0,d);[/color]
[color=red](hx)[/color]　$x^3-96x^2+1953x-9310$

[color=green]將$h(x)$因式分解[/color]
[color=red](%i12)[/color]　[color=blue]factor(hx);[/color]
[color=red](%o12)[/color]　$(x-70)(x-19)(x-7)$

[color=green]得到$h(x)$的解，因為這個範例比較簡單$f(x)\equiv 0\pmod{N}$的三個解都找出來[/color]
[color=red](%i13)[/color]　[color=blue]roots:solve(hx,x);[/color]
[color=red](roots)[/color]　$[x=7,x=19,x=70]$

[color=green]驗證答案[/color]
[color=red](%i14)[/color]
[color=blue]for root in roots do
(print(將,root,代入f(,rhs(root),)=,ev(fx,root),≡0 (mod ,N,))
)$[/color]
將$x=7$代入$f(7)=1969712\equiv 0 \pmod{123107}$
將$x=19$代入$f(19)=15265268\equiv 0 \pmod{123107}$
將$x=70$代入$f(70)=467314172\equiv 0 \pmod{123107}$

bugmens 發表於 2021-5-10 16:40

使用低次方公鑰$e$的RSA傳送線性相關訊息是不安全的，傳送超過$\displaystyle \frac{e(e+1)}{2}$個加密訊息能讓破解者回復原本的訊息。

設使用低次方公鑰$e=3$，原本訊息$m$，在訊息後面串接加密時間$TimeStamp_i$當作補綴，計算3次方後同餘$n_i$得到密文$Cipertext_i$。
$Cipertext_i=(10000m+TimeStamp_i)^3\pmod{n_i}$
當破解者收集超過$\displaystyle \frac{3\cdot 4}{2}=6$個密文$Cipertext_i$、加密時間$TimeStamp_i$和公鑰$n_i$，利用前一篇文章的方法可以在多項式時間內回復原本的訊息$m$。
此時$\displaystyle n_1>2^{\frac{(e+1)(e+2)}{4}}(e+1)^{(e+1)}$，$n=min(n_i)$，$n_i\ge n$
$\displaystyle N=\prod_{i=1}^k n_i\ge n_1\prod_{i=2}^{\frac{d(d+1)}{2}+1}n_i>2^{\frac{(e+1)(e+2)}{2}}(e+1)^{(e+1)}n^{\frac{d(d+1)}{2}}$

破解者收集到7組密文、加密時間和公鑰
$TimeStamp_1=$13點40分產生密文$Cipertext_1=10117$，公鑰$n_1=14857$
$TimeStamp_2=$13點47分產生密文$Cipertext_2=13166$，公鑰$n_2=15397$
$TimeStamp_3=$13點56分產生密文$Cipertext_3=11707$，公鑰$n_3=16199$
$TimeStamp_4=$14點09分產生密文$Cipertext_4=1590$，公鑰$n_4=16463$
$TimeStamp_5=$14點18分產生密文$Cipertext_5=15758$，公鑰$n_5=16171$
$TimeStamp_6=$14點20分產生密文$Cipertext_6=7371$，公鑰$n_6=16157$
$TimeStamp_7=$14點24分產生密文$Cipertext_7=6303$，公鑰$n_7=16241$

根據密文和加密時間產生多項式
$f_i(x)=(10000x+TimeStamp_i)^3-Cipertext_i\pmod{n_i}$
$f_1(x)=(10000x+1340)^3-10117\equiv-7380x^3+7136x^2-5462x+2733\pmod{14857}$
$f_2(x)=(10000x+1347)^3-13166\equiv1351x^3+7316x^2-5044x-847\pmod{15397}$
$f_3(x)=(10000x+1356)^3-11707\equiv-4994x^3+4461x^2-2123x-3373\pmod{16199}$
$f_4(x)=(10000x+1409)^3-1590\equiv-7473x^3-3954x^2+4418x-1917\pmod{16463}$
$f_5(x)=(10000x+1418)^3-15758\equiv-5245x^3-2021x^2-7211x+1009\pmod{16171}$
$f_6(x)=(10000x+1420)^3-7371\equiv1554x^3-2117x^2-1884x+1717\pmod{16157}$
$f_7(x)=(10000x+1424)^3-6303\equiv4317x^3+441x^2-301x-5633\pmod{16241}$

$\displaystyle N=\prod_{i=1}^7 n_i=258865864180238903908838873371$
$X=\lfloor\;N^{2/(d(d+1))}\rfloor\;=79832$

利用[url=https://zh.wikipedia.org/wiki/%E4%B8%AD%E5%9B%BD%E5%89%A9%E4%BD%99%E5%AE%9A%E7%90%86]中國餘數定理[/url]計算新的方程式係數
將$f_i(x)$的常數項係數以中國餘數定理計算新的常數項$c_0$
$c_0\equiv\cases{2733\pmod{14857}\cr
-847\pmod{15397}\cr
-3373\pmod{16199}\cr
-1917\pmod{16463}\cr
1009\pmod{16171}\cr
1717\pmod{16157}\cr
-5633\pmod{16241}}$，$c_0\equiv 204373190208566474382317165684\pmod{N}$

將$f_i(x)$的1次方係數以中國餘數定理計算新的1次方係數$c_1$
$c_1\equiv\cases{-5462\pmod{14857}\cr
-5044\pmod{15397}\cr
-2123\pmod{16199}\cr
4418\pmod{16463}\cr
-7211\pmod{16171}\cr
-1884\pmod{16157}\cr
-301\pmod{16241}}$，$c_1\equiv 249751034306884980399002316934\pmod{N}$

將$f_i(x)$的2次方係數以中國餘數定理計算新的2次方係數$c_2$
$c_2\equiv\cases{7136\pmod{14857}\cr
7316\pmod{15397}\cr
4461\pmod{16199}\cr
-3954\pmod{16463}\cr
-2021\pmod{16171}\cr
-2117\pmod{16157}\cr
441\pmod{16241}}$，$c_2\equiv 189008702173331023044971363347\pmod{N}$

將$f_i(x)$的3次方係數以中國餘數定理計算新的3次方係數$c_3$
$c_3\equiv\cases{-7380\pmod{14857}\cr
1351\pmod{15397}\cr
-4994\pmod{16199}\cr
-7473\pmod{16463}\cr
-5245\pmod{16171}\cr
1554\pmod{16157}\cr
4317\pmod{16241}}$，$c_3\equiv 1000000000000\pmod{N}$

產生新的同餘方程式$g(x)\pmod{N}$，若$x=x_0$是$g(x)\equiv 0\pmod{N}$解，那$x=x_0$也會是$f_i(x)\equiv 0\pmod{n_i}$的解
$g(x)=c_0+c_1x+c_2x^2+c_3x^3\pmod{N}$
　$=204373190208566474382317165684+249751034306884980399002316934x+189008702173331023044971363347x^2+1000000000000x^3\pmod{N}$

產生lattice，希望能找到較小的解$x=x_0$$(x_0<X=78932)$
$B=\left[\matrix{c_0&c_1X&c_2X^2&c_3X^3&\frac{1}{d+1}\cr
N&0&0&0&0\cr
0&NX&0&0&0\cr
0&0&NX^2&0&0\cr
0&0&0&NX^3&0}\right]$
$\left[\matrix{
204373190208566474382317165684&19938124570787241755213152965475088&1204580474576509549683162316445791745728&508781169018368000000000000&\frac{1}{4}\cr
258865864180238903908838873371&0&0&0&0\cr
0&20665779669236832176850424938953672&0&0&0\cr
0&0&1649790522554514786342323123726549543104&0&0\cr
0&0&0&131706076996572024423280339613337903125078528&0}\right]$

經LLL化簡lattice
$B=\left[\matrix{
0&0&0&0&\frac{258865864180238903908838873371}{4}\cr
19032544658836594241198114925&-110020730529168337991621111320&-69821420216485869263622535616&-94549927515912701524841700864&-\frac{74058264293788734740876853939}{4}\cr
2056083148951895180465932260&8991794266570450022519459504&-157772457706749993512226999616&88218148052792936245521824256&-\frac{31442973836260991406843209159}{2}\cr
258865864180238903908838873371&0&0&0&0\cr
-60101849692113834636025787760&433902895535857979265114013016&-240340197778189487664217294976&-337639116008434960645370124800&-\frac{44674685201276114130186287835}{4}}\right]$

第1列向量都是0，改取第2列向量
$\vec{b_2}=[19032544658836594241198114925,-110020730529168337991621111320,-69821420216485869263622535616,-94549927515912701524841700864,-\frac{74058264293788734740876853939}{4}]$

化簡後方程式$h(x)$不需要同餘$N$
$\displaystyle h(x)=\frac{19032544658836594241198114925}{X^0}-\frac{110020730529168337991621111320}{X^1}x-\frac{69821420216485869263622535616}{X^2}x^2-\frac{94549927515912701524841700864}{X^3}x^3$
　$\displaystyle =\frac{19032544658836594241198114925}{79832^0}-\frac{110020730529168337991621111320}{79832^1}x-\frac{69821420216485869263622535616}{79832^2}x^2-\frac{94549927515912701524841700864}{79832^3}x^3$
　$=19032544658836594241198114925-1378153253446842594343385x-10955561955008732159x^2-185836137957573x^3$
　$=-(x-12345)(185836137957573x^2+13249709078094970844x+1541720912015925009412565)$
得$x=12345$

參考資料
Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
[url]http://www.csc.kth.se/~johanh/rsalowexponent.pdf[/url]
[url]http://citeseerx.ist.psu.edu/viewdoc/download;jsessionid=84578E15DEED9F65A7EFFCC2121C0412?doi=10.1.1.185.1713&rep=rep1&type=pdf[/url]
註：
原本論文以n代表邊界，但之後的資料改以X表示，本文章也以X表示能找到小於X的解x0。

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

[color=green]有7個密文[/color]
[color=red](%i2)[/color]　[color=blue]Cipertext:[10117,13166,11707,1590,15758,7371,6303];[/color]
[color=red](Cipertext)[/color]　$[10117,13166,11707,1590,15758,7371,6303]$

[color=green]有7個公鑰$n_i$[/color]
[color=red](%i3)[/color]　[color=blue]n:[14857,15397,16199,16463,16171,16157,16241];[/color]
[color=red](n)[/color]　$[14857,15397,16199,16463,16171,16157,16241]$

[color=green]有7個時戳[/color]
[color=red](%i4)[/color]　[color=blue]Timestamp:[1340,1347,1356,1409,1418,1420,1424];[/color]
[color=red](Timestamp)[/color]　$[1340,1347,1356,1409,1418,1420,1424]$

[color=green]公鑰$e$[/color]
[color=red](%i5)[/color]　[color=blue]e:3;[/color]
[color=red](e)[/color]　3

[color=green]同餘方程式最高次方$d$[/color]
[color=red](%i6)[/color]　[color=blue]d:e;[/color]
[color=red](d)[/color]　3

[color=green]根據密文和時戳產生同餘方程式$f_i(x)$[/color]
[color=red](%i7)[/color]　[color=blue]fx:create_list(polymod((10000*x+Timestamp[ i ])^3-Cipertext[ i ],n[ i ]),i,1,length(n));[/color]
[color=red](fx)[/color]　$\matrix{[-7380x^3+7136x^2-5462x+2733,\cr
1351x^3+7316x^2-5044x-847,\cr
-4994x^3+4461x^2-2123x-3373,\cr
-7473x^3-3954x^2+4418x-1917,\cr
-5245x^3-2021x^2-7211x+1009,\cr
1554x^3-2117x^2-1884x+1717,\cr
4317x^3+441x^2-301x-5633]}$

[color=green]$f_i(x)$的常數項係數[/color]
[color=red](%i8)[/color]　[color=blue]a0:create_list(coeff(fx[ i ],x,0),i,1,length(n));[/color]
[color=red](a0)[/color]　$[2733,-847,-3373,-1917,1009,1717,-5633]$

[color=green]$f_i(x)$的1次方係數[/color]
[color=red](%i9)[/color]　[color=blue]a1:create_list(coeff(fx[ i ],x,1),i,1,length(n));[/color]
[color=red](a1)[/color]　$[-5462,-5044,-2123,4418,-7211,-1884,-301]$

[color=green]$f_i(x)$的2次方係數[/color]
[color=red](%i10)[/color]　[color=blue]a2:create_list(coeff(fx[ i ],x,2),i,1,length(n));[/color]
[color=red](a2)[/color]　$[7136,7316,4461,-3954,-2021,-2117,441]$

[color=green]$f_i(x)$的3次方係數[/color]
[color=red](%i11)[/color]　[color=blue]a3:create_list(coeff(fx[ i ],x,3),i,1,length(n));[/color]
[color=red](a3)[/color]　$[-7380,1351,-4994,-7473,-5245,1554,4317]$

[color=green]利用中國餘數定理計算新的常數項$c_0$[/color]
[color=red](%i12)[/color]　[color=blue]c0:chinese(a0,n);[/color]
[color=red](c0)[/color]　$204373190208566474382317165684$

[color=green]利用中國餘數定理計算新的1次方係數$c_1$[/color]
[color=red](%i13)[/color]　[color=blue]c1:chinese(a1,n);[/color]
[color=red](c1)[/color]　$249751034306884980399002316934$

[color=green]利用中國餘數定理計算新的2次方係數$c_2$[/color]
[color=red](%i14)[/color]　[color=blue]c2:chinese(a2,n);[/color]
[color=red](c2)[/color]　$189008702173331023044971363347$

[color=green]利用中國餘數定理計算新的3次方係數$c_3$[/color]
[color=red](%i15)[/color]　[color=blue]c3:chinese(a3,n);[/color]
[color=red](c3)[/color]　$1000000000000$

[color=green]產生新的同餘方程式$g(x)\pmod{N}$，若$x=x_0$是$g(x)\equiv 0\pmod{N}$的解，那$x=x_0$也會是$f_i(x)\equiv 0\pmod{n_i}$的解[/color]
[color=red](%i16)[/color]　[color=blue]gx:c0+c1*x+c2*x^2+c3*x^3;[/color]
[color=red](gx)[/color]　$1000000000000x^3+189008702173331023044971363347x^2+249751034306884980399002316934x+204373190208566474382317165684$

[color=green]$N=\prod_{i=1}^7 n_i$[/color]
[color=red](%i17)[/color]　[color=blue]N:product(n[ i ],i,1,length(n));[/color]
[color=red](N)[/color]　$258865864180238903908838873371$

[color=green]希望能找到$|\;x_0|\;<X=\lfloor\;N^{2/(d(d+1))} \rfloor\;，g(x_0)\equiv 0\pmod{N}$[/color]
[color=red](%i18)[/color]　[color=blue]X:floor(N^(2/(d*(d+1))));[/color]
[color=red](X)[/color]　$79832$

[color=green]定義lattice產生方式[/color]
[color=red](%i20)[/color]
[color=blue]kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(gx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/[/color]

[color=green]根據$g(x)$係數，產生lattice[/color]
[color=red](%i21)[/color]　[color=blue]latticeB:genmatrix(genlattice,d+2,d+2);[/color]
[color=red](latticeB)[/color]　$\left[\matrix{
204373190208566474382317165684&19938124570787241755213152965475088&1204580474576509549683162316445791745728&508781169018368000000000000&\frac{1}{4}\cr
258865864180238903908838873371&0&0&0&0\cr
0&20665779669236832176850424938953672&0&0&0\cr
0&0&1649790522554514786342323123726549543104&0&0\cr
0&0&0&131706076996572024423280339613337903125078528&0}\right]$

[color=green]經LLL化簡後的lattice B[/color]
[color=red](%i22)[/color]　[color=blue]latticeB: LLL(latticeB);[/color]
[color=red](latticeB)[/color]　$\left[\matrix{
0&0&0&0&\frac{258865864180238903908838873371}{4}\cr
19032544658836594241198114925&-110020730529168337991621111320&-69821420216485869263622535616&-94549927515912701524841700864&-\frac{74058264293788734740876853939}{4}\cr
2056083148951895180465932260&8991794266570450022519459504&-157772457706749993512226999616&88218148052792936245521824256&-\frac{31442973836260991406843209159}{2}\cr
258865864180238903908838873371&0&0&0&0\cr
-60101849692113834636025787760&433902895535857979265114013016&-240340197778189487664217294976&-337639116008434960645370124800&-\frac{44674685201276114130186287835}{4}}\right]$

[color=green]第1列向量都是0，改取第2列向量[/color]
[color=red](%i23)[/color]　[color=blue]b2:latticeB[2];[/color]
[color=red](b2)[/color]　$[19032544658836594241198114925,-110020730529168337991621111320,-69821420216485869263622535616,-94549927515912701524841700864,-\frac{74058264293788734740876853939}{4}]$

[color=green]化簡後方程式$h(x)$不需要同餘$N$[/color]
[color=red](%i24)[/color]　[color=blue]hx:sum(b2[i+1]/X^i*x^i,i,0,d);[/color]
[color=red](hx)[/color]　$-185836137957573x^3-10955561955008732159x^2-1378153253446842594343385x+19032544658836594241198114925$

[color=green]將h(x)因式分解[/color]
[color=red](%i25)[/color]　[color=blue]factor(hx);[/color]
[color=red](%o25)[/color]　$-(x-12345)(185836137957573x^2+13249709078094970844x+1541720912015925009412565)$

[color=green]得到較小的解$x$[/color]
[color=red](%i26)[/color]　[color=blue]x:12345;[/color]
[color=red](x)[/color]　$12345$

[color=green]驗證答案$f_i(12345)\equiv 0 \pmod{n_i}$[/color]
[color=red](%i27)[/color]　[color=blue]create_list(mod(ev(fx[ i ],x=x),n[ i ]),i,1,length(n));[/color]
[color=red](%o27)[/color]　$[0,0,0,0,0,0,0]$

bugmens 發表於 2021-5-22 00:05

Rabin加密法請參閱wiki。[url]https://en.wikipedia.org/wiki/Rabin_cryptosystem[/url][table][tr][td]公式[/td][td]範例[/td][/tr]
[tr][td][b]產生金鑰[/b]
1.選擇兩個不相同的大質數$p$和$q$，其中$p\equiv 3\pmod{4}$和$q\equiv 3\pmod{4}$
2.計算$n=pq$
$n$是公鑰和$(p,q)$是私鑰[/td][td]私鑰$p=7$和$q=11$
公鑰$n=77$[/td][/tr]
[tr][td][b]加密[/b]
訊息$M$轉換成數字$m$($m<n$)
計算密文$c=m^2\pmod{n}$[/td][td]明文$m=20$
密文$c=20^2=400=15\pmod{77}$[/td][/tr]
[tr][td][b]解密[/b]
計算密文$c$在同餘$n$的平方根得到$m$
1.計算$c$在同餘$p$和$q$的平方根
$m_p=c^{\frac{1}{4}(p+1)}\pmod{p}$
$m_q=c^{\frac{1}{4}(q+1)}\pmod{q}$
2.使用擴展歐幾里得演算法計算$y_p$和$y_q$使得$y_p\cdot p+y_q\cdot q=1$。
3.使用中國餘數定理$c$在同餘$n$的平方根
$r_1=(y_p\cdot p\cdot m_q+y_q\cdot q\cdot m_p)\pmod{n}$
$r_2=n-r_1$
$r_3=(y_p\cdot p\cdot m_q-y_q\cdot q\cdot m_p)\pmod{n}$
$r_4=n-r_3$
4個$r_i$值其中一個會是明文$m$[/td][td]1.計算$m_p=15^{\frac{1}{4}(7+1)}=15^2=1\pmod{7}$
$m_q=15^{\frac{1}{4}(11+1)}=15^3=9\pmod{11}$
2.使用擴展歐幾里得演算法計算$y_p$和$y_q$
$p=7$，$q=11$
$q-p=11-7=4$
$p-(q-p)=7-4$，$2p-q=3$
$(q-p)-(2p-q)=4-3$，$-3p+2q=1$
$y_p=-3$和$y_q=2$
3.計算4個$r_i$值
$r_1=(-3\cdot 7\cdot 9+2\cdot 11\cdot 1)\pmod{77}=64$
$r_2=77-64=13$
$r_3=(-3\cdot 7\cdot 9-2\cdot 11\cdot 1)\pmod{77}=20$
$r_4=77-20=57$
其中$r_3=20$是當初的明文[/td][/tr][/table]

使用Rabin加密函數傳送線性相關訊息是不安全的，傳送3個加密訊息能讓破解者在多項式時間內回復原本的訊息。

設原本訊息$m$，在訊息後面串接加密時間$TimeStamp_i$當作補綴，計算2次方後同餘$n_i$得到密文$Cipertext_i$。
$Cipertext_i=(10000m+TimeStamp_i)^2\pmod{n_i}$
破解者收集到3組密文、加密時間和公鑰
$TimeStamp_1=$13點40分產生密文$Cipertext_1=5926$，公鑰$n_1=14857$
$TimeStamp_2=$13點47分產生密文$Cipertext_2=3031$，公鑰$n_2=15397$
$TimeStamp_3=$13點56分產生密文$Cipertext_3=5421$，公鑰$n_3=16199$

根據密文和加密時間產生多項式
$f_i(x)=(10000x+TimeStamp_i)^2-Cipertext_i\pmod{n_i}$
$f_1(x)=-2467x^2-2028x+6834\pmod{14857}$
$f_2(x)=-3515x^2-4750x-5468\pmod{15397}$
$f_3(x)=3573x^2+2874x+2828\pmod{16199}$

$\displaystyle N=\prod_{i=1}^3 n_i=3705573556571$
$X=\lfloor\;N^{2/(d(d+1))}\rfloor\;=15474$

利用[url=https://zh.wikipedia.org/wiki/%E4%B8%AD%E5%9B%BD%E5%89%A9%E4%BD%99%E5%AE%9A%E7%90%86]中國餘數定理[/url]計算新的方程式係數
將$f_i(x)$的常數項係數以中國餘數定理計算新的常數項$c_0$
$c_0\equiv\cases{6834\pmod{14857}\cr -5468\pmod{15397}\cr 2828\pmod{16199}}$，$c_0\equiv 489114568907 \pmod{N}$

將$f_i(x)$的1次方係數以中國餘數定理計算新的1次方係數$c_1$
$c_1\equiv\cases{-2028 \pmod{14857}\cr -4750\pmod{15397}\cr 2874\pmod{16199}}$，$c_1\equiv 3243065948060 \pmod{N}$

將$f_i(x)$的2次方係數以中國餘數定理計算新的2次方係數$c_1$
$c_2\equiv\cases{-2467 \pmod{14857}\cr -3515\pmod{15397}\cr 3573\pmod{16199}}$，$c_2\equiv 100000000 \pmod{N}$

產生新的同餘方程式$g(x)\pmod{N}$，若$x=x_0$是$g(x)\equiv 0\pmod{N}$解，那$x=x_0$也會是$f_i(x)\equiv 0\pmod{n_i}$的解
$g(x)=c_0+c_1x+c_2x^2\pmod{N}$
　$=489114568907+3243065948060x+100000000x^2\pmod{N}$

產生lattice，希望能找到較小的解$x=x_0$$(x_0<X=15474)$
$B=\left[\matrix{c_0&c_1X&c_2X^2&\frac{1}{d+1}\cr
N&0&0&0\cr
0&NX&0&0\cr
0&0&NX^2&0}\right]$
$\left[\matrix{489114568907&50183202480280440&23944467600000000&\frac{1}{3}\cr
3705573556571&0&0&0\cr
0&57340045214379654&0&0\cr
0&0&887279859647310765996&0}\right]$

經LLL化簡lattice
$B=\left[\matrix{0&0&0&\frac{3705573556571}{3}\cr
3705573556571&0&0&0\cr
-705084292305&-1585793949534&3095540771328&\frac{167522755129}{3}\cr
233266894054&-3534864776520&-1757763366516&240304851747}\right]$

第1,2列向量都有0，改取第3列向量
$\displaystyle \vec{b_3}=[-705084292305,-1585793949534,3095540771328,\frac{167522755129}{3}]$

化簡後方程式$h(x)$不需要同餘$N$
$\displaystyle h(x)=-\frac{705084292305}{X^0}-\frac{1585793949534}{X^1}x+\frac{3095540771328}{X^2}x^2$
　$\displaystyle =-\frac{705084292305}{15474^0}-\frac{1585793949534}{15474^1}x+\frac{3095540771328}{15474^2}x^2$
　$=-705084292305-102481191x+12928x^2$
　$=(x-12345)(12928x+57114969)$
得$x=12345$

參考資料
Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
[url]http://www.csc.kth.se/~johanh/rsalowexponent.pdf[/url]
[url]http://citeseerx.ist.psu.edu/viewdoc/download;jsessionid=84578E15DEED9F65A7EFFCC2121C0412?doi=10.1.1.185.1713&rep=rep1&type=pdf[/url]
註：
原本論文以n代表邊界，但之後的資料改以X表示，本文章也以X表示能找到小於X的解x0。

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

[color=green]有3個密文[/color]
[color=red](%i2)[/color]　[color=blue]Cipertext:[5926,3031,5421];[/color]
[color=red](Cipertext)[/color]　$[5926,3031,5421]$

[color=green]有3個公鑰$n_i$[/color]
[color=red](%i3)[/color]　[color=blue]n:[14857,15397,16199];[/color]
[color=red](n)[/color]　$[14857,15397,16199]$

[color=green]有3個時戳[/color]
[color=red](%i4)[/color]　[color=blue]Timestamp:[1340,1347,1356];[/color]
[color=red](Timestamp)[/color]　$[1340,1347,1356]$

[color=green]同餘方程式最高次方$d$[/color]
[color=red](%i5)[/color]　[color=blue]d:2;[/color]
[color=red](d)[/color]　2

[color=green]根據密文和時戳產生同餘方程式$f_i(x)$[/color]
[color=red](%i6)[/color]　[color=blue]fx:create_list(polymod((10000*x+Timestamp[ i ])^3-Cipertext[ i ],n[ i ]),i,1,length(n));[/color]
[color=red](fx)[/color]　$\matrix{[-2467x^2-2028x+6834,\cr -3515x^2-4750x-5468,\cr 3573x^2+2874x+2828]}$

[color=green]$f_i(x)$的常數項係數[/color]
[color=red](%i7)[/color]　[color=blue]a0:create_list(coeff(fx[ i ],x,0),i,1,length(n));[/color]
[color=red](a0)[/color]　$[6834,-5468,2828]$

[color=green]$f_i(x)$的1次方係數[/color]
[color=red](%i8)[/color]　[color=blue]a1:create_list(coeff(fx[ i ],x,1),i,1,length(n));[/color]
[color=red](a1)[/color]　$[-2028,-4750,2874]$

[color=green]$f_i(x)$的2次方係數[/color]
[color=red](%i9)[/color]　[color=blue]a2:create_list(coeff(fx[ i ],x,2),i,1,length(n));[/color]
[color=red](a2)[/color]　$[-2467,-3515,3573]$

[color=green]利用中國餘數定理計算新的常數項$c_0$[/color]
[color=red](%i10)[/color]　[color=blue]c0:chinese(a0,n);[/color]
[color=red](c0)[/color]　$489114568907$

[color=green]利用中國餘數定理計算新的1次方係數$c_1$[/color]
[color=red](%i11)[/color]　[color=blue]c1:chinese(a1,n);[/color]
[color=red](c1)[/color]　$3243065948060$

[color=green]利用中國餘數定理計算新的2次方係數$c_2$[/color]
[color=red](%i12)[/color]　[color=blue]c2:chinese(a2,n);[/color]
[color=red](c2)[/color]　$100000000$

[color=green]產生新的同餘方程式$g(x)\pmod{N}$，若$x=x_0$是$g(x)\equiv 0\pmod{N}$的解，那$x=x_0$也會是$f_i(x)\equiv 0\pmod{n_i}$的解[/color]
[color=red](%i13)[/color]　[color=blue]gx:c0+c1*x+c2*x^2+c3*x^3;[/color]
[color=red](gx)[/color]　$100000000x^2+3243065948060x+489114568907$

[color=green]$\displaystyle N=\prod_{i=1}^3 n_i$[/color]
[color=red](%i14)[/color]　[color=blue]N:product(n[ i ],i,1,length(n));[/color]
[color=red](N)[/color]　$3705573556571$

[color=green]希望能找到$|\;x_0|\;<X=\lfloor\;N^{2/(d(d+1))} \rfloor\;，g(x_0)\equiv 0\pmod{N}$[/color]
[color=red](%i15)[/color]　[color=blue]X:floor(N^(2/(d*(d+1))));[/color]
[color=red](X)[/color]　$15474$

[color=green]定義lattice產生方式[/color]
[color=red](%i17)[/color]
[color=blue]kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(gx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/[/color]

[color=green]根據$g(x)$係數，產生lattice[/color]
[color=red](%i18)[/color]　[color=blue]latticeB:genmatrix(genlattice,d+2,d+2);[/color]
[color=red](latticeB)[/color]　$\left[\matrix{
489114568907&50183202480280440&23944467600000000&\frac{1}{3}\cr
3705573556571&0&0&0\cr
0&57340045214379654&0&0\cr
0&0&887279859647310765996&0}\right]$

[color=green]經LLL化簡後的lattice B[/color]
[color=red](%i19)[/color]　[color=blue]latticeB: LLL(latticeB);[/color]
[color=red](latticeB)[/color]　$\left[\matrix{\displaystyle 0&0&0&\frac{3705573556571}{3}\cr
3705573556571&0&0&0\cr
-705084292305&-1585793949534&3095540771328&\frac{167522755129}{3}\cr
233266894054&-3534864776520&-1757763366516&240304851747}\right]$

[color=green]第1,2列向量都有0，改取第3列向量[/color]
[color=red](%i20)[/color]　[color=blue]b3:latticeB[3];[/color]
[color=red](b3)[/color]　$\displaystyle [-705084292305,-1585793949534,3095540771328,\frac{167522755129}{3}]$

[color=green]化簡後方程式$h(x)$不需要同餘$N$[/color]
[color=red](%i21)[/color]　[color=blue]hx:sum(b2[i+1]/X^i*x^i,i,0,d);[/color]
[color=red](hx)[/color]　$12928x^2-102481191x-705084292305$

[color=green]將$h(x)$因式分解[/color]
[color=red](%i22)[/color]　[color=blue]factor(hx);[/color]
[color=red](%o22)[/color]　$(x-12345)(12928x+57114969)$

[color=green]得到較小的解$x$[/color]
[color=red](%i23)[/color]　[color=blue]x:12345;[/color]
[color=red](x)[/color]　$12345$

[color=green]驗證答案$f_i(12345)\equiv 0 \pmod{n_i}$[/color]
[color=red](%i24)[/color]　[color=blue]create_list(mod(ev(fx[ i ],x=x),n[ i ]),i,1,length(n));[/color]
[color=red](%o24)[/color]　$[0,0,0]$

bugmens 發表於 2021-6-6 21:25

[table][tr][td][align=center]Håstad方法[/align][/td][td][align=center]Coppersmith方法[/align][/td][/tr]
[tr][td]可以找出比邊界$X$還小的解$x_0$($\displaystyle |\;x_0|\;<X=N^{\displaystyle \frac{2}{d(d+1)}}$)[/td][td]可以找出比邊界$X$還小的解$x_0$($\displaystyle |\;x_0|\;<X=\frac{1}{2}N^{\displaystyle \frac{1}{d}}$)[/td][/tr]
[tr][td]將$f(x)$各項係數取lattice如下
$B=\matrix{\matrix{常數項&1次方&2次方&\ldots&d-1次方&d次方&} \cr \left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right]}$
該lattice的向量線性組合為
$\matrix{\matrix{s\cr -s_0 \cr -s_1 \cr -s_2 \cr \vdots \cr -s_{d-1}\cr -s_d}&\left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right]}$
$=\left[\matrix{sa_0&sa_1X&sa_2X^2&\ldots&sa_{d-1}X^{d-1}&sa_dX^d&\frac{s}{d+1}\cr
-s_0N&0&0&0&0&0&0\cr
0&-s_1NX&0&0&0&0&0\cr
0&0&-s_2NX^2&0&0&0&0\cr
0&0&0&\ddots&0&0&0\cr
0&0&0&0&-s_{d-1}NX^{d-1}&0&0\cr
0&0&0&0&0&-s_dNX^d&0}\right]$
$=[(sa_0-s_0N),(sa_1-s_1N)X,\ldots,(sa_{d-1}-s_{d-1}N)X^{d-1},(sa_d-s_dN)X^d,\frac{s}{d+1}]$

將向量線性組合前$d+1$個分量除以$X^i$為係數的方程式
$h(x)=(sa_0-s_0N)+(sa_1-s_1N)x+\ldots+(sa_{d-1}-s_{d-1}N)x^{d-1}+(sa_d-s_dN)x^d$
　$=s(a_0+a_1x+\ldots+a_{d-1}x^{d-1}+a_d x^d)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)$
　$=sf(x)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)$
得到$h(x)\equiv sf(x)\pmod{N}$
若$x=x_0$是$h(x)\equiv 0 \pmod{N}$的解，那$x=x_0$也會是$f(x)\equiv 0 \pmod{N}$的解。[/td][td]將$f(x)$各項係數取lattice如下
$B=\left[\matrix{1&0&0&\ldots&0&0&a_0 \cr 0&X^{-1}&0&0&0&0&a_1\cr
0&0&X^{-2}&0&0&0&a_2\cr
0&0&0&X^{-3}&0&0&a_3\cr
&&&\ddots&&&\cr
0&0&0&0&X^{-(d-1)}&0&a_{d-1}\cr
0&0&0&0&0&X^{-d}&a_d\cr
0&0&0&0&0&0&N}\right] \matrix{常數項\cr 1次方\cr 2次方\cr 3次方\cr \vdots \cr d-1次方\cr d次方}$
該lattice的向量線性組合為
$\matrix{\matrix{1\cr x_0 \cr x_0^2 \cr x_0^3 \cr \vdots \cr x_0^{d-1}\cr x_0^d\cr -y_0}&\left[\matrix{1&0&0&\ldots&0&0&a_0 \cr 0&X^{-1}&0&0&0&0&a_1\cr
0&0&X^{-2}&0&0&0&a_2\cr
0&0&0&X^{-3}&0&0&a_3\cr
&&&\ddots&&&\cr
0&0&0&0&X^{-(d-1)}&0&a_{d-1}\cr
0&0&0&0&0&X^{-d}&a_d\cr
0&0&0&0&0&0&N}\right]}$
$=\left[\matrix{1&0&0&\ldots&0&0&a_0 \cr 0&x_0^1X^{-1}&0&0&0&0&a_1x_0^1\cr
0&0&x_0^2X^{-2}&0&0&0&a_2x_0^2\cr
0&0&0&x_0^3X^{-3}&0&0&a_3x_0^3\cr
&&&\ddots&&&\cr
0&0&0&0&x_0^{(d-1)}X^{-(d-1)}&0&a_{d-1}x_0^{(d-1)}\cr
0&0&0&0&0&x_0^{d}X^{-d}&a_dx_0^d\cr
0&0&0&0&0&0&-y_0N}\right]$
$\displaystyle =\left[1,\left(\frac{x_0}{X}\right),\left(\frac{x_0}{X}\right)^2,,\left(\frac{x_0}{X}\right)^3,\ldots,,\left(\frac{x_0}{X}\right)^{d-1},\left(\frac{x_0}{X}\right)^d,f(x_0)-y_0N\right]$
若能找到$x_0,y_0$使得$|\;x_0|\;<X$、$f(x_0)-y_0N\equiv 0\pmod{N}$
此時向量長度$\sqrt{1^2+\left(\frac{x_0}{X}\right)^2+\left(\frac{x_0}{X}\right)^4+\ldots+\left(\frac{x_0}{X}\right)^{2d}+0^2}<\sqrt{d+1}$是短向量。[/td][/tr][/table]
上面是Håstad和Coppersmith所用的lattice比較表，Håstad僅針對一個方程式$h(x_0)=sf(x_0)\pmod{N}$來產生lattice，而Coppersmith增加方程式個數，產生更大的lattice雖然增加LLL執行時間，但能提高解的上界。
$f(x_0)-y_0N=0$
$x_0f(x_0)-x_0y_0N=0$
$(f(x_0))^2-y_0^2N^2=0$
$x_0(f(x_0))^2-x_0y_0^2N^2=0$
…
Coppersmith方法如下：[table][tr][td][align=center]方法[/align][/td][td][align=center]範例[/align][/td][/tr]
[tr][td=2,1][b][align=center]問題敘述[/align][/b][/td][/tr]
[tr][td]設同餘方程式為$p(x)=x^k+a_{k-1}x^{k-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}$
且$p(x)$為monic(最高次方項係數為1)且不可分解。
利用LLL方法可以找出比邊界$X$還小的解$x_0$($\displaystyle |\;x_0|\;<X=\frac{1}{2}N^{\displaystyle \frac{1}{k}}$)
使得$p(x_0)\equiv 0 \pmod{N}$[/td][td]設同餘方程式為$p(x)=x^2+14x+19\equiv 0\pmod{35}$
且$p(x)$為monic(最高次方項係數為1)且不可分解。
利用LLL方法可以找出比邊界$X$還小的解
使得$p(x_0)\equiv 0 \pmod{35}$[/td][/tr]
[tr][td=2,1][b][align=center]步驟1：計算參數$h$和$X$[/align][/b][/td][/tr]
[tr][td]步驟3需要$hk\ge7$、$\displaystyle h-1\ge (hk-1)(\frac{1}{k}-\epsilon)$和$\displaystyle X=\frac{1}{2}N^{\frac{1}{k}}$
$hk\ge7$化簡為$\displaystyle h\ge \frac{7}{k}$
$\displaystyle h-1\ge (hk-1)(\frac{1}{k}-\epsilon)$化簡為
$\displaystyle h-1\ge h-\epsilon hk-\frac{1}{k}+\epsilon$
$\displaystyle \epsilon hk\ge \frac{k+\epsilon k-1}{k}$
$\displaystyle h\ge \frac{k+\epsilon k-1}{\epsilon k^2}$
兩個條件合併一起
$\displaystyle h\ge max\left(\frac{7}{k},\frac{k+\epsilon k-1}{\epsilon k^2}\right)$[/td][td]$p(x)$最高次方為2次方$(k=2)$
設$\epsilon=0.1$
$\displaystyle h\ge max\left(\frac{7}{2},\frac{2+0.1\cdot 2-1}{0.1\cdot 2^2}\right)=max(3.5,3)$
$h\ge 4$但本範例取$h=3$就能得到答案
$\displaystyle X=\frac{1}{2}35^{1/2}=2.958$，取$X=2$[/td][/tr]
[tr][td=2,1][b][align=center]步驟2：產生矩陣$M$[/align][/b][/td][/tr]
[tr][td]矩陣$M$是大小$(2hk-k)\times(2hk-k)$的上三角矩陣
$M=\left[\matrix{D&A\cr0_{hk}&D'}\right]$
左上角矩陣$D=(d(i,j))$是大小$hk\times hk$的對角矩陣，
對角線元素為$d_{i,i}=\delta X^{1-i}$，$\displaystyle \delta=\frac{1}{\sqrt{hk}}$
右上角矩陣$A=(a_{i,j})$是大小$(hk\times (h-1)k)$矩陣，
矩陣元素$a_{i,j}$是$x^u(p(x))^v$的$x^i$項係數
其中$\displaystyle v=\lfloor\;\frac{k+j-1}{k}\rfloor\;$和$u=(j-1)-k(v-1)$
左下角$0_{hk}$為零矩陣
右下角矩陣$D'=(d_{i,j}')$是大小$((h-1)k\times (h-1)k)$的對角矩陣，
對角線元素為$d_{i,i}'=N^v$

$M$為上三角矩陣，行列式值為對角線元素相乘
$\displaystyle det(M)=\prod_{g=0}^{hk-1}\delta X^{-g}\prod_{\gamma(i,j)=hk}^{2hk-k}N^j$
　　$\displaystyle =\delta^{hk} X^{-{\frac{hk(hk-1)}{2}}}N^{\frac{hk(h-1)}{2}}$
　　$\displaystyle =(N^{h-1}X^{-(hk-1)}(hk)^{-1})^{\frac{hk}{2}}$
－－－－－－－－－－－－－－－－－－－
$p(x)=x^2+ax+b\equiv 0\pmod{N}$
$xp(x)=x^3+ax^2+bx\equiv 0\pmod{N}$
$(p(x))^2=x^4+cx^3+dx^2+ex+f\equiv 0\pmod{N^2}$
$x(p(x))^2=x^5+cx^4+dx^3+ex^2+fx\equiv 0\pmod{N^2}$
$M=\left[\matrix{\matrix{\delta&&&&&\cr&\delta X^{-1}&&&&\cr&&\delta X^{-2}&&&\cr&&&\delta X^{-3}&&\cr&&&&\delta X^{-4}&\cr&&&&&\delta X^{-5}}&\matrix{│\cr │\cr │\cr │}&
\matrix{
b&0&f&0\cr
a&b&e&f\cr
1&a&d&e\cr
&1&c&d\cr
&&1&c\cr
&&&1}\cr ―――――――――&┼&――――――― \cr
\matrix{0}&\matrix{│\cr │\cr │}&\matrix{N&&&\cr &N&&\cr &&N^2&\cr &&&N^2}}\right]$
設$r$向量左手邊為$r_g=x_0^g$，右手邊為$x_0$和$y_0$的非負次方$r_{\gamma(i,j)}=-x_0^iy_0^j$
$r=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-y_0,-x_0y_0,-y_0^2,-x_0y_0^2]$
計算向量線性組合$s=rM$
$\displaystyle s=[1,\delta\frac{x_0}{X},\delta\left(\frac{x_0}{X}\right)^2,\delta\left(\frac{x_0}{X}\right)^3,\delta\left(\frac{x_0}{X}\right)^4,\delta\left(\frac{x_0}{X}\right)^5,$
$-p(x_0)-y_0N,x_0p(x_0)-x_0y_0N,(p(x_0))^2-y_0^2N^2,x_0(p(x_0))^2-x_0y_0^2N^2]$
存在$|\;x_0|\;<X$和$y_0$使得$p(x_0)-y_0N=0$
$\displaystyle s=\left[1,\delta\frac{x_0}{X},\delta\left(\frac{x_0}{X}\right)^2,\delta\left(\frac{x_0}{X}\right)^3,\delta\left(\frac{x_0}{X}\right)^4,\delta\left(\frac{x_0}{X}\right)^5,0,0,0,0\right]$
計算向量$s$長度比1短
$\displaystyle \Vert\;s\Vert\;=\sqrt{\sum_{k=0}^{hk-1}\left(\delta \left( \frac{x_0}{X}\right)^{k}\right)^2}<\sqrt{\sum_{k=0}^{hk-1}(\delta \cdot 1)^2}=\sqrt{\delta^2\cdot hk}=1$
[/td][td]$p(x)=x^2+14x+19\equiv 0\pmod{35}$
$xp(x)=x^3+14x^2+19x\equiv 0\pmod{35}$
$p(x)^2=x^4+28x^3+234x^2+532x+361\equiv 0\pmod{35^2}$
$xp(x)^2=x^5+28x^4+234x^3+532x^2+361x\equiv 0\pmod{35^2}$
原本$\displaystyle \delta=\frac{1}{\sqrt{hk}}=\frac{1}{\sqrt{6}}$，但本範例忽略$\delta$也能算出答案
$M=\left[\matrix{\matrix{1&&&&&\cr&2^{-1}&&&&\cr&&2^{-2}&&&\cr&&&2^{-3}&&\cr&&&&2^{-4}&\cr&&&&&2^{-5}}&\matrix{│\cr │\cr │\cr │}&
\matrix{
19&0&361&0\cr
14&19&532&361\cr
1&14&234&532\cr
&1&28&234\cr
&&1&28\cr
&&&1}\cr ―――――――――&┼&――――――― \cr
\matrix{0}&\matrix{│\cr │\cr │}&\matrix{35&&&\cr &35&&\cr &&1225&\cr &&&1225}}\right]$

$det(M)=1\cdot 2^{-1}\ldots 2^{-5}\cdot 35 \cdot 35 \cdot 1225 \cdot 1225$
　　$=2^{-15}35^6$[/td][/tr]
[tr][td=2,1][b][align=center]步驟3：矩陣$M$基本列運算得到$\widehat{M}$[/align][/b][/td][/tr]
[tr][td]因為$p(x)$為monic(最高次方項係數為1)，在矩陣$A$的對角線元素為1，進行基本列運算將右上角化簡為零，右下角化簡為零，再將對角線元素為1的一整列移到整個矩陣下方。
$\widetilde{M}=\left[\matrix{\widehat{M}&│&0_{(hk\times (h-1)k)}\cr ―&┼&――――――\cr A'&│&I_{(h-1)k}}\right]$
得到左上角矩陣$\widehat{M}$
－－－－－－－－－－－－－－－－－－－
$|\;det(M)|\;=|\;det(\widetilde{M})|\;=|\;det(\widehat{M})det(I)|\;=|\;det(\widehat{M})|\;$
得到$\displaystyle det(M)=(N^{h-1}X^{-(hk-1)}(hk)^{-1})^{\frac{hk}{2}}=det(\widehat{M})$
設$hk\ge 7$，可推得$\displaystyle hk<2^{\frac{hk-1}{2}}$，$(hk)^{-1}>2^{-\frac{(hk-1)}{2}}$
$\displaystyle det(\widehat{M})>(N^{h-1}X^{-(hk-1)}2^{-\frac{(hk-1)}{2}})^{\frac{hk}{2}}$
設$\displaystyle X=\frac{1}{2}N^{\frac{1}{k}-\epsilon}$，可推得$\displaystyle X^{-1}=2N^{-(\frac{1}{k}-\epsilon)}$，$\displaystyle X^{-(hk-1)}=2^{hk-1}N^{-(hk-1)(\frac{1}{k}-\epsilon)}$
$\displaystyle det(\widehat{M})>(N^{n-1-(hk-1)(\frac{1}{k}-\epsilon)}\cdot 2^{+\frac{(hk-1)}{2}})^{\frac{hk}{2}}$
設$\displaystyle n-1\ge (hk-1)(\frac{1}{k}-\epsilon)$
$\displaystyle det(\widehat{M})>(N^0\cdot 2^{+\frac{(hk-1)}{2}})2^{\frac{hk}{2}}=2^{\frac{(hk)(hk-1)}{4}}$
設$n=hk=dim(\widehat{M})$
$\displaystyle det(\widehat{M})>2^{\frac{n(n-1)}{4}}$
$\displaystyle det(\widehat{M})^{\frac{1}{n}}>2^{\frac{n-1}{4}}$
$\displaystyle det(\widehat{M})^{\frac{1}{n}}\cdot 2^{-\frac{n-1}{4}}>1$
由步驟2結論可知向量$s$長度小於1($1>\Vert\;s\Vert\;$)
得到$\displaystyle det(\widehat(M))^{\frac{1}{n}}\cdot 2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;$[/td][td]將右上角化簡為零
$\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
&&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr
&&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr
&&&&\frac{1}{16}&-\frac{7}{8}\cr
&&&&&\frac{1}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 1&0&0&0\cr &1&0&0\cr &&1&0\cr &&&1}\cr
――――――――――――――&┼&―――――――――\cr
\matrix{0}&\matrix{│\cr│\cr│\cr│}&\matrix{35&&&\cr&35&&\cr&&1225&\cr&&&1225}}\right]$
將右下角化簡為零
$\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
&&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr
&&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr
&&&&\frac{1}{16}&-\frac{7}{8}\cr
&&&&&\frac{1}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 1&0&0&0\cr &1&0&0\cr &&1&0\cr &&&1}\cr
――――――――――――――&┼&―――\cr
\matrix{\displaystyle &&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr
&&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
&&&&-\frac{1225}{16}&-\frac{8575}{8}\cr
&&&&&-\frac{1225}{32}}&\matrix{│\cr│\cr│\cr│}&\matrix{0&&&\cr&0&&\cr&&0&\cr&&&0}}\right]$
將對角線元素為1的一整列移到整個矩陣下方
$\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
&&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr
&&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
&&&&-\frac{1225}{16}&-\frac{8575}{8}\cr
&&&&&-\frac{1225}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 0&0&0&0\cr &0&0&0\cr &&0&0\cr &&&0}\cr
――――――――――――――&┼&―――\cr
\matrix{\displaystyle 　　&　&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr
&&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr
&&&&\frac{1}{16}&-\frac{7}{8}\cr
&&&&&\frac{1}{32}\cr}&\matrix{│\cr│\cr│\cr│}&\matrix{1&&&\cr&1&&\cr&&1&\cr&&&1}}\right]$
得到左上角矩陣$\widehat{M}$
$\widehat{M}=\left[\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
&&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr
&&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
&&&&-\frac{1225}{16}&-\frac{8575}{8}\cr
&&&&&-\frac{1225}{32}}\right]$
$\displaystyle det(\widehat{M})=1\cdot \frac{1}{2}\cdot \frac{-35}{4}\cdot \frac{-35}{8}\cdot \frac{-1225}{16}\cdot \frac{-1225}{35}$
　　$\displaystyle =2^{-15}35^6$
$\widehat{M}$乘32倍變成整數
$\widehat{M}=\left[\matrix{
32&0&-152&1064&-6726&42028\cr
&16&-112&708&-4424&27605\cr
&&-280&1960&-11060&58800\cr
&&&-140&1960&-19250\cr
&0&&&-2450&34300\cr
&&&&&-1225}\right]$[/td][/tr]
[tr][td=2,1][b][align=center]步驟4：經LLL化簡和Gram-Schmidt正交化後得到不需要同餘$N$的方程式[/align][/b][/td][/tr]
[tr][td]矩陣$\widehat{M}$經LLL化簡為$B$
$B=LLL(\widehat{M})$
矩陣$B$經Gram-Schmidt正交化得到$B^{*}$
$B^{*}=$Gram-Schmidt$(B)$
－－－－－－－－－－－－－－－－－－－
引理1：
假設lattice $L$經LLL化簡後向量為$b_1,b_2,\ldots,b_n$，經Gram-Schmidt化簡後向量為$b_1^{*},b_2^{*},\ldots,b_n^{*}$，則$\displaystyle \Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}$。
[證明]
$\displaystyle det(L)^2=\prod_{i=1}^n \Vert\;b_i^{*}\Vert\;^2=\Vert\;b_1^{*}\Vert\;^2 \Vert\;b_2^{*}\Vert\;^2\cdot \Vert\;b_n^{*}\Vert\;^2$
經LLL化簡後向量長度滿足$\Vert\;b_i^{*}\Vert\;^2\le 2\Vert\;b_{i+1}^{*}\Vert\;^2$　$(i=1,2,\ldots,n-1)$
$\displaystyle det(L)^2 \le \left(2^{n-1}\Vert\;b_n^{*}\Vert\;^2\right)\left(2^{n-2}\Vert\;b_n^{*}\Vert\;^2\right)\ldots \left(\Vert\;b_n^{*}\Vert\;^2\right)\left(\Vert\;b_n^{*}\Vert\;^2\right)$
$\displaystyle det(L)^2 \le 2^{\frac{n(n-1)}{2}}\Vert\;b_n^{*}\Vert\;^{2n}$
$\displaystyle \Vert\;b_n^{*}\Vert\;^{2n}\ge det(L)^2 2^{-\frac{n(n-1)}{2}}$
兩邊各加上$\displaystyle \frac{1}{2n}$次方$\Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}$

引理2：
假設lattice $L$其中一個元素$s$滿足$\displaystyle det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;$，則$s$會落在由$b_1,b_2,\ldots,b_{n-1}$所展開的超平面上。
[證明]
將lattice 元素$s$表示成$b_1,b_2,\ldots,b_n$的線性組合$\displaystyle s=\sum_{i=1}^n a_ib_i$，其中$a_i$是整數
向量長度$\Vert\;s\Vert\;=\Vert\;a_1b_1+a_2b_2+\ldots+a_nb_n\Vert\;\ge \Vert\;a_nb_n\Vert\;=|\;a_n|\;\Vert\;b_n\Vert\;\ge |\;a_n|\;\Vert\;b_n^{*}\Vert\;$
由引理1可知$\Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}$、$\displaystyle det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;$和
$\Vert\;s\Vert\;\ge |\;a_n|\;\Vert\;b_n^{*}\Vert\;$，得到$\Vert\;b_n^{*}\Vert\;>|\;a_n|\;\Vert\;b_n^{*}\Vert\;$，$a_n=0$
$s$可表示成$b_1,b_2,\ldots,b_{n-1}$的線性組合，$s$落在由$b_1,b_2,\ldots,b_{n-1}$所展開的超平面上。
－－－－－－－－－－－－－－－－－－－
$\displaystyle s=\left[1,\delta \frac{x_0}{X},\ldots,\delta\left(\frac{x_0}{X}\right)^{hk-1}\right]$是lattice$\widehat{M}$的向量元素，
由步驟3結論可知$\displaystyle det(\widehat{M})^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;$
由上面引理2可知$s$落在由$b_1,b_2,\ldots,b_{n-1}$所展開的超平面上。
而這個超平面會和Gram-Schmidt的向量$b_n^{*}$正交，得到$s\cdot b_n^{*}=0$，可得到一個不需要同餘$N$的方程式。[/td][td]
LLL化簡
$B=\left[\matrix{0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]$
Gram-Schmidt正交化
$B^{*}=\left[\matrix{\displaystyle 0&160&0&-60&0&-100\cr
-64&-\frac{164}{7}&-88&\frac{907}{14}&-72&-\frac{1069}{14}\cr
\frac{4327744}{55201}&-\frac{213712}{55201}&\frac{2859392}{55201}&-\frac{1388192}{55201}&-\frac{9041940}{55201}&\frac{490976}{55201}\cr
\frac{2396089600}{17933807}&-\frac{673016640}{17933807}&-\frac{1044380280}{17933807}&\frac{154688960}{17933807}&\frac{745216000}{17933807}&-\frac{1169640000}{17933807}\cr
-\frac{2184694400}{45963969}&-\frac{1521655800}{15321323}&\frac{344724800}{15321323}&-\frac{6338718400}{45963969}&\frac{172362400}{45963969}&-\frac{1166905600}{15321323}\cr
-\frac{117600}{17929}&-\frac{627200}{17929}&\frac{3763200}{17929}&\frac{2508800}{17929}&\frac{627200}{17929}&-\frac{2508800}{17929}}\right]$
取最後一列向量乘上$\displaystyle \frac{17929}{39200}$變成整數
$[−3, −16, 96, 64, 16, −64]$
形成不需要再同餘$N$的方程式
$\displaystyle h(x)=-3-16\left(\frac{x}{2}\right)+96\left(\frac{x}{2}\right)^2+64\left(\frac{x}{2}\right)^3+16\left(\frac{x}{2}\right)^4-64\left(\frac{x}{2}\right)^5$
　$=-3-8x+24x^2+8x^3+x^4-2x^5$
　$=-(x-3)(2x-1)(x^3+3x^2+5x+1)$
解方程式得到答案
$x=3$[/td][/tr][/table]

參考資料：
D. Coppersmith. Finding a small root of a univariate modular equation. In Proceedings of Eurocrypt 1996, volume 1070 of Lecture Notes in Computer Science, pages 155–165. Springer, 1996.
[url]https://link.springer.com/chapter/10.1007/3-540-68339-9_14[/url]
N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997.
[url]https://link.springer.com/chapter/10.1007/BFb0024458[/url]
有二次同餘方程式範例
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
[url]https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/258484/348751_FULLTEXT01.pdf?sequence=1&isAllowed=y[/url]
有三次同餘方程式範例
Lattice Basis Reduction：An Introduction to the LLL Algorithm and Its Applications
[url]https://www.routledge.com/Lattice-Basis-Reduction-An-Introduction-to-the-LLL-Algorithm-and-Its-Applications/Bremner/p/book/9781439807026[/url]
有一整章關於Coppersmith方法的介紹

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.43.2/share/maxima/5.43.2/share/LLL.mac

[color=green]要先載入eigen.mac才能使用gramschmidt指令[/color]
[color=red](%i2)[/color]　[color=blue]load("eigen.mac");[/color]
[color=red](%o2)[/color]　C:/maxima-5.43.2/share/maxima/5.43.2/share/matrix/eigen.mac

[color=green]要先載入diag.mac才能使用diag指令[/color]
[color=red](%i3)[/color]　[color=blue]load("diag.mac");[/color]
[color=red](%o3)[/color]　C:/maxima-5.43.2/share/maxima/5.43.2/share/contrib/diag.mac

[color=green]同餘方程式$p(x)$[/color]
[color=red](%i4)[/color]　[color=blue]px:x^2+14*x+19;[/color]
[color=red](px)[/color]　$x^2+14x+19$

[color=green]$p(x)\equiv 0\pmod{N}$[/color]
[color=red](%i5)[/color]　[color=blue]N:35;[/color]
[color=red](N)[/color]　$35$

[color=green]$p(x)$的次數$k$[/color]
[color=red](%i6)[/color]　[color=blue]k:hipow(px,x);[/color]
[color=red](k)[/color]　$2$

[color=green]設誤差值$\epsilon=0.1$[/color]
[color=red](%i7)[/color]　[color=blue]epsilon:0.1;[/color]
[color=red](epsilon)[/color]　$0.1$

[color=green]參數$h$，按照公式應該是$h=4$，但$h=3$也能算出來[/color]
[color=red](%i9)[/color]
[color=blue]h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
h:3;[/color]
[color=red](h)[/color]　4
[color=red](h)[/color]　3

[color=green]$\widehat{M}$的維度$n=hk$[/color]
[color=red](%i10)[/color]　[color=blue]n:h*k;[/color]
[color=red](n)[/color]　6

[color=green]參數$\delta$，按照公式應該是$\displaystyle \delta=\frac{1}{\sqrt{6}}$，改成$\delta=1$方便計算[/color]
[color=red](%i12)[/color]
[color=blue]delta:1/sqrt(h*k);
delta:1;[/color]
[color=red](delta)[/color]　$\displaystyle \frac{1}{\sqrt{6}}$
[color=red](delta)[/color]　1

[color=green]希望能找到$|\;x|\;<X=\frac{1}{2}N^{1/k}$，$p(x)\equiv 0\pmod{N}$[/color]
[color=red](%i13)[/color]　[color=blue]X:floor(1/2*N^(1/k));[/color]
[color=red](X)[/color]　2

[color=green]左上角矩陣對角線元素$\delta X^{-i}$[/color]
[color=red](%i14)[/color]　[color=blue]Xpower:create_list(delta*X^-(i-1),i,1,h*k);[/color]
[color=red](Xpower)[/color]　$\displaystyle \left[1,\frac{1}{2},\frac{1}{4},\frac{1}{8},\frac{1}{16},\frac{1}{32}\right]$

[color=green]左上角矩陣[/color]
[color=red](%i15)[/color]　[color=blue]D1:diag(Xpower);[/color]
[color=red](D1)[/color]　$\left[\matrix{\displaystyle 1&0&0&0&0&0\cr
0&\frac{1}{2}&0&0&0&0\cr
0&0&\frac{1}{4}&0&0&0\cr
0&0&0&\frac{1}{8}&0&0\cr
0&0&0&0&\frac{1}{16}&0\cr
0&0&0&0&0&\frac{1}{32}}\right]$

[color=green]多項式$x^u\cdot p(x)^v$[/color]
[color=red](%i16)[/color]　[color=blue]xpxpower:create_list(x^u*px^v,v,1,h-1,u,0,k-1);[/color]
[color=red](xpxpower)[/color]　$[x^2+14x+19,x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]$

[color=green]$x^1,x^2,\ldots,x^{n-1}$[/color]
[color=red](%i17)[/color]　[color=blue]xpower:create_list(x^i,i,1,n-1);[/color]
[color=red](xpower)[/color]　$[x,x^2,x^3,x^4,x^5]$

[color=green]取多項式$x^u\cdot p(x)^v$係數，形成右上角矩陣(常數項在最後一行)[/color]
[color=red](%i18)[/color]　[color=blue]A:augcoefmatrix(xpxpower,xpower);[/color]
[color=red](A)[/color]　$\left[\matrix{14&1&0&0&0&19\cr
19&14&1&0&0&0\cr
532&234&28&1&0&361\cr
361&532&234&28&1&0}\right]$

[color=green]將常數項移到第一行[/color]
[color=red](%i19)[/color]　[color=blue]A:addcol(col(A,h*k),submatrix(A,h*k));[/color]
[color=red](A)[/color]　$\left[ \matrix{
19&14&1&0&0&0\cr
0&19&14&1&0&0\cr
361&532&234&28&1&0\cr
0&361&532&234&28&1}\right]$

[color=green]矩陣$A$轉置[/color]
[color=red](%i20)[/color]　[color=blue]A:transpose(A);[/color]
[color=red](A)[/color]　$\left[ \matrix{
19&0&361&0\cr
14&19&532&361\cr
1&14&234&532\cr
0&1&28&234\cr
0&0&1&28\cr
0&0&0&1}\right]$

[color=green]左下角0矩陣[/color]
[color=red](%i21)[/color]　[color=blue]Zero:zeromatrix((h-1)*k,h*k);[/color]
[color=red](Zero)[/color]　$\left[ \matrix{
0&0&0&0&0&0\cr
0&0&0&0&0&0\cr
0&0&0&0&0&0\cr
0&0&0&0&0&0}\right]$

[color=green]右下角矩陣元素$N^v$[/color]
[color=red](%i22)[/color]　[color=blue]Npower:create_list(N^v,v,1,h-1,u,0,k-1);[/color]
[color=red](Npower)[/color]　$[35,35,1225,1225]$

[color=green]右下角矩陣[/color]
[color=red](%i23)[/color]　[color=blue]D2:diag(Npower);[/color]
[color=red](D2)[/color]　$\left[ \matrix{
35&0&0&0\cr
0&35&0&0\cr
0&0&1225&0\cr
0&0&0&1225}\right]$

[color=green]4個子矩陣合併成矩陣$M$[/color]
[color=red](%i24)[/color]　[color=blue]M:addrow(addcol(D1,A),addcol(Zero,D2));[/color]
[color=red](M)[/color]　$\left[ \matrix{\displaystyle
1&0&0&0&0&0&19&0&361&0\cr
0&\frac{1}{2}&0&0&0&0&14&19&532&361\cr
0&0&\frac{1}{4}&0&0&0&1&14&234&532\cr
0&0&0&\frac{1}{8}&0&0&0&1&28&234\cr
0&0&0&0&\frac{1}{16}&0&0&0&1&28\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&0&0&0&0&35&0&0&0\cr
0&0&0&0&0&0&0&35&0&0\cr
0&0&0&0&0&0&0&0&1225&0\cr
0&0&0&0&0&0&0&0&0&1225}\right]$

[color=green]將矩陣$M$複製成另一個矩陣$\widetilde{M}$，進行矩陣列運算[/color]
[color=red](%i25)[/color]　[color=blue]M_tilde:copymatrix(M)$[/color]

[color=green]將右上角化簡為零[/color]
[color=red](%i27)[/color]
[color=blue]for i:k+1 thru n do
  (for j:1 thru i-1 do
   (print("第",j,"列=第",j,"列-",M_tilde[j,i+n-k],"*第",i,"列=",
            M_tilde[j]:M_tilde[j]-M_tilde[j,i+n-k]*M_tilde[ i ])
   )
  )$
M_tilde;[/color]
第1列=第1列-19*第3列$\displaystyle =[1,0,-\frac{19}{4},0,0,0,0,-266,-4085,-10108]$
第2列=第2列-14*第3列$\displaystyle =[0,\frac{1}{2},-\frac{7}{2},0,0,0,0,-177,-2744,-7087]$
第1列=第1列--266*第4列$\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},0,0,0,0,3363,52136]$
第2列=第2列--177*第4列$\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},0,0,0,0,2212,34331]$
第3列=第3列-14*第4列$\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},0,0,1,0,-158,-2744]$
第1列=第1列-3363*第5列$\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},-\frac{3363}{16},0,0,0,0,-42028]$
第2列=第2列-2212*第5列$\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},-\frac{553}{4},0,0,0,0,-27605]$
第3列=第3列--158*第5列$\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},\frac{79}{8},0,1,0,0,1680]$
第4列=第4列-28*第5列$\displaystyle =[0,0,0,\frac{1}{8},-\frac{7}{4},0,0,1,0,-550]$
第1列=第1列--42028*第6列$\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},-\frac{3363}{16},\frac{10507}{8},0,0,0,0]$
第2列=第2列--27605*第6列$\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},-\frac{553}{4},\frac{27605}{32},0,0,0,0]$
第3列=第3列-1680*第6列$\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},\frac{79}{8},-\frac{105}{2},1,0,0,0]$
第4列=第4列--550*第6列$\displaystyle =[0,0,0,\frac{1}{8},-\frac{7}{4},\frac{275}{16},0,1,0,0]$
第5列=第5列-28*第6列$\displaystyle =[0,0,0,0,\frac{1}{16},-\frac{7}{8},0,0,1,0]$
[color=red](%o27)[/color]　$\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&0&0&0&0&35&0&0&0\cr
0&0&0&0&0&0&0&35&0&0\cr
0&0&0&0&0&0&0&0&1225&0\cr
0&0&0&0&0&0&0&0&0&1225}\right]$

[color=green]將右下角化簡為零[/color]
[color=red](%i29)[/color]
[color=blue]for i:k+1 thru n do
  (j:i+n-k,
print("第",j,"列=第",j,"列-",M_tilde[j,j],"*第",i,"列=",
M_tilde[j]:M_tilde[j]-M_tilde[j,j]*M_tilde[ i ])
  )$
M_tilde;[/color]
第7列=第7列-35*第3列$\displaystyle =[0,0,-\frac{35}{4},\frac{245}{4},-\frac{2765}{8},\frac{3675}{2},0,0,0,0]$
第8列=第8列-35*第4列$\displaystyle =[0,0,0,-\frac{35}{8},\frac{245}{4},-\frac{9625}{16},0,0,0,0]$
第9列=第9列-1225*第5列$\displaystyle =[0,0,0,0,-\frac{1225}{16},\frac{8575}{8},0,0,0,0]$
第10列=第10列-1225*第6列$\displaystyle =[0,0,0,0,0,-\frac{1225}{32},0,0,0,0]$
[color=red](%o29)[/color]　$\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr
0&0&0&0&0&-\frac{1225}{32}&0&0&0&0}\right]$

[color=green]將對角線元素為1的一整列移到整個矩陣下方[/color]
[color=red](%i31)[/color]
[color=blue]for i:k+1 thru n do
  (j:i+n-k,
print("第",i,"列和第",j,"列交換"),
[M_tilde[j],M_tilde[ i ]]:[M_tilde[ i ],M_tilde[j]]
  )$
M_tilde;[/color]
第3列和第7列交換
第4列和第8列交換
第5列和第9列交換
第6列和第10列交換
[color=red](%o31)[/color]　$\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr
0&0&0&0&0&-\frac{1225}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1}\right]$

[color=green]得到左上角矩陣$\widehat{M}$[/color]
[color=red](%i32)[/color]　[color=blue]M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);[/color]
[color=red](M_hat)[/color]　$\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}\cr
0&0&0&0&0&-\frac{1225}{32}}\right]$

[color=green]$\widehat{M}$乘32倍變成整數[/color]
[color=red](%i33)[/color]　[color=blue]M_hat:M_hat*1/delta*X^(n-1);[/color]
[color=red](M_hat)[/color]　$\left[ \matrix{
32&0&-152&1064&-6726&42028\cr
0&16&-112&708&-4424&27605\cr
0&0&-280&1960&-11060&58800\cr
0&0&0&-140&1960&-19250\cr
0&0&0&0&-2450&34300\cr
0&0&0&0&0&-1225}\right]$

[color=green]LLL化簡[/color]
[color=red](%i34)[/color]　[color=blue]B: LLL(M_hat);[/color]
[color=red](B)[/color]　$\left[ \matrix{
0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]$

[color=green]Gram-Schmidt正交化[/color]
[color=red](%i35)[/color]　[color=blue]Bstar:apply(matrix,expand(gramschmidt(B)));[/color]
[color=red](Bstar)[/color]　$\left[ \matrix{\displaystyle
0&160&0&-60&0&-100\cr
-64&-\frac{164}{7}&-88&\frac{907}{14}&-72&-\frac{1069}{14}\cr
\frac{4327744}{55201}&-\frac{213712}{55201}&\frac{2859392}{55201}&-\frac{1388192}{55201}&-\frac{9041940}{55201}&\frac{490976}{55201}\cr
\frac{2396089600}{17933807}&-\frac{673016640}{17933807}&-\frac{1044380280}{17933807}&\frac{154688960}{17933807}&\frac{745216000}{17933807}&-\frac{1169640000}{17933807}\cr
-\frac{2184694400}{45963969}&-\frac{1521655800}{15321323}&\frac{344724800}{15321323}&-\frac{6338718400}{45963969}&\frac{172362400}{45963969}&-\frac{1166905600}{15321323}\cr
-\frac{117600}{17929}&-\frac{627200}{17929}&\frac{3763200}{17929}&\frac{2508800}{17929}&\frac{627200}{17929}&-\frac{2508800}{17929}}\right]$

[color=green]取最後一個正交向量[/color]
[color=red](%i36)[/color]　[color=blue]Bstar_n:Bstar[n];[/color]
[color=red](Bstar_n)[/color]　$\displaystyle \left[-\frac{117600}{17929},-\frac{627200}{17929},\frac{3763200}{17929},\frac{2508800}{17929},\frac{627200}{17929},-\frac{2508800}{17929}\right]$

[color=green]取各分數的分母[/color]
[color=red](%i37)[/color]　[color=blue]Denom:map('denom,Bstar_n);[/color]
[color=red](Denom)[/color]　$[17929,17929,17929,17929,17929,17929]$

[color=green]求最大的分母[/color]
[color=red](%i38)[/color]　[color=blue]MaxDenom:lmax(%);[/color]
[color=red](MaxDenom)[/color]　17929

[color=green]正交向量化為整數[/color]
[color=red](%i39)[/color]　[color=blue]Bstar_n:Bstar_n*MaxDenom;[/color]
[color=red](Bstar_n)[/color]　$[-117600,-627200,3763200,2508800,627200,-2508800]$

[color=green]計算最大公因數[/color]
[color=red](%i40)[/color]　[color=blue]GCD:lreduce('gcd,Bstar_n);[/color]
[color=red](GCD)[/color]　39200

[color=green]同除最大公因數，得到化簡的正交向量[/color]
[color=red](%i41)[/color]　[color=blue]Bstar_n:Bstar_n/GCD;[/color]
[color=red](Bstar_n)[/color]　$[-3,-16,96,64,16,-64]$

[color=green]正交向量和$\displaystyle \left(\frac{x}{X}\right)^i$相乘[/color]
[color=red](%i42)[/color]　[color=blue]hx:sum(Bstar_n[i+1]*(x/X)^i,i,0,n-1);[/color]
[color=red](hx)[/color]　$-2x^5+x^4+8x^3+24x^2-8x-3$

[color=green]將$h(x)$因式分解[/color]
[color=red](%i43)[/color]　[color=blue]factor(hx);[/color]
[color=red](%o43)[/color]　$-(x-3)(2x-1)(x^3+3x^2+5x+1)$

[color=green]得到$h(x)$的解[/color]
[color=red](%i44)[/color]　[color=blue]x:3;[/color]
[color=red](x)[/color]　3

[color=green]驗證答案[/color]
[color=red](%i45)[/color]　[color=blue]ev(mod(px,N),x=3);[/color]
[color=red](%o45)[/color]　0

bugmens 發表於 2021-6-7 19:44

解三次同餘方程式$p(x)=x^3-4x^2-3x-10\pmod{1131}$。

參考資料
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
[url]https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/258484/348751_FULLTEXT01.pdf?sequence=1&isAllowed=y[/url]

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.43.2/share/maxima/5.43.2/share/LLL.mac

[color=green]要先載入eigen.mac才能使用gramschmidt指令[/color]
[color=red](%i2)[/color]　[color=blue]load("eigen.mac");[/color]
[color=red](%o2)[/color]　C:/maxima-5.43.2/share/maxima/5.43.2/share/matrix/eigen.mac

[color=green]要先載入diag.mac才能使用diag指令[/color]
[color=red](%i3)[/color]　[color=blue]load("diag.mac");[/color]
[color=red](%o3)[/color]　C:/maxima-5.43.2/share/maxima/5.43.2/share/contrib/diag.mac

[color=green]同餘方程式$p(x)$[/color]
[color=red](%i4)[/color]　[color=blue]px:x^3-4*x^2-3*x-10;[/color]
[color=red](px)[/color]　$x^3-4x^2-3x-10$

[color=green]$p(x)\equiv 0\pmod{N}$[/color]
[color=red](%i5)[/color]　[color=blue]N:1131;[/color]
[color=red](N)[/color]　1131

[color=green]$p(x)$的次數$k$[/color]
[color=red](%i6)[/color]　[color=blue]k:hipow(px,x);[/color]
[color=red](k)[/color]　3

[color=green]設誤差值$epsilon=0.1$[/color]
[color=red](%i7)[/color]　[color=blue]epsilon:0.1;[/color]
[color=red](epsilon)[/color]　0.1

[color=green]參數h[/color]
[color=red](%i8)[/color]　[color=blue]h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));[/color]
[color=red](h)[/color]　3

[color=green]$\widehat{M}$的維度$n=hk$[/color]
[color=red](%i9)[/color]　[color=blue]n:h*k;[/color]
[color=red](n)[/color]　9

[color=green]參數$\delta$，按照公式應該是$\displaystyle \delta=\frac{1}{3}$，本範例$\displaystyle \delta=\frac{1}{9}$[/color]
[color=red](%i11)[/color]
[color=blue]delta:1/sqrt(h*k);
delta:1/9;[/color]
[color=red](delta)[/color]　$\displaystyle \frac{1}{3}$
[color=red](delta)[/color]　$\displaystyle \frac{1}{9}$

[color=green]希望能找到$|\;x|\;<X=\frac{1}{2}N^{1/k}$，$p(x)\equiv 0\pmod{N}$
按照公式應該是5，本範例$X=6$[/color]
[color=red](%i13)[/color]
[color=blue]X:floor(1/2*N^(1/k));
X:6;[/color]
[color=red](X)[/color]　5
[color=red](X)[/color]　6

[color=green][/color]
[color=red](%i14)[/color]　[color=blue]Xpower:create_list(delta*X^-(i-1),i,1,h*k);[/color]
[color=red](Xpower)[/color]　$\displaystyle \left[\frac{1}{9},\frac{1}{54},\frac{1}{324},\frac{1}{1944},\frac{1}{11664},\frac{1}{69984},\frac{1}{419904},\frac{1}{2519424},\frac{1}{15116544}\right]$

[color=green]左上角矩陣[/color]
[color=red](%i15)[/color]　[color=blue]D1:diag(Xpower);[/color]
[color=red](D1)[/color]　$\left[\matrix{\displaystyle
\frac{1}{9}&0&0&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}}\right]$

[color=green]多項式$x^u\cdot p(x)^v$[/color]
[color=red](%i16)[/color]　[color=blue]xpxpower:create_list(x^u*px^v,v,1,h-1,u,0,k-1);[/color]
[color=red](xpxpower)[/color]　$[x^3-4x^2-3x-10,x(x^3-4x^2-3x-10),x^2(x^3-4x^2-3x-10),(x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]$

[color=green]$x^1,x^2,\ldots,x^{n-1}$[/color]
[color=red](%i17)[/color]　[color=blue]xpower:create_list(x^i,i,1,n-1);[/color]
[color=red](xpower)[/color]　$[x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]$

[color=green]取多項式$x^u\cdot(x)^v$係數，形成右上角矩陣(常數項在最後一行)[/color]
[color=red](%i8)[/color]　[color=blue]A:augcoefmatrix(xpxpower,xpower);[/color]
[color=red](A)[/color]　$\left[\matrix{\displaystyle
-3&-4&1&0&0&0&0&0&-10\cr
-10&-3&-4&1&0&0&0&0&0\cr
0&-10&-3&-4&1&0&0&0&0\cr
60&89&4&10&-8&1&0&0&100\cr
100&60&89&4&10&-8&1&0&0\cr
0&100&60&89&4&10&-8&1&0}\right]$

[color=green]將常數項移到第一行[/color]
[color=red](%i19)[/color]　[color=blue]A:addcol(col(A,h*k),submatrix(A,h*k));[/color]
[color=red](A)[/color]　$\left[\matrix{\displaystyle
-10&-3&-4&1&0&0&0&0&0\cr
0&-10&-3&-4&1&0&0&0&0\cr
0&0&-10&-3&-4&1&0&0&0\cr
100&60&89&4&10&-8&1&0&0\cr
0&100&60&89&4&10&-8&1&0\cr
0&0&100&60&89&4&10&-8&1}\right]$

[color=green]矩陣$A$轉置[/color]
[color=red](%i20)[/color]　[color=blue]A:transpose(A);[/color]
[color=red](A)[/color]　$\left[\matrix{\displaystyle
-10&0&0&100&0&0\cr
-3&-10&0&60&100&0\cr
-4&-3&-10&89&60&100\cr
1&-4&-3&4&89&60\cr
0&1&-4&10&4&89\cr
0&0&1&-8&10&4\cr
0&0&0&1&-8&10\cr
0&0&0&0&1&-8\cr
0&0&0&0&0&1}\right]$

[color=green]左下角0矩陣[/color]
[color=red](%i21)[/color]　[color=blue]Zero:zeromatrix((h-1)*k,h*k);[/color]
[color=red](Zero)[/color]　$\left[\matrix{\displaystyle
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0}\right]$

[color=green]右下角矩陣元素$N^v$[/color]
[color=red](%i22)[/color]　[color=blue]Npower:create_list(N^v,v,1,h-1,u,0,k-1);[/color]
[color=red](Npower)[/color]　$[1131,1131,1131,1279161,1279161,1279161]$

[color=green]右下角矩陣[/color]
[color=red](%i23)[/color]　[color=blue]D2:diag(Npower);[/color]
[color=red](D2)[/color]　$\left[\matrix{\displaystyle
1131&0&0&0&0&0\cr
0&1131&0&0&0&0\cr
0&0&1131&0&0&0\cr
0&0&0&1279161&0&0\cr
0&0&0&0&1279161&0\cr
0&0&0&0&0&1279161}\right]$

[color=green]4個子矩陣合併成矩陣$M$[/color]
[color=red](%i24)[/color]　[color=blue]M:addrow(addcol(D1,A),addcol(Zero,D2));[/color]
[color=red](M)[/color]　$\left[\matrix{\displaystyle
\frac{1}{9}&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr
0&\frac{1}{54}&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr
0&0&\frac{1}{324}&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr
0&0&0&\frac{1}{1944}&0&0&0&0&0&1&-4&-3&4&89&60\cr
0&0&0&0&\frac{1}{11664}&0&0&0&0&0&1&-4&10&4&89\cr
0&0&0&0&0&\frac{1}{69984}&0&0&0&0&0&1&-8&10&4\cr
0&0&0&0&0&0&\frac{1}{419904}&0&0&0&0&0&1&-8&10\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&0&0&0&0&0&1&-8\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]$

[color=green]將矩陣$M$複製成另一個矩陣$\widetilde{M}$，進行矩陣列運算[/color]
[color=red](%i25)[/color]　[color=blue]M_tilde:copymatrix(M)$[/color]

[color=green]將右上角化簡為零[/color]
[color=red](%i27)[/color]
[color=blue]for i:k+1 thru n do
  (for j:1 thru i-1 do
   (print("第",j,"列=第",j,"列-",M_tilde[j,i+n-k],"*第",i,"列=",
            M_tilde[j]:M_tilde[j]-M_tilde[j,i+n-k]*M_tilde[ i ])
   )
  )$
M_tilde;[/color]
[color=red](%o27)[/color]
第1列=第1列--10*第4列$\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},0,0,0,0,0,0,-40,-30,140,890,600\right]$
第2列=第2列--3*第4列$\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},0,0,0,0,0,0,-22,-9,72,367,180\right]$
第3列=第3列--4*第4列$\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},0,0,0,0,0,0,-19,-22,105,416,340\right]$
第1列=第1列--40*第5列$\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},0,0,0,0,0,0,-190,540,1050,4160\right]$
第2列=第2列--22*第5列$\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},0,0,0,0,0,0,-97,292,455,2138\right]$
第3列=第3列--19*第5列$\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},0,0,0,0,0,0,-98,295,492,2031\right]$
第4列=第4列--4*第5列$\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},0,0,0,0,1,0,-19,44,105,416\right]$
第1列=第1列--190*第6列$\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},0,0,0,0,0,0,-980,2950,4920\right]$
第2列=第2列--97*第6列$\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},0,0,0,0,0,0,-484,1425,2526\right]$
第3列=第3列--98*第6列$\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},0,0,0,0,0,0,-489,1472,2423\right]$
第4列=第4列--19*第6列$\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},0,0,0,1,0,0,-108,295,492\right]$
第5列=第5列--4*第6列$\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},0,0,0,0,1,0,-22,44,105\right]$
第1列=第1列--980*第7列$\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},0,0,0,0,0,0,-4890,14720\right]$
第2列=第2列--484*第7列$\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},0,0,0,0,0,0,-2447,7366\right]$
第3列=第3列--489*第7列$\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},0,0,0,0,0,0,-2440,7313\right]$
第4列=第4列--108*第7列$\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},0,0,1,0,0,0,-569,1572\right]$
第5列=第5列--22*第7列$\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},0,0,0,1,0,0,-132,325\right]$
第6列=第6列--8*第7列$\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},0,0,0,0,1,0,-54,84\right]$
第1列=第1列--4890*第8列$\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},\frac{815}{419904},0,0,0,0,0,0,-24400\right]$
第2列=第2列--2447*第8列$\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},\frac{2447}{2519424},0,0,0,0,0,0,-12210\right]$
第3列=第3列--2440*第8列$\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},\frac{305}{314928},0,0,0,0,0,0,-12207\right]$
第4列=第4列--569*第8列$\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},\frac{569}{2519424},0,1,0,0,0,0,-2980\right]$
第5列=第5列--132*第8列$\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},\frac{11}{209952},0,0,1,0,0,0,-731\right]$
第6列=第6列--54*第8列$\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},\frac{1}{46656},0,0,0,1,0,0,-348\right]$
第7列=第7列--8*第8列$\displaystyle =\left[0,0,0,0,0,0,\frac{1}{419904},\frac{1}{314928},0,0,0,0,1,0,-54\right]$
第1列=第1列--24400*第9列$\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},\frac{815}{419904},\frac{1525}{944784},0,0,0,0,0,0\right]$
第2列=第2列--12210*第9列$\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},\frac{2447}{2519424},\frac{2035}{2519424},0,0,0,0,0,0\right]$
第3列=第3列--12207*第9列$\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},\frac{305}{314928},\frac{4069}{5038848},0,0,0,0,0,0\right]$
第4列=第4列--2980*第9列$\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},\frac{569}{2519424},\frac{745}{3779136},1,0,0,0,0,0\right]$
第5列=第5列--731*第9列$\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},\frac{11}{209952},\frac{731}{15116544},0,1,0,0,0,0\right]$
第6列=第6列--348*第9列$\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},\frac{1}{46656},\frac{29}{1259712},0,0,1,0,0,0\right]$
第7列=第7列--54*第9列$\displaystyle =\left[0,0,0,0,0,0,\frac{1}{419904},\frac{1}{314928},\frac{1}{279936},0,0,0,1,0,0\right]$
第8列=第8列--8*第9列$\displaystyle =\left[0,0,0,0,0,0,0,\frac{1}{2519424},\frac{1}{1889568},0,0,0,0,1,0\right]$
\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]\)

[color=green]將右下角化簡為零[/color]
[color=red](%i29)[/color]
[color=blue]for i:k+1 thru n do
  (j:i+n-k,
print("第",j,"列=第",j,"列-",M_tilde[j,j],"*第",i,"列=",
M_tilde[j]:M_tilde[j]-M_tilde[j,j]*M_tilde[ i ])
  )$
M_tilde;[/color]
[color=red](%o29)[/color]
第10列=第10列-1131*第4列$\displaystyle =\left[0,0,0,-\frac{377}{648},-\frac{377}{972},-\frac{7163}{23328},-\frac{377}{1296},-\frac{214513}{839808},-\frac{280865}{1259712},0,0,0,0,0,0\right]$
第11列=第11列-1131*第5列$\displaystyle =\left[0,0,0,0,-\frac{377}{3888},-\frac{377}{5832},-\frac{4147}{69984},-\frac{4147}{69984},-\frac{275587}{5038848},0,0,0,0,0,0\right]$
第12列=第12列-1131*第6列$\displaystyle =\left[0,0,0,0,0,-\frac{377}{23328},-\frac{377}{17496},-\frac{377}{15552},-\frac{10933}{419904},0,0,0,0,0,0\right]$
第13列=第13列-1279161*第7列$\displaystyle =\left[0,0,0,0,0,0,-\frac{142129}{46656},-\frac{142129}{34992},-\frac{142129}{31104},0,0,0,0,0,0\right]$
第14列=第14列-1279161*第8列$\displaystyle =\left[0,0,0,0,0,0,0,-\frac{142129}{279936},-\frac{142129}{209952},0,0,0,0,0,0\right]$
第15列=第15列-1279161*第9列$\displaystyle =\left[0,0,0,0,0,0,0,0,-\frac{142129}{1679616},0,0,0,0,0,0\right]$
\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0}\right]\)

[color=green]將對角線元素為1的一整列移到整個矩陣下方[/color]
[color=red](%i31)[/color]
[color=blue]for i:k+1 thru n do
  (j:i+n-k,
print("第",i,"列和第",j,"列交換"),
[M_tilde[j],M_tilde[ i ]]:[M_tilde[ i ],M_tilde[j]]
  )$
M_tilde;[/color]
[color=red](%o31)[/color]
第4列和第10列交換
第5列和第11列交換
第6列和第12列交換
第7列和第13列交換
第8列和第14列交換
第9列和第15列交換
\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1}\right]\)

[color=green]得到左上角矩陣$\widehat{M}$[/color]
[color=red](%i32)[/color]　[color=blue]M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);[/color]
[color=red](M_hat)[/color]　$\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}}\right]$

[color=green]$\widehat{M}$變成整數[/color]
[color=red](%i33)[/color]　[color=blue]M_hat:M_hat*1/delta*X^(n-1);[/color]
[color=red](M_hat)[/color]　$\left[\matrix{\displaystyle
1679616&0&0&77760&51840&41040&35280&29340&24400\cr
0&279936&0&23328&28512&20952&17424&14682&12210\cr
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&0&0&-8794656&-5863104&-4641624&-4397328&-3861234&-3370380\cr
0&0&0&0&-1465776&-977184&-895752&-895752&-826761\cr
0&0&0&0&0&-244296&-325728&-366444&-393588\cr
0&0&0&0&0&0&-46049796&-61399728&-69074694\cr
0&0&0&0&0&0&0&-7674966&-10233288\cr
0&0&0&0&0&0&0&0&-1279161}\right]$

[color=green]LLL化簡[/color]
[color=red](%i34)[/color]　[color=blue]B: LLL(M_hat);[/color]
[color=red](B)[/color]　$\left[\matrix{\displaystyle
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&279936&-46656&-7776&3888&-216&-180&42&3\cr
0&0&186624&124416&98496&-159624&-255312&-307884&-344760\cr
0&0&-46656&-31104&-24624&223128&308124&351804&-897780\cr
0&0&513216&342144&-1194912&-255744&-50652&-1824&94692\cr
1679616&0&-46656&46656&27216&19872&17676&14700&12193\cr
0&0&-513216&-342144&-270864&2210112&3063636&-4171566&-35880\cr
0&559872&3825792&-6197472&610416&67608&-231696&55866&135297\cr
0&0&-559872&-373248&-4692816&20511144&-17352684&1982268&-265239}\right]$

[color=green]Gram-Schmidt正交化[/color]
[color=red](%i35)[/color]　[color=blue]Bstar:apply(matrix,expand(gramschmidt(B)));[/color]
[color=red](Bstar)[/color]　矩陣太大不列出來

[color=green]取最後一個正交向量[/color]
[color=red](%i36)[/color]　[color=blue]Bstar_n:Bstar[n];[/color]
[color=red](Bstar_n)[/color]　$\displaystyle \left[-\frac{6714060256800}{194554091},-\frac{24170616924480}{194554091},-\frac{215118490627872}{194554091},-\frac{58009480618752}{194554091},-\frac{870142209281280}{194554091},\frac{4176682604550144}{194554091},-\frac{3132511953412608}{194554091},0,0\right]$

[color=green]取各分數的分母[/color]
[color=red](%i37)[/color]　[color=blue]Denom:map('denom,Bstar_n);[/color]
[color=red](Denom)[/color]　$\left[194554091,194554091,194554091,194554091,194554091,194554091,194554091,1,1\right]$

[color=green]求最大的分母[/color]
[color=red](%i38)[/color]　[color=blue]MaxDenom:lmax(%);[/color]
[color=red](MaxDenom)[/color]　194554091

[color=green]正交向量化為整數[/color]
[color=red](%i39)[/color]　[color=blue]Bstar_n:Bstar_n*MaxDenom;[/color]
[color=red](Bstar_n)[/color]　$\left[-6714060256800,-24170616924480,-215118490627872,-58009480618752,-870142209281280,4176682604550144,-3132511953412608,0,0\right]$

[color=green]計算最大公因數[/color]
[color=red](%i40)[/color]　[color=blue]GCD:lreduce('gcd,Bstar_n);[/color]
[color=red](GCD)[/color]　268562410272

[color=green]同除最大公因數，得到化簡的正交向量[/color]
[color=red](%i41)[/color]　[color=blue]Bstar_n:Bstar_n/GCD;[/color]
[color=red](Bstar_n)[/color]　$\left[-25,-90,-801,-216,-3240,15552,-11664,0,0\right]$

[color=green]正交向量和$\displaystyle \left(\frac{x}{X}\right)^{i}$相乘[/color]
[color=red](%i42)[/color]　[color=blue]hx:sum(Bstar_n[i+1]*(x/X)^i,i,0,n-1);[/color]
[color=red](hx)[/color]　$\displaystyle -\frac{1}{4}x^6+2x^5-\frac{5}{2}x^4-x^3-\frac{89}{4}x^2-15x-25$

[color=green]取$h(x)$各項係數[/color]
[color=red](%i43)[/color]　[color=blue]coef:augcoefmatrix([hx],xpower);[/color]
[color=red](coef)[/color]　$\left[\matrix{\displaystyle -15&-\frac{89}{4}&-1&-\frac{5}{2}&2&-\frac{1}{4}&0&0&-25}\right]$

[color=green]取$h(x)$係數的分母[/color]
[color=red](%i44)[/color]　[color=blue]Denom:map('denom,args(coef)[1]);[/color]
[color=red](Denom)[/color]　$[1,4,1,2,1,4,1,1,1]$

[color=green]求最大的分母[/color]
[color=red](%i45)[/color]　[color=blue]MaxDenom:lmax(Denom);[/color]
[color=red](MaxDenom)[/color]　4

[color=green]將$h(x)$化成整數[/color]
[color=red](%i46)[/color]　[color=blue]hx:expand(hx*MaxDenom);[/color]
[color=red](hx)[/color]　$-x^6+8x^5-10x^4-4x^3-89x^2-60x-100$

[color=green]將$h(x)$因式分解[/color]
[color=red](%i47)[/color]　[color=blue]factor(hx);[/color]
[color=red](%o47)[/color]　$-(x-5)^2(x^2+x+2)^2$

[color=green]得到$h(x)$的解[/color]
[color=red](%i48)[/color]　[color=blue]x:5;[/color]
[color=red](x)[/color]　5

[color=green]驗證答案[/color]
[color=red](%i49)[/color]　[color=blue]ev(mod(px,N),x=5);[/color]
[color=red](%o49)[/color]　0

bugmens 發表於 2021-6-19 17:56

Howgrave-Graham論文中回顧Coppersmith方法，但步驟3,4又和Coppersmith有些許不同，本文章就之前範例說明。[table][tr][td][align=center]方法[/align][/td][td][align=center]範例[/align][/td][/tr]
[tr][td=2,1][b][align=center]步驟1：計算參數$h$和$X$(和Coppersmith相同)[/align][/b][/td][/tr]
[tr][td=2,1][b][align=center]步驟2：產生矩陣$M$(和Coppersmith相同)[/align][/b][/td][/tr]
[tr][td=2,1][b][align=center]步驟3：矩陣$M$基本列運算得到$\widehat{M}$，計算$[r(x)H_1^{-1}]_{sh}$[/align][/b][/td][/tr]
[tr][td]因為$p(x)$為monic(最高次方項係數為1)，在矩陣$A$的對角線元素為1，進行基本列運算將右上角化簡為零，右下角化簡為零，再將對角線元素為1的一整列移到整個矩陣下方。
$\widetilde{M}=H_1M=\left[\matrix{\widehat{M}&│&0_{(hk\times (h-1)k)}\cr ―&┼&――――――\cr A'&│&I_{(h-1)k}}\right]$
得到左上角矩陣$\widehat{M}$
計算矩陣$H_1^{-1}=M\widetilde{M}^{-1}$
$r(x)=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-y_0,-x_0y_0,-y_0^2,-x_0y_0^2]$
又$p(x_0)\equiv 0\pmod{N}$，$p(x_0)=y_0N$，$\displaystyle y_0=\frac{p(x_0)}{N}$
$\displaystyle r(x)=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-\frac{p(x_0)}{N},-\frac{x_0p(x_0)}{N},-\frac{p^2(x_0)}{N},-\frac{x_0p^2(x_0)}{N}]$
計算$\displaystyle p(x_0)H_1^{-1}$
將後面的0刪除$\displaystyle [p(x_0)H_1^{-1}]_{sh}$
[/td][td]$H_1^{-1}=M\widetilde{M}^{-1}=\left[\matrix{
1&&&&&&19&0&361&0\cr
&1&&&&&14&19&532&361\cr
&&&&&&1&14&234&532\cr
&&&&&&&1&28&234\cr
&&&&&&&&1&28\cr
&&&&&&&&&1\cr
&&1&&&&35&&&\cr
&&&1&&&&35&&\cr
&&&&1&&&&1225&\cr
&&&&&1&&&&1225} \right]$
$\displaystyle r(x)=(1,x,x^2,x^3,x^4,x^5,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2})$
$r(x)H_1^{-1}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2},$
　　　　　$19+14x+x^2-p(x),$
　　　　　$19x+14x^2+x^3-xp(x),$
　　　　　$361+532x+234x^2+28x^3+x^4-p^2(x),$
　　　　　$361x+532x^2+234x^3+28x^4+x^5-xp^2(x))$
$r(x)H_1^{-1}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2},0,0,0,0)$
$\left[r(x)H_1^{-1}\right]_{sh}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2})$[/td][/tr]
[tr][td=2,1][b][align=center]步驟4：經LLL化簡和計算矩陣$H_2^{-1}$得到不需要同餘$N$的方程式[/align][/b][/td][/tr]
[tr][td]$B_2=LLL(\widehat{M})$
計算$B_2=H_2\widehat{M}$，$H_2^{-1}=\widehat{M}B_2^{-1}$
$r'_{hk}(x)=[r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T$
解出$x$[/td][td]
$\widehat{M}=\left[\matrix{
32&0&-152&1064&-6726&42028\cr
&16&-112&708&-4424&27605\cr
&&-280&1960&-11060&58800\cr
&&&-140&1960&-19250\cr
&0&&&-2450&34300\cr
&&&&&-1225}\right]$
$B=LLL(\widehat{M})=\left[\matrix{0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]$

$H_2^{-1}=\widehat{M}B_2^{-1}=\left[\matrix{-166&-125&-9&-111&-73&-70\cr
-109&-82&-6&-73&-48&-46\cr
-231&-171&-7&-157&-104&-98\cr
77&60&8&50&32&32\cr
-138&-109&-18&-88&-56&-57\cr
5&4&1&3&2&2}\right]$
$((H_2^{-1})_{6})^T=\left[-70,-46,-98,32,-57,2\right]$
$\displaystyle [r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_6)^T=-70\cdot 1-46x+98\frac{p(x)}{35}-32\frac{xp(x)}{35}+57\frac{p^2(x)}{35^2}-2\frac{xp^2(x)}{35^2}$
$\displaystyle h(x)=\frac{-1}{1225}(2x^5-x^4-8x^3-24x^2+8x+3)$
　　$\displaystyle =\frac{-1}{1225}(x-3)(2x-1)(x^3+3x^2+5x+1)$
解方程式得到答案
$x=3$[/td][/tr][/table]
註：
1.原論文用$c(x)$，本文章和Coppersmith一致用$r(x)$。
2.原論文的$\widehat{M}$有行列互換，但本文章沒有行列互換，但不影響計算過程。
原論文
$\widetilde{M}=\left[\matrix{
-1225&&&&&\cr
34300&-2450&&&&\cr
-19250&1960&-140&&&\cr
58800&-11060&1960&-280&&\cr
27605&-4424&708&-112&16&\cr
42028&-6726&1064&-152&0&32}\right]$，$H_2^{-1}=\left[\matrix{
-5&4&-2&1&-1&-2\cr
138&-109&56&-18&31&57\cr
-77&60&-32&8&-18&-32\cr
231&-171&104&-7&59&98\cr
109&-82&48&-6&27&46\cr
166&-125&73&-9&41&70}\right]$
本文章
$\widetilde{M}=\left[\matrix{
32&0&-152&1064&-6726&42028\cr
&16&-112&708&-4424&27605\cr
&&-280&1960&-11060&58800\cr
&&&-140&1960&-19250\cr
&&&&-2450&34300\cr
&&&&&-1225}\right]$，$H_2^{-1}=\left[\matrix{
-166&-125&-9&-111&-73&-70\cr
-109&-82&-6&-73&-48&-46\cr
-231&-171&-7&-157&-104&-98\cr
77&60&8&50&32&32\cr
-138&-109&-18&-88&-56&-57\cr
5&4&1&3&2&2}\right]$

參考資料：
N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997.
[url]https://link.springer.com/chapter/10.1007/BFb0024458[/url]

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

[color=green]同餘方程式[/color]
[color=red](%i2)[/color]　[color=blue]px:x^2+14*x+19;[/color]
[color=red](px)[/color]　$x^2+14x+19$

[color=green]$p(x)\equiv 0\pmod{N}$[/color]
[color=red](%i3)[/color]　[color=blue]N:35;[/color]
[color=red](N)[/color]　35

[color=green]$p(x)$的次數$k$[/color]
[color=red](%i4)[/color]　[color=blue]k:hipow(px,x);[/color]
[color=red](k)[/color]　2

[color=green]設誤差值$epsilon=0.1$[/color]
[color=red](%i5)[/color]　[color=blue]epsilon:0.1;[/color]
[color=red](epsilon)[/color]　0.1

[color=green]參數$h$[/color]
[color=red](%i7)[/color]
[color=blue]h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
h:3;[/color]
[color=red](h)[/color]　4
[color=red](h)[/color]　3

[color=green]$\widehat{M}$的維度$n=hk$[/color]
[color=red](%i8)[/color]　[color=blue]n:h*k;[/color]
[color=red](n)[/color]　6

[color=green]參數$\delta$，按照公式應該是$\displaystyle \delta=\frac{1}{\sqrt{6}}$，本範例$\delta=1$[/color]
[color=red](%i10)[/color]
[color=blue]delta:1/sqrt(h*k);
delta:1;[/color]
[color=red](delta)[/color]　$\displaystyle \frac{1}{\sqrt{6}}$
[color=red](delta)[/color]　1

[color=green]希望能找到$|\;x|\;<X=\frac{1}{2}N^{1/k}$，$p(x)\equiv 0\pmod{N}$[/color]
[color=red](%i11)[/color]　[color=blue]X:floor(1/2*N^(1/k));[/color]
[color=red](X)[/color]　2

[color=green]產生矩陣$M$[/color]
[color=red](%i14)[/color]
[color=blue]kill(genlattice)$
genlattice[i,j]:=(
v:floor((k+j-h*k-1)/k),
u: (j-h*k-1)-k*(v-1),
if i<=h*k and j<=h*k then if i=j then delta*X^(1-i) else 0/*左上角矩陣*/
else if i<=h*k and j>h*k then (coeff(expand(x^u*px^v),x,i-1))/*右上角矩陣*/
else if i>h*k and j<=h*k then 0/*左下角矩陣*/
else if i>h*k and j>h*k then if i=j then N^v else 0)$/*右下角矩陣*/
M:genmatrix(genlattice,2*h*k-k,2*h*k-k);[/color]
[color=red](M)[/color]　$\left[\matrix{\displaystyle
1&0&0&0&0&0&19&0&361&0\cr
0&\frac{1}{2}&0&0&0&0&14&19&532&361\cr
0&0&\frac{1}{4}&0&0&0&1&14&234&532\cr
0&0&0&\frac{1}{8}&0&0&0&1&28&234\cr
0&0&0&0&\frac{1}{16}&0&0&0&1&28\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&0&0&0&0&35&0&0&0\cr
0&0&0&0&0&0&0&35&0&0\cr
0&0&0&0&0&0&0&0&1225&0\cr
0&0&0&0&0&0&0&0&0&1225}\right]$

[color=green]將矩陣$M$複製成另一個矩陣$\widetilde{M}$[/color]
[color=red](%i15)[/color]　[color=blue]M_tilde:copymatrix(M)$[/color]

[color=green]矩陣$\widetilde{M}$進行矩陣列運算[/color]
[color=red](%i17)[/color]
[color=blue]for i:n thru k+1 step -1 do
  (for j:1 thru i-1 do
   (M_tilde:rowop(M_tilde,j,i,M_tilde[j,i+n-k])),/*消掉右上角*/
j:i+n-k,
M_tilde:rowop(M_tilde,j,i,M_tilde[j,j]),/*消掉右下角N^v*/
M_tilde:rowswap(M_tilde,i,j)/*列交換*/
)$
M_tilde;[/color]
[color=red](%o17)[/color]　$\left[\matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr
0&0&0&0&0&-\frac{1225}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1}\right]$

[color=green]計算矩陣$H_1^{-1}=M\widetilde{M}^{-1}$[/color]
[color=red](%i18)[/color]　[color=blue]H1_inv:M.invert(M_tilde);[/color]
[color=red](H1_inv)[/color]　$\left[\matrix{\displaystyle
1&0&0&0&0&0&19&0&361&0\cr
0&1&0&0&0&0&14&19&532&361\cr
0&0&0&0&0&0&1&14&234&532\cr
0&0&0&0&0&0&0&1&28&234\cr
0&0&0&0&0&0&0&0&1&28\cr
0&0&0&0&0&0&0&0&0&1\cr
0&0&1&0&0&0&35&0&0&0\cr
0&0&0&1&0&0&0&35&0&0\cr
0&0&0&0&1&0&0&0&1225&0\cr
0&0&0&0&0&1&0&0&0&1225}\right]$

[color=green]產生$r(x)$[/color]
[color=red](%i19)[/color]　[color=blue]rx:create_list(x^i,i,0,h*k-1);[/color]
[color=red](rx)[/color]　$\left[1,x,x^2,x^3,x^4,x^5\right]$

[color=green]產生$r(x)$[/color]
[color=red](%i21)[/color]
[color=blue]for j:1 thru h*k-k do
  (print("j=",j,
         ",v=floor(","k+j-1"/"k",")=floor(",(k+j-1)/k,")=",v:floor((k+j-1)/k),
         ",u=(j-1)-k(v-1)=(",j,"-1)-",k,"(",v,"-1)","=",u: (j-1)-k*(v-1),
         ",-","x"^"u"*"p(x)"^"v"/"N"^"v","=","-","x"^u*"p(x)"^v/"N"^v),
rx:append(rx,[-x^u*px^v/N^v])
  )$
rx;[/color]
$\displaystyle j=1,v=floor(\frac{k+j-1}{k})=floor(1)=1,u=(j-1)-k(v-1)=(1-1)-2(1-1)=0,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)}{N}$
$\displaystyle j=2,v=floor(\frac{k+j-1}{k})=floor(\frac{3}{2})=1,u=(j-1)-k(v-1)=(2-1)-2(1-1)=1,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)x}{N}$
$\displaystyle j=3,v=floor(\frac{k+j-1}{k})=floor(2)=2,u=(j-1)-k(v-1)=(3-1)-2(2-1)=0,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)^2}{N^2}$
$\displaystyle j=4,v=floor(\frac{k+j-1}{k})=floor(\frac{5}{2})=2,u=(j-1)-k(v-1)=(4-1)-2(2-1)=1,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)^2x}{N^2}$
[color=red](%o21)[/color]　$\displaystyle \left[1,x,x^2,x^3,x^4,x^5,\frac{-x^2-14x-19}{35},-\frac{x(x^2+14x+19)}{35},-\frac{(x^2+14x+19)^2}{1225},-\frac{x(x^2+14x+19)^2}{1225}\right]$

[color=green]計算$r(x)H_1^{-1}$[/color]
[color=red](%i22)[/color]　[color=blue]rxH1_inv:args(rx.H1_inv)[1];[/color]
[color=red](rxH1_inv)[/color]　$\displaystyle [1,x,\frac{-x^2-14x-19}{35},-\frac{x(x^2+14*x+19)}{35},-\frac{(x^2+14x+19)^2}{1225},-\frac{x(x^2+14x+19)^2}{1225},0,$
　　　　　　$x^3-x(x^2+14x+19)+14x^2+19x,$
　　　　　　$-(x^2+14x+19)^2+x^4+28x^3+234x^2+532x+361,$
　　　　　　$-x(x^2+14x+19)^2+x^5+28x^4+234x^3+532x^2+361x]$

[color=green]其中$r(x)H_1^{-1}$後面化簡為0[/color]
[color=red](%i23)[/color]　[color=blue]rxH1_inv:ratsimp(rxH1_inv);[/color]
[color=red](rxH1_inv)[/color]　$\displaystyle \left[1,x,-\frac{x^2+14x+19}{35},-\frac{x^3+14x^2+19x}{35},-\frac{x^4+28x^3+234x^2+532x+361}{1225},-\frac{x^5+28x^4+234x^3+532x^2+361x}{1225},0,0,0,0\right]$

[color=green]縮短$r(x)H_1^{-1}$長度[/color]
[color=red](%i24)[/color]　[color=blue]rxH1_inv_short:rest(rxH1_inv,-(h*k-k));[/color]
[color=red](rxH1_inv_short)[/color]　$\displaystyle \left[1,x,-\frac{x^2+14x+19}{35},-\frac{x^3+14x^2+19x}{35},-\frac{x^4+28x^3+234x^2+532x+361}{1225},-\frac{x^5+28x^4+234x^3+532x^2+361x}{1225}\right]$

[color=green]得到左上角矩陣$\widehat{M}$[/color]
[color=red](%i25)[/color]　[color=blue]M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);[/color]
[color=red](M_hat)[/color]　$\left[\matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}\cr
0&0&0&0&0&-\frac{1225}{32}}\right]$

[color=green]$\widehat{M}$乘32倍變成整數[/color]
[color=red](%i26)[/color]　[color=blue]M_hat:M_hat*1/delta*X^(n-1);[/color]
[color=red](M_hat)[/color]　$\left[\matrix{\displaystyle
32&0&-152&1064&-6726&42028\cr
0&16&-112&708&-4424&27605\cr
0&0&-280&1960&-11060&58800\cr
0&0&0&-140&1960&-19250\cr
0&0&0&0&-2450&34300\cr
0&0&0&0&0&-1225}\right]$

[color=green]LLL化簡[/color]
[color=red](%i27)[/color]　[color=blue]B2: LLL(M_hat);[/color]
[color=red](B2)[/color]　$\left[\matrix{\displaystyle
0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]$

[color=green]計算矩陣$H_2^{-1}=\widehat{M}B_2^{-1}$[/color]
[color=red](%i28)[/color]　[color=blue]H2_inv:M_hat.invert(B2);[/color]
[color=red](H2_inv)[/color]　$\left[\matrix{\displaystyle
-166&-125&-9&-111&-73&-70\cr
-109&-82&-6&-73&-48&-46\cr
-231&-171&-7&-157&-104&-98\cr
77&60&8&50&32&32\cr
-138&-109&-18&-88&-56&-57\cr
5&4&1&3&2&2}\right]$

[color=green]取矩陣$H_2^{-1}$最後一行[/color]
[color=red](%i29)[/color]　[color=blue]H2_inv_lastcolumn:transpose(col(H2_inv,n));[/color]
[color=red](H2_inv_lastcolumn)[/color]　$[\matrix{-70&-46&-98&32&-57&2}]$

[color=green]將$[r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T$相乘[/color]
[color=red](%i30)[/color]　[color=blue]hx:rxH1_inv_short.H2_inv_lastcolumn;[/color]
[color=red](hx)[/color]　$\displaystyle -\frac{2(x^5+28x^4+234x^3+532x^2+361x)}{1225}+\frac{57(x^4+28x^3+234x^2+532x+361)}{1225}-\frac{32(x^3+14x^2+19x)}{35}+\frac{14(x^2+14x+19)}{5}-46x-70$

[color=green]將$h(x)$因式分解[/color]
[color=red](%i31)[/color]　[color=blue]factor(hx);[/color]
[color=red](%o31)[/color]　$\displaystyle -\frac{(x-3)(2x-1)(x^3+3x^2+5x+1)}{1225}$

[color=green]得到$h(x)$的解[/color]
[color=red](%i32)[/color]　[color=blue]x:3;[/color]
[color=red](x)[/color]　3

[color=green]驗證答案[/color]
[color=red](%i33)[/color]　[color=blue]ev(mod(px,N),x=3);[/color]
[color=red](%o33)[/color]　0

bugmens 發表於 2021-6-19 18:16

bugmens 發表於 2021-6-29 10:42

當初Coppersmith的方法比較麻煩，Howgrave-Graham提供改良的方法，方法如下。[table][tr][td][align=center]方法[/align][/td][td][align=center]範例[/align][/td][/tr]
[tr][td=2,1][align=center][b]問題敘述[/b][/align][/td][/tr]
[tr][td]設同餘方程式為$p(x)=x^k+a_{k-1}x^{k-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}$
且$p(x)$為monic(最高次方項係數為1)且不可分解。
利用LLL方法可以找出比邊界$X$還小的解$x_0$($\displaystyle |\;x_0|\;<X$)
使得$p(x_0)\equiv 0 \pmod{N}$[/td][td]設同餘方程式為$p(x)=x^2+14x+19\equiv 0\pmod{35}$
且$p(x)$為monic(最高次方項係數為1)且不可分解。
利用LLL方法可以找出比邊界$X$還小的解
使得$p(x_0)\equiv 0 \pmod{35}$[/td][/tr]
[tr][td=2,1][align=center][b]步驟1：計算參數$h$和$X$[/b][/align][/td][/tr]
[tr][td]$h\ge 2$
$\displaystyle X=\lceil\;2^{-\frac{1}{2}}(hk)^{-\frac{1}{hk-1}}N^{\frac{h-1}{hk-1}}\rceil\;-1$[/td][td]$h=3$
$k=2$
$X=\lceil\;2^{-\frac{1}{2}}\cdot 6^{-\frac{1}{5}}\cdot 35^{\frac{2}{5}}\rceil\;-1=\lceil\;2.0487\rceil\;-1=3-1=2$[/td][/tr]
[tr][td=2,1][align=center][b]步驟2：產生矩陣$M$[/b][/align][/td][/tr]
[tr][td]定義三角$(hk)\times(hk)$矩陣$M=(m_{i,j})$，$m_{i,j}=e_{i,j}X^{j-1}$
$e_{i,j}$是$q_{u,v}(x)=N^{(h-1-v)}x^u(p(x))^v$的$\displaystyle x^{j-1}$項係數
其中$\displaystyle v=\lfloor\;\frac{i-1}{k}\rfloor\;$和$u=(i-1)-kv$
注意到對所有$u,v\ge 0$，$q_{u,v}(x_0)\equiv 0\pmod{N^{h-1}}$
－－－－－－－－－－－－－－－－－－－－－－－
以$h=3,k=2$為例計算$det(M)$
$M=\left[\matrix{N^2&&&&&\cr
0&N^2X^1&&&&\cr
*&*&NX^2&&&\cr
0&*&*&NX^3&&\cr
*&*&*&*&X^4&\cr
0&*&*&*&*&X^5}\right]$
*代表非零數字
因為$M$為下三角矩陣，行列式值為對角線元素相乘
$det(M)=(N^2\cdot N^2X^1)\cdot (NX^2\cdot NX^3)\cdot(X^4\cdot X^5)$
　　　$=X^{0+1+2+3+4+5}N^{2(2+1+0)}$
　　　$=X^{15}N^6$
－－－－－－－－－－－－－－－－－－－－－－－
有上面的經驗改計算$det(M)$的一般式
維度$(hk)\times(hk)$矩陣$M$的對角線元素為
$\displaystyle [(N^{h-1},N^{h-1}X^1,\ldots,N^{h-1}X^{k-1}),$有$k$個
$\displaystyle (N^{h-2}X^k,N^{h-2},X^{k+1},\ldots,N^{h-2}X^{2k-1}),$有$k$個
⋯
$\displaystyle (X^{hk-k},\ldots,X^{hk-1})]$有$k$個
因為$M$為下三角矩陣，行列式值為對角線元素相乘
$det(M)=X^{0+1+\ldots+(hk-1)}N^{k[(h-1)+(h-2)+\ldots+0]}$
　　　$=X^{\frac{hk(hk-1)}{2}}N^{\frac{hk(h-1)}{2}}$[/td][td]$i=1$，$\displaystyle v=\lfloor\;\frac{1-1}{2}\rfloor\;=0$，$u=(1-1)-2\cdot 0=0$
$q_{0,0}(x)=N^{3-1-0}x^0(x^2+14x+19)^0=1225$
$i=2$，$\displaystyle v=\lfloor\;\frac{2-1}{2}\rfloor\;=0$，$u=(2-1)-2\cdot 0=1$
$q_{1,0}(x)=N^{3-1-0}x^1(x^2+14x+19)^0=1225x$
$i=3$，$\displaystyle v=\lfloor\;\frac{3-1}{2}\rfloor\;=1$，$u=(3-1)-2\cdot 1=0$
$q_{0,1}(x)=N^{3-1-1}x^0(x^2+14x+19)^1=665+490x+35x^2$
$i=4$，$\displaystyle v=\lfloor\;\frac{4-1}{2}\rfloor\;=1$，$u=(4-1)-2\cdot 1=1$
$q_{1,1}(x)=N^{3-1-1}x^1(x^2+14x+19)^1=665x+490x^2+35x^3$
$i=5$，$\displaystyle v=\lfloor\;\frac{5-1}{2}\rfloor\;=2$，$u=(5-1)-2\cdot 2=0$
$q_{0,2}(x)=N^{3-1-2}x^0(x^2+14x+19)^2=361+532x+234x^2+28x^3+x^4$
$i=6$，$\displaystyle v=\lfloor\;\frac{6-1}{2}\rfloor\;=2$，$u=(6-1)-2\cdot 2=1$
$q_{1,2}(x)=N^{3-1-2}x^1(x^2+14x+19)^2=361x+532x^2+234x^3+28x^4+x^5$
$m_{i,j}=e_{i,j}X^{j-1}$，$x^{j-1}$次方係數乘上$2^{j-1}$
　　　　　常數項　1次方　　2次方　　3次方　　4次方　　5次方
$M=\matrix{q_{0,0}(x)\cr q_{1,0}(x)\cr q_{0,1}(x)\cr q_{1,1}(x)\cr q_{0,2}(x)\cr q_{1,2}(x)}\left[\matrix{1225&&&&0&\cr
0&1225\times 2&&&&\cr
665&490\times 2&35\times 2^2&&&\cr
0&665\times 2&490\times 2^2&35\times 2^3&&\cr
361&532\times 2&234 \times 2^2&28\times 2^3&2^4&\cr
0&361\times 2&532\times 2^2&234\times 2^3&28\times 2^4&2^5} \right]$
$det(M)=2^{15}35^6$[/td][/tr]
[tr][td=2,1][align=center][b]步驟3：經LLL化簡後的短向量產生不需要同餘$N^{h-1}$的方程式[/b][/align][/td][/tr]
[tr][td]矩陣$M$經LLL化簡為$B$
$B=LLL(M)$
lattice經LLL化簡後第一行$b_1$為整個lattice中較短向量
所形成的方程式不需要再同餘$N$
－－－－－－－－－－－－－－－－－－－
設$B$是矩陣$M$經LLL化簡後的矩陣，矩陣$B$的第一列短向量$b_1$
從$\displaystyle det(M)=X^{\frac{hk(hk-1)}{2}}N^{\frac{hk(h-1)}{2}}$和引理$\Vert\;b_1\Vert\;\le 2^{(n-1)/4}\cdot (det(L))^{1/n}$
得知$\Vert\;b_1\Vert\;\le 2^{\frac{hk-1}{4}}X^{\frac{hk-1}{2}}N^{\frac{h-1}{2}}$
設整數向量$c$，長度為$n$，$(c\in Z^n)$
$b_1=cM$，其中$\displaystyle b_{1,j}=\sum_{i=1}^{hk}c_im_{i,j}=\sum_{i=1}^{hk}c_ie_{i,j}X^{j-1}$
$[b_{1,1},b_{1,2},\ldots,b_{1,hk}]=[c_1,c_2,\ldots,c_{hk}]\left[\matrix{m_{1,1}&m_{1,2}&\ldots&m_{1,hk}\cr
m_{2,1}&m_{2,2}&\ldots&m_{2,hk}\cr
\vdots&\vdots&&\vdots\cr
m_{hk,1}&m_{hk,2}&\ldots&m_{hk,hk}}\right]$
$[b_{1,1},b_{1,2},\ldots,b_{1,hk}]=[c_1,c_2,\ldots,c_{hk}]\left[\matrix{e_{1,1}&e_{1,2}X&\ldots&e_{1,hk}X^{hk-1}\cr
e_{2,1}&e_{2,2}X&\ldots&e_{2,hk}X^{hk-1}\cr
\vdots&\vdots&&\vdots\cr
e_{hk,1}&e_{hk,2}X&\ldots&e_{hk,hk}X^{hk-1}}\right]$
設向量長度$\displaystyle \Vert\;b_1\Vert\;_2=\sqrt{\sum_{j=1}^{hk} b_{1j}^2}$，$\displaystyle \Vert\;b_1\Vert\;_1=\sum_{j=1}^{hk} |\;b_{1j}|\;$
[url]https://en.wikipedia.org/wiki/Norm_(mathematics)[/url]
$\displaystyle \Vert\;b_1\Vert\;_2\ge \frac{1}{\sqrt{hk}}\Vert\;b_1\Vert\;_1$
　　　$\displaystyle =\frac{1}{\sqrt{hk}}\left(\Bigg|\sum_{i=1}^{hk}c_i m_{i,1}\Bigg|+\Bigg|\sum_{i=1}^{hk}c_i m_{i,2}\Bigg|+\ldots+\Bigg|\sum_{i=1}^{hk}c_i m_{i,hk}\Bigg|\right)$
　　　$\displaystyle =\frac{1}{\sqrt{hk}}\left(\Bigg|\sum_{i=1}^{hk}c_i e_{i,1}\Bigg|+\Bigg|\left(\sum_{i=1}^{hk}c_i e_{i,2}\right)X\Bigg|+\ldots+\Bigg|\left(\sum_{i=1}^{hk}c_i e_{i,hk}\right)X^{hk-1}\Bigg|\right)$
　　　$\displaystyle \ge \frac{1}{\sqrt{hk}}|\;r(x)|\;$對所有$|\;x|\;\le X$
其中$\displaystyle r(x)=\sum_{i}^{hk}c_ie_{i,1}+\left(\sum_{i=1}^{hk}c_i e_{i,2}\right)x+\ldots+\left(\sum_{i=1}^{hk}c_i e_{i,hk}\right)x^{hk-1}$
從$\displaystyle \frac{1}{\sqrt{hk}}|\;r(x)|\;\le \Vert\;b_1\Vert\;$，$\Vert\;b_1\Vert\;\le 2^{\frac{hk-1}{4}}X^{\frac{hk-1}{2}}N^{\frac{h-1}{2}}$
得到$\displaystyle |\;r(x)|\;\le \left(2^{\frac{hk-1}{4}}\sqrt{hk}\right)X^{\frac{hk-1}{2}}X^{\frac{h-1}{2}}$
選擇$\displaystyle X=\lceil\;\left(2^{-\frac{1}{2}}(hk)^{-\frac{1}{hk-1}}\right)N^{\frac{h-1}{hk-1}}\rceil\;-1$，$\displaystyle X^{\frac{hk-1}{2}}<2^{-\frac{hk-1}{4}}(hk)^{-\frac{1}{2}}N^{\frac{h-1}{2}}$
$\displaystyle |\;r(x)|\;\le\left(2^{\frac{hk-1}{4}}\sqrt{hk}\right)\left(2^{-\frac{hk-1}{4}}(hk)^{-\frac{1}{2}}N^{\frac{h-1}{2}}\right)N^{\frac{h-1}{2}}=N^{h-1}$
原本要解同餘方程式$r(x)\equiv 0\pmod{N^{h-1}}$，對所有$|\;x|\;<X$，$|\;r(x)|\;<N^{h-1}$
變成解一般方程式$r(x)=0$[/td][td]LLL化簡
$B=LLL(M)=\left[\matrix{3&8\times 2&-24\times 2^2&-8 \times 2^3&-1\times 2^4&2\times 2^5\cr
49&50\times 2&0&20\times 2^3&0&2\times 2^5\cr
115&-83\times 2&4\times 2^2&13\times 2^3&6\times 2^4&2\times 2^5\cr
61&16\times 2&37\times 2^2&-16\times 2^3&3\times 2^4&4\times 2^5\cr
21&-37\times 2&-14\times 2^2&2\times 2^3&14\times 2^4&-4\times 2^5\cr
-201&4\times 2&33\times 2^2&-4\times 2^3&-3\times 2^4&1\times 2^5} \right]$
取第一列向量形成不需要再同餘$N^{h-1}$的方程式
$\displaystyle r(x)=3+8\times 2\left(\frac{x}{2}\right)-24\times 2^2\left(\frac{x}{2}\right)^2-8\times 2^3\left(\frac{x}{2}\right)^3-1\times 2^4\left(\frac{x}{2}\right)^4+2\times 2^5\left(\frac{x}{2}\right)^5$
　　$=3+8x-24x^2-8x^3-x^4+2x^5$
　　$=(x-3)(2x-1)(x^3+3x^2+5x+1)$
解方程式得到答案
$x=3$
－－－－－－－－－－－－－－－－－－－
$b_1=[\matrix{3&16&-96&-64&-16&64}]$
$c=[\matrix{70&46&-98&32&-57&2}]$
$(m_{i,j})=\left[\matrix{1225&&&&&\cr
0&2450&&&&\cr
665&980&140&&&\cr
0&1330&1960&280&&\cr
361&1064&936&224&16&\cr
0&722&2128&1872&448&32}\right]$
$(e_{i,j}X^{j-1})=\left[\matrix{1225&&&&&\cr
0&1225\times 2&&&&\cr
665&490\times 2&35\times 2^2&&&\cr
0&665\times 2&490\times 2^2&35\times 2^3&&\cr
361&532\times 2&234\times 2^2&28\times 2^3&2^4&\cr
0&361\times 2&532\times 2^2&234\times 2^3&28\times 2^4& 2^5}\right]$[/td][/tr][/table]

引理1：
假設lattice $L$經LLL化簡後向量$b_1,b_2,\ldots,b_n$，則$\Vert\;b_1 \Vert\;\le 2^{(n-1)/4}\cdot(det(L))^{1/n}$。
[證明]
設$b_i$是LLL化簡後的向量，符合以下兩個條件
(1)(size-reduced)對$1\le j<i\le n$，$\displaystyle |\;\mu_{i,j}|\;\le \frac{1}{2}$
(2)(Lovász condition)對$i=2,3,\ldots,n$，$\displaystyle \frac{3}{4}\Vert\;b_{i-1}^2\Vert\;\le \Vert\;b_i^*\Vert\;^2+\mu_{i,i-1}^2 \Vert\;b_{i-1}^*\Vert\;^2$
[url]https://en.wikipedia.org/wiki/Lenstra%E2%80%93Lenstra%E2%80%93Lov%C3%A1sz_lattice_basis_reduction_algorithm[/url]
將(2)式移項$\displaystyle (\frac{3}{4}-\mu_{i,i-1}^2) \Vert\;b_{i-1}^2\Vert\;^2\le \Vert\;b_i^*\Vert\;^2$
將(1)式平方$\mu_{i,i-1}^2\le \frac{1}{4}$代入上式，得到對$1<i\le n$，$\displaystyle \frac{1}{2}\Vert\;b_{i-1}^*\Vert\;^2\le \Vert\;b_i^*\Vert\;^2$，$\displaystyle \Vert\;b_{i-1}^*\Vert\;^2\le 2^{i-(i-1)} \Vert\;b_i^*\Vert\;^2$
由數學歸納法得知，對$1\le j\le i\le n$，$\Vert\;b_j^*\Vert\;^2\le 2^{i-j}\cdot \Vert\;b_i^*\Vert\;^2$
由Gram-Schmidt正交化可知$\displaystyle b_i^*=b_i-\sum_{j=1}^{i-1}\mu_{ij}b_j^*$，$\displaystyle b_i=b_i^*+\sum_{j=1}^{i-1}\mu_{ij}b_j^*$
$\displaystyle \Vert\;b_i\Vert\;^2=\Vert\;b_i^*\Vert\;^2+2\sum_{j=1}^{i-1}\mu_{ij}b_i^*\cdot b_j^*+\sum_{j=1}^{i-1}\mu_{ij}^2\Vert\;b_j^*\Vert\;^2$
因為Gram-Schmidt正交化，$b_i^*\cdot b_j^*=0$代入上式
$\displaystyle \Vert\;b_i\Vert\;^2=\Vert\;b_i^*\Vert\;^2+\sum_{j=1}^{i-1}\mu_{ij}^2\Vert\;b_j^*\Vert\;^2$
　　$\displaystyle \le \Vert\;b_i^*\Vert\;^2+\sum_{j=1}^{i-1}\frac{1}{4}2^{i-j}\Vert\;b_i^*\Vert\;^2$
　　$\displaystyle =(1+\frac{1}{4}(2^i-2))\cdot \Vert\;b_i^*\Vert\;^2$
　　$\le 2^{i-1}\cdot \Vert\;b_i^*\Vert\;^2$
對$1\le j\le i\le n$，$\Vert\;b_j\Vert\;^2\le 2^{j-1}\cdot \Vert\;b_j^*\Vert\;^2\le 2^{i-1}\cdot \Vert\;b_i^*\Vert\;^2$
$\Vert\;b_1\Vert\;^2\le 2^{n-1}\Vert\;b_n^*\Vert\;^2$
$\Vert\;b_1\Vert\;^2\le 2^{n-2}\Vert\;b_{n-1}^*\Vert\;^2$
⋯
$\Vert\;b_1\Vert\;^2\le 2^{0}\Vert\;b_1^*\Vert\;^2$
將上面各式相乘$\displaystyle \Vert\;b_1\Vert\;^{2n}\le 2^{0+1+\ldots+(n-2)+(n-1)}\prod_{i=1}^n \Vert\;b_i^*\Vert\;^2$
$\displaystyle \Vert\;b_1\Vert\;^{2n}\le 2^{\frac{n(n-1)}{2}}\cdot det(L)^2$
$\displaystyle \Vert\;b_1\Vert\;\le 2^{\frac{n-1}{4}}\cdot det(L)^{\frac{1}{n}}$

參考資料：
N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997.
[url]https://link.springer.com/chapter/10.1007/BFb0024458[/url]

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

[color=green]同餘方程式[/color]
[color=red](%i2)[/color]　[color=blue]px:x^2+14*x+19;[/color]
[color=red](px)[/color]　$x^2+14x+19$

[color=green]$p(x)\equiv 0\pmod{N}$[/color]
[color=red](%i3)[/color]　[color=blue]N:35;[/color]
[color=red](N)[/color]　35

[color=green]$p(x)$的次數$k$[/color]
[color=red](%i4)[/color]　[color=blue]k:hipow(px,x);[/color]
[color=red](k)[/color]　2

[color=green]參數$h\ge 2$[/color]
[color=red](%i5)[/color]　[color=blue]h:3;[/color]
[color=red](h)[/color]　3

[color=green]希望能找到$|\;x|\;<X$，$p(x)\equiv 0\pmod{N}$[/color]
[color=red](%i6)[/color]　[color=blue]X:ceiling(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1)))-1;[/color]
[color=red](X)[/color]　2

[color=green]產生$q_{u,v}(x)$方程組[/color]
[color=red](%i7)[/color]
[color=blue]q_uv:create_list((v:floor((i-1)/k),
                           u: (i-1)-k*v,
                           N^(h-1-v)*x^u*px^v),i,1,h*k);[/color]
[color=red](q_uv)[/color]　$[1225,1225x,35(x^2+14x+19),35x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]$

[color=green]用$Xx$取代原本的$x$[/color]
[color=red](%i8)[/color]　[color=blue]q_uv:ev(q_uv,x=x*X);[/color]
[color=red](q_uv)[/color]　$[1225,2450x,35(4x^2+28x+19),70x(4x^2+28x+19),(4x^2+28x+19)^2,2x(4x^2+28x+19)^2]$

[color=green]$x^1,x^2,\ldots,x^{hk-1}$[/color]
[color=red](%i9)[/color]　[color=blue]xpower:create_list(x^i,i,1,h*k-1);[/color]
[color=red](xpower)[/color]　$[x,x^2,x^3,x^4,x^5]$

[color=green]取多項式$q_{u,v}(x)$係數(常數項在最後一行)[/color]
[color=red](%i10)[/color]　[color=blue]M:augcoefmatrix(q_uv,xpower);[/color]
[color=red](M)[/color]　$\left[\matrix{0&0&0&0&0&1225\cr
2450&0&0&0&0&0\cr
980&140&0&0&0&665\cr
1330&1960&280&0&0&0\cr
1064&936&224&16&0&361\cr
722&2128&1872&448&32&0}\right]$

[color=green]將常數項移到第一行[/color]
[color=red](%i11)[/color]　[color=blue]M:addcol(col(M,h*k),submatrix(M,h*k));[/color]
[color=red](M)[/color]　$\left[\matrix{1225&0&0&0&0&0\cr
0&2450&0&0&0&0\cr
665&980&140&0&0&0\cr
0&1330&1960&280&0&0\cr
361&1064&936&224&16&0\cr
0&722&2128&1872&448&32}\right]$

[color=green]LLL化簡[/color]
[color=red](%i12)[/color]　[color=blue]B: LLL(M);[/color]
[color=red](B)[/color]　$\left[\matrix{3&16&-96&-64&-16&64\cr
49&100&0&160&0&64\cr
115&-166&16&104&96&64\cr
61&32&148&-128&48&128\cr
21&-74&-56&16&224&-128\cr
-201&8&132&-32&-48&32}\right]$

[color=green]第一列短向量$b_1$[/color]
[color=red](%i13)[/color]　[color=blue]B[1];[/color]
[color=red](%o13)[/color]　$[3,16,-96,-64,-16,64]$

[color=green]產生的方程式不需要再同餘$N^{h-1}$[/color]
[color=red](%i14)[/color]　[color=blue]rx:sum(B[1][i+1]*(x/X)^i,i,0,h*k-1);[/color]
[color=red](rx)[/color]　$2x^5-x^4-8x^3-24x^2+8x+3$

[color=green]將$r(x)$因式分解[/color]
[color=red](%i15)[/color]　[color=blue]factor(rx);[/color]
[color=red](%o15)[/color]　$(x-3)(2x-1)(x^3+3x^2+5x+1)$

[color=green]得到$r(x)$的解[/color]
[color=red](%i16)[/color]　[color=blue]x:3;[/color]
[color=red](x)[/color]　3

[color=green]驗證答案[/color]
[color=red](%i17)[/color]　[color=blue]ev(mod(px,N),x=3);[/color]
[color=red](%o17)[/color]　0

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
解三次同餘方程式$p(x)=x^3-4x^2-3x-10\pmod{1131}$。

參考資料
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
[url]https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/258484/348751_FULLTEXT01.pdf?sequence=1&isAllowed=y[/url]

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

[color=green]同餘方程式[/color]
[color=red](%i2)[/color]　[color=blue]px:x^3-4*x^2-3*x-10;[/color]
[color=red](px)[/color]　$x^3-4x^2-3x-10$

[color=green]$p(x)\equiv 0\pmod{N}$[/color]
[color=red](%i3)[/color]　[color=blue]N:1131;[/color]
[color=red](N)[/color]　1131

[color=green]$p(x)$的次數$k$[/color]
[color=red](%i4)[/color]　[color=blue]k:hipow(px,x);[/color]
[color=red](k)[/color]　3

[color=green]參數$h\ge 2$[/color]
[color=red](%i5)[/color]　[color=blue]h:3;[/color]
[color=red](h)[/color]　3

[color=green]希望能找到$|\;x|\;<X$，$p(x)\equiv 0\pmod{N}$
按照公式應該是3，本範例$X=6$[/color]
[color=red](%i7)[/color]
[color=blue]X:ceiling(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1)))-1;
X:6;[/color]
[color=red](X)[/color]　3
[color=red](X)[/color]　6

[color=green]產生$q_{u,v}(x)$方程組[/color]
[color=red](%i8)[/color]
[color=blue]q_uv:create_list((v:floor((i-1)/k),
                           u: (i-1)-k*v,
                           N^(h-1-v)*x^u*px^v),i,1,h*k);[/color]
[color=red](q_uv)[/color]　$[1279161,1279161x,1279161x^2,1131(x^3-4x^2-3x-10),1131x(x^3-4x^2-3x-10),1131x^2(x^3-4x^2-3x-10),$
　　　　$(x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]$

[color=green]用$Xx$取代原本的$x$[/color]
[color=red](%i8)[/color]　[color=blue]q_uv:ev(q_uv,x=x*X);[/color]
[color=red](q_uv)[/color]　$[1279161,7674966x,46049796x^2,1131(216x^3-144x^2-18x-10),6786x(216x^3-144x^2-18x-10),$
　　　$40716x^2(216x^3-144x^2-18x-10),(216x^3-144x^2-18x-10)^2,6x(216x^3-144x^2-18x-10)^2,36x^2(216x^3-144x^2-18x-10)^2]$

[color=green]$x^1,x^2,\ldots,x^{hk-1}$[/color]
[color=red](%i9)[/color]　[color=blue]xpower:create_list(x^i,i,1,h*k-1);[/color]
[color=red](xpower)[/color]　$[x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]$

[color=green]取多項式$q_{u,v}(x)$係數(常數項在最後一行)[/color]
[color=red](%i11)[/color]　[color=blue]M:augcoefmatrix(q_uv,xpower);[/color]
[color=red](M)[/color]　$\left[\matrix{0&0&0&0&0&0&0&0&1279161\cr
7674966&0&0&0&0&0&0&0&0\cr
0&46049796&0&0&0&0&0&0&0\cr
-20358&-162864&244296&0&0&0&0&0&-11310\cr
-67860&-122148&-977184&1465776&0&0&0&0&0\cr
0&-407160&-732888&-5863104&8794656&0&0&0&0\cr
360&3204&864&12960&-62208&46656&0&0&100\cr
600&2160&19224&5184&77760&-373248&279936&0&0\cr
0&3600&12960&115344&31104&466560&-2239488&1679616&0}\right]$

[color=green]將常數項移到第一行[/color]
[color=red](%i12)[/color]　[color=blue]M:addcol(col(M,h*k),submatrix(M,h*k));[/color]
[color=red](M)[/color]　$\left[\matrix{1279161&0&0&0&0&0&0&0&0\cr
0&7674966&0&0&0&0&0&0&0\cr
0&0&46049796&0&0&0&0&0&0\cr
-11310&-20358&-162864&244296&0&0&0&0&0\cr
0&-67860&-122148&-977184&1465776&0&0&0&0\cr
0&0&-407160&-732888&-5863104&8794656&0&0&0\cr
100&360&3204&864&12960&-62208&46656&0&0\cr
0&600&2160&19224&5184&77760&-373248&279936&0\cr
0&0&3600&12960&115344&31104&466560&-2239488&1679616}\right]$

[color=green]LLL化簡[/color]
[color=red](%i12)[/color]　[color=blue]B: LLL(M);[/color]
[color=red](M)[/color]　$\left[\matrix{
100&360&3204&864&12960&-62208&46656&0&0\cr
-11310&-20358&-162864&244296&0&0&0&0&0\cr
400&2040&14976&22680&57024&-171072&-186624&279936&0\cr
1279161&0&0&0&0&0&0&0&0\cr
-22920&-109656&-457488&-491184&1426896&186624&-139968&0&0\cr
1400&8040&59256&121176&322704&-451008&-746496&-839808&1679616\cr
-53360&-196668&-1128060&-794880&-859248&972000&1632960&1959552&1679616\cr
-22620&7634250&-325728&488592&0&0&0&0&0\cr
-267849&3713268&20770668&14244552&11153376&9020160&7231680&5598720&5038848}\right]$

[color=green]第一列短向量$b_1$[/color]
[color=red](%i14)[/color]　[color=blue]B[1];[/color]
[color=red](%o14)[/color]　$[100,360,3204,864,12960,-62208,46656,0,0]$

[color=green]產生的方程式不需要再同餘$N^{h-1}$[/color]
[color=red](%i15)[/color]　[color=blue]rx:sum(B[1][i+1]*(x/X)^i,i,0,h*k-1);[/color]
[color=red](rx)[/color]　$x^6-8x^5+10x^4+4x^3+89x^2+60x+100$

[color=green]將$r(x)$因式分解[/color]
[color=red](%i16)[/color]　[color=blue]factor(rx);[/color]
[color=red](%o16)[/color]　$(x-5)^2(x^2+x+2)^2$

[color=green]得到$r(x)$的解[/color]
[color=red](%i17)[/color]　[color=blue]x:5;[/color]
[color=red](x)[/color]　5

[color=green]驗證答案[/color]
[color=red](%i18)[/color]　[color=blue]ev(mod(px,N),x=5);[/color]
[color=red](%o18)[/color]　0

bugmens 發表於 2021-7-11 21:42

將Coppersmith和Howgrave-Graham方法寫成副程式，放入LLL.zip，提供將來範例直接使用。

111.3.6補充
發現ceiling指令在處理超大浮點數會出現錯誤，改用bigfloat numbers。
[table][tr][td]修正前[/td][td]修正後[/td][/tr]
[tr][td]h:3$
k:3$
N:10^150$
X:ceiling(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1)))-1;
16990442448471225139289591175253590015錯誤[/td][td]h:3$
k:3$
N:10^150$
fpprec:100$/*設定小數點以下100為有效位數*/
X:ceiling(bfloat(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1))))-1;
16990442448471225207917914988908164235正確[/td][/tr][/table]

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用Coppersmith_Howgrave指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

[color=green]Coppersmith_Howgrave方法副程式[/color]
[color=red](%i2)[/color]
[color=blue]Coppersmith_Howgrave(px,N,h):=block
([ak,inv_ak,k,X,q_uv,M,B,i,rx,x],
px:expand(px),/*先expand()確保coeff()取得到係數,例子3(x^2+x+1),x^2係數為0*/
if (ak:coeff(px,x,hipow(px,x)))#1 then
  (print("p(x)不是monic多項式，同乘",ak^"-1","≡",inv_ak:inv_mod(ak,N),"mod(",N,")"),
print("p(x)變成monic多項式，",inv_ak,"(",px,")=",px:polymod(inv_ak*px,N),"(mod",N,")")
  ),
if h<2 then (print("參數h要≥2"),return([])),
fpprec:100,/*設定小數點以下100為有效位數*/
print("參數h=",h),
print("p(x)最高次方k=",k:hipow(px,x)),
print("X=ceiling(",2^(-1/2),"(hk)"^"-1/(hk-1)","N"^"(h-1)/(hk-1)",")=ceiling(",
      2^(-1/2),h*k,""^("-1"/(h*k-1)),N^((h-1)/(h*k-1)),")=",X:ceiling(bfloat(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1))))-1),
print("q_uv=N"^"h-1-v","x"^"u","p(x)"^"v","=",q_uv:create_list((v:floor((i-1)/k),u: (i-1)-k*v,N^(h-1-v)*x^u*px^v),i,1,h*k)),
print("用",X,"x取代x,得到q_uv=",q_uv:ev(q_uv,x=x*X)),
M:augcoefmatrix(q_uv,create_list(x^i,i,1,h*k-1)),
print("產生矩陣M=",M:addcol(col(M,h*k),submatrix(M,h*k))),
print("LLL化簡B=",B: LLL(M)),
print("產生不需要同餘N"^(h-1),"的方程式"),
printList:["r(x)=",B[1][1]],
for i:2 thru h*k do
  (if B[1][ i ]>=0 then printList:append(printList,["+"]),
printList:append(printList,[B[1][ i ],"(",x/X,")"^(i-1)])
  ),
apply(print,printList),/*再用apply(print,)將全部內容印在同一行*/
print("r(x)=",rx:sum(B[1][i+1]*(x/X)^i,i,0,h*k-1),"=",factor(rx)),
print("整數解為",x:sublist(solve(rx,x),lambda([x],integerp(rhs(x))))),
return(x)
)$[/color]

[color=green]二次同餘方程式[/color]
[color=red](%i5)[/color]
[color=blue]px:x^2+14*x+19;
N:35;
h:3;[/color]
[color=red](px)[/color]　$x^2+14x+19$
[color=red](N)[/color]　35
[color=red](h)[/color]　3

[color=green][/color]
[color=red](%i6)[/color]　[color=blue]solution:Coppersmith_Howgrave(px,N,h);[/color]
參數$h=3$
$p(x)$最高次方$k=2$
$\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}}6^{-1/5}35^{2/5})=2$
$q_{uv}=N^{h-1-v}x^{u}p(x)^{v}=[1225,1225x,35(x^2+14x+19),35x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]$
用$2x$取代$x$,得到$q_{uv}=[1225,2450x,35(4x^2+28x+19),70x(4x^2+28x+19),(4x^2+28x+19)^2,2x(4x^2+28x+19)^2]$
產生矩陣$M=\left[\matrix{1225&0&0&0&0&0\cr
0&2450&0&0&0&0\cr
665&980&140&0&0&0\cr
0&1330&1960&280&0&0\cr
361&1064&936&224&16&0\cr
0&722&2128&1872&448&32}\right]$
LLL化簡$B=\left[\matrix{3&16&-96&-64&-16&64\cr
49&100&0&160&0&64\cr
115&-166&16&104&96&64\cr
61&32&148&-128&48&128\cr
21&-74&-56&16&224&-128\cr
-201&8&132&-32&-48&32}\right]$
產生不需要同餘$N^2$的方程式
$\displaystyle r(x)= 3 + 16\left(\frac{x}{2}\right)-96\left(\frac{x}{2}\right)^2 -64\left(\frac{x}{2}\right)^3-16\left(\frac{x}{2}\right)^4 + 64\left(\frac{x}{2}\right)^5 $
$r(x)=2x^5-x^4-8x^3-24x^2+8x+3=(x-3)(2x-1)(x^3+3x^2+5x+1)$
整數解為$[x=3]$
[color=red](solution)[/color]　$[x=3]$

[color=green]驗證答案[/color]
[color=red](%i7)[/color]　[color=blue]ev(mod(px,N),solution);[/color]
[color=red](%o7)[/color]　0

[color=green]三次同餘方程式[/color]
[color=red](%i10)[/color]
[color=blue]px:x^3-4*x^2-3*x-10;
N:1131;
h:3;[/color]
[color=red](px)[/color]　$x^3-4x^2-3x-10$
[color=red](N)[/color]　1131
[color=red](h)[/color]　3

[color=green][/color]
[color=red](%i11)[/color]　[color=blue]solution:Coppersmith_Howgrave(px,N,h);[/color]
參數$h=3$
$p(x)$最高次方$k=3$
$\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)} N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}} 9 ^{-1/8} 1131^{1/4})=3$
$q_{uv}=N^{h-1-v} x^u p(x)^v =[1279161,1279161x,1279161x^2,1131(x^3-4x^2-3x-10),$
$1131x(x^3-4x^2-3x-10),1131x^2(x^3-4x^2-3x-10),(x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]$
用$3x$取代$x$得到$q_{uv}=1279161,3837483x,11512449x^2,1131(27x^3-36x^2-9x-10),$
$3393x(27x^3-36x^2-9x-10),10179x^2(27x^3-36x^2-9x-10),(27x^3-36x^2-9x-10)^2,3x(27x^3-36x^2-9x-10)^2,9x^2(27x^3-36x^2-9x-10)^2]$
產生矩陣$M=\left[\matrix{1279161&0&0&0&0&0&0&0&0\cr
0&3837483&0&0&0&0&0&0&0\cr
0&0&11512449&0&0&0&0&0&0\cr
-11310&-10179&-40716&30537&0&0&0&0&0\cr
0&-33930&-30537&-122148&91611&0&0&0&0\cr
0&0&-101790&-91611&-366444&274833&0&0&0\cr
100&180&801&108&810&-1944&729&0&0\cr
0&300&540&2403&324&2430&-5832&2187&0\cr
0&0&900&1620&7209&972&7290&-17496&6561}\right]$
LLL化簡$B=\left[\matrix{100&180&801&108&810&-1944&729&0&0\cr
100&480&1341&2511&1134&486&-5103&2187&0\cr
0&300&1440&4023&7533&3402&1458&-15309&6561\cr
-10710&-9099&-35910&31185&4860&-11664&4374&0&0\cr
-1020&-3108&-13203&-21114&-43335&-39609&-37908&-15309&39366\cr
-10410&-40689&-60804&-76221&100845&-2916&-28431&13122&0\cr
1542&18561&31473&86157&29808&100602&181521&269001&426465\cr
1222511&-52875&-208521&136539&-9963&-13608&26973&4374&-6561\cr
-225150&3376488&-1106784&-423009&379647&-50787&-80190&54675&59049}\right]$
產生不需要同餘$N^2$的方程式
$\displaystyle r(x)=100 + 180\left(\frac{x}{3}\right)+801\left(\frac{x}{3}\right)^2+108\left(\frac{x}{3}\right)^3+810\left(\frac{x}{3}\right)^4-1944\left(\frac{x}{3}\right)^5+729\left(\frac{x}{3}\right)^6+0\left(\frac{x}{3}\right)^7+0\left(\frac{x}{3}\right)^8$
$r(x)=x^6-8x^5+10x^4+4x^3+89x^2+60x+100=(x-5)^2(x^2+x+2)^2$
整數解為$[x=5]$
[color=red](solution)[/color]　$[x=5]$

[color=green]驗證答案[/color]
[color=red](%i12)[/color]　[color=blue]ev(mod(px,N),solution);[/color]
[color=red](%o12)[/color]　0

bugmens 發表於 2022-2-22 23:51

1-1.刻板訊息(Stereotyped Messages)

銀行要傳送底下的訊息給客戶
Your pin no is ****，其中****為四位數密碼
將明文按英文字母轉換成數字(空白$=00,A=01,B=02,...,Z=26$，不分大小寫)
設明文$M=B+x$，其中$B=25152118001609140014150009190000$，密碼$0\le x <10000$
採用RSA方案將明文加密，其中公鑰$e=3$，$N=54957464841358314276864542898551$
得到密文$C\equiv M^e \equiv (B+x)^3\equiv 37393323096087665763922106857101 \pmod{N}$要如何找出密碼$x$呢？

參考資料：
Cryptanalytic Attacks on RSA，[url]https://books.google.com.tw/books?id=KN2jkDfd4Z4C&lpg=PA183&ots=D-bE1-Rb3c&dq=stereotyped%20messages&hl=zh-TW&pg=PA185#v=onepage&q&f=false[/url]

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.45.1\share\maxima\5.45.1\share目錄下
要先載入LLL.mac才能使用Coppersmith_Howgrave指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.45.1/share/maxima/5.45.1/share/LLL.mac

[color=green]明文訊息[/color]
[color=red](%i2)[/color]　[color=blue]m:"Your pin no is";[/color]
[color=red](m)[/color]　Your pin no is

[color=green]這個範例不區分大小寫，統一轉成大寫字母[/color]
[color=red](%i3)[/color]　[color=blue]m:supcase(m);[/color]
[color=red](m)[/color]　YOUR PIN NO IS

[color=green]明文訊息轉成list[/color]
[color=red](%i4)[/color]　[color=blue]mlist:charlist(m);[/color]
[color=red](mlist)[/color]　[Y,O,U,R, ,P,I,N, ,N,O, ,I,S]

[color=green]明文轉成數字B[/color]
[color=red](%i5)[/color]　[color=blue]B:0;[/color]
[color=red](B)[/color]　0

[color=green]將明文訊息按照字母順序轉換成數字(空白=00,A=01,B=02,...,Z=26)[/color]
[color=red](%i7)[/color]
[color=blue]for i:1 thru length(mlist) do
  (if mlist[ i ]=" " then
   (B:B*100+0)/*空白就補上00*/
else/*其他就乘100倍再加上英文字母的順序*/
   (B:B*100+cint(mlist[ i ])-cint("A")+1)
  )$
B;[/color]
[color=red](%o7)[/color]　2515211800160914001415000919

[color=green]最後四位數為密碼x[/color]
[color=red](%i8)[/color]　[color=blue]B:B*10000;[/color]
[color=red](B)[/color]　25152118001609140014150009190000

[color=green]公鑰e[/color]
[color=red](%i9)[/color]　[color=blue]e:3;[/color]
[color=red](e)[/color]　3

[color=green]公鑰N[/color]
[color=red](%i10)[/color]　[color=blue]N:54957464841358314276864542898551;[/color]
[color=red](N)[/color]　54957464841358314276864542898551

[color=green]密文C[/color]
[color=red](%i11)[/color]　[color=blue]C:37393323096087665763922106857101;[/color]
[color=red](C)[/color]　37393323096087665763922106857101

[color=green]明文M，其中x為四位數密碼[/color]
[color=red](%i12)[/color]　[color=blue]M:B+x;[/color]
[color=red](M)[/color]　$x+25152118001609140014150009190000$

[color=green]產生方程式p(x)≡(B+x)^e-C(mod N)[/color]
[color=red](%i13)[/color]　[color=blue]px:M^e-C;[/color]
[color=red](px)[/color]　$(x+25152118001609140014150009190000)^3-37393323096087665763922106857101$

[color=green]方程式p(x)同餘N[/color]
[color=red](%i14)[/color]　[color=blue]px:polymod(px,N);[/color]
[color=red](px)[/color]　$x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263$

[color=green]參數h[/color]
[color=red](%i15)[/color]　[color=blue]h:3;[/color]
[color=red](h)[/color]　3

[color=green]呼叫Coppersmith_Howgrave副程式，找符合p(x)≡0(mod N)的較小的解x[/color]
[color=red](%i16)[/color]　[color=blue]x:Coppersmith_Howgrave(px,N,h);[/color]
參數$h=3$
$p(x)$最高次方$k=3$
$\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})$
$=ceiling(\frac{1}{\sqrt{2}}9^{-1/8}54957464841358314276864542898551^{1/4})=46260610$
$q_{uv}=N^{h-1-v}x^u p(x)^v=$
$[3020322941789135243826751301254310584993059920451586964677899601,$
$3020322941789135243826751301254310584993059920451586964677899601x,$
$3020322941789135243826751301254310584993059920451586964677899601x^2,$
$54957464841358314276864542898551(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263),$
$54957464841358314276864542898551x(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263),$
$54957464841358314276864542898551x^2(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263),$
$(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263)^2,$
$x(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263)^2,$
$x^2(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263)^2]$

用$46260610x$取代$x$,得到$q_{uv}=$
$[3020322941789135243826751301254310584993059920451586964677899601,$
$139721981684159887751924249514318172791235797686641888454048089061016610x,$
$6463624103118063744935544456324562407407970654820642611436221569296955598732100x^2,$
$54957464841358314276864542898551(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263),$
$2542365847614788847019462641858137376110x(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263),$
$117611394953827177084317023684568968482648027100x^2(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263),$
$(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263)^2,$
$46260610x(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263)^2,$
$2140044037572100x^2(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263)^2]$

產生矩陣\(M=\left[\matrix{
3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0\cr
0&139721981684159887751924249514318172791235797686641888454048089061016610&0&0&0&0&0&0&0\cr
0&0&6463624103118063744935544456324562407407970654820642611436221569296955598732100&0&0&0&0&0&0\cr
1004840807312492934121310085993087816338401741664749320802716913&-58760286766514250464246726367461673333231803685743085020341021553863830&2410902949519492989179980080581154246553453535301351223201730247704151548267900&5440774873514967046498526949032608069078072148942531000&0&0&0&0&0\cr
0&46484548699168383753141618577192698167382430994473719077419374052696930&-2718286709593876800168836752261861160016036509902723416322838065104888632736300&111529841095570952570189278315533349949653158149697041409558194314245150155317497419000&251693564521475219700920220763687359166473755234092339003910000&0&0&0&0\cr
0&0&2150403578398235925134420691768266304768993361087260873490057469495932126927300&-125749601340705593040658491150052576997649458730371025900378445822971862132447207143000&5159438482284180564178023830336345244014424384431456450801421899475512335726582174276365590000&11643497827837801763248586973862843084330167466119804398647668985100000&0&0&0\cr
334303671329367207597382428251924280469672863044332310758017169&-39098291891529790146672600165213743993545305783624348258638047456145580&2747361389197032065525895040706053126300958522505044634704406065907531371974300&-93808080400887705413187047147355847439306195234682022660264660430139194466387149708000&1924447532275702298105139918003157179495823605879799776741463766795883123756267581643242950000&8685945472081614468358429342848175207711673102374196684328376029800000&9800949035846008678895673107522190930361000000&0&0\cr
0&15465091760936037937451545534215250888338153144877269738375436628413090&-1808710832860221925357063953928888577525241908186990361297033844530242779603800&127094613754702113540787875379036848315089384835782092878652994296582604861668022323000&-4339619022274109793914334845135441389609242568335483524297665952941101520923694041653401880000&89026116756068676488745616742176033049356292460399124349923926144875298793670429650041221245199500000&401817135965233455091086640042055722495618701836422786877008115447926178000000&453397880977148227551007964314572140974967380210000000&0\cr
0&0&715424578566875285969650341855573377397564850755440873231788107446732875384900&-83672066441721911002392246317762282218349981070294168177721176838614194432567346318000&5879474360006910140686106995638225815533507147028029443643143494486432216289728330155597030000&-200753423138003906273451417680221051302571222849166152478959848559286650429857849820251779543946800000&4118402467066958176262030365319276016243382196556464335893334277056879696127458214572993419947888441695000000&18588305818204638424921273531195923376638043474361038338830390395571488229248580000000&20974462546710273066928434544050339130507985738616528100000000}\right]\)

LLL化簡\(B=\left[\matrix{
1346829011992131838415424923205840084705445702496636688958&-45179677717016066583753308148255943279532835707102039947418400&-57317453167676354735698331555650210546427932428564618523281700&55022492206313287028619713807534065142711418176206799219594000&-9126018929197534844882170642391266050994818115932677074230000&-74312694674165829957248058752411116787238498594388701682800000&-19823407733951640707057856074266278764703362315244543316000000&138583699736138999822205248506077392755142831146437181570000000&20974462546710273066928434544050339130507985738616528100000000\cr
-5902801572552400483890393706301403464838435984190741057521&198017000397961977217885428384176729067567197716265205355728090&42767563064370999055058464552273491314630668309914422404759500&-118669599523559088891420124095064243299234055073696904508477000&5351963749137648019221242354483616465414282780748646299580000&-112004086186351949887374756082813158190757018854244406606700000&-81397469992098637889082971258651279103671999211513531483000000&-10896835906406582990864300928074561497704329125231160360000000&0\cr
3508846630479685748619833227116965930963020713923238512016&-117708907048737798457372393976462193778029056413142461742828970&-19527888444159534716576393306673687254846408168280511459649900&27139572631435639962886919071578980327487934016822772654740000&152842267767879348291763951826981942119544813261287552570070000&-27976405711844657161410593106590342431253966526607082103400000&113524558112017051054823008390937950572260639715265074131000000&-73696712976382536265834206929658681977733154502070358350000000&-20974462546710273066928434544050339130507985738616528100000000\cr
-698639478405741507601710852229901400525255812179741745660&23434582306738882194913520923528306099741489318995435888835520&77832343453161261306864164010036521096392268014746035430400000&-19810469901945597112216075834712042329629980808126434227417000&11981172299793958495319504252438495583021639688484388874570000&123052851048114992637170087912139575579626631163057082528500000&-77828623800639953659282136255768504523687584641815030167000000&45046935686004396852036235081258646064208160740318079740000000&83897850186841092267713738176201356522031942954466112400000000\cr
2608388682960311335109469583103966794580680761470012241110&-87504293274733197882640504831875268439796045643230655421800670&67355084330066865588347641681926665747584588920990302572315700&49518826646218754489406268633116221438926982129998391470769000&-76798282830980653021742983335907095096227676638334916897480000&8588117181290281381087324090049898257206127303677712526400000&128047976903282825900283462166286459364396690101948932088000000&88906907910860169021868087433507208597965866101930374390000000&-41948925093420546133856869088100678261015971477233056200000000\cr
-1995198218937024623232349557084188775094976064244671057536&66932114210862830110104110182574512142599015426308136347603390&-7269506494572805968382600910891268087690791621484198916104800&8746942221093256881071752182172494956975331200299995572349000&135289672986284673880862945002578814813571416764191759148860000&57336532483012033414667813522314757646899794385904686577900000&98003299188098351389493461699129078727854830331097773587000000&76794339087563318362316609668062911023749796992816963810000000&-20974462546710273066928434544050339130507985738616528100000000\cr
1080486934579740147709503727342917433192987867804798211748&-36248047630075260993070370343206373336745272044257160933612290&50432291648410244801921487663386649765799516063041448619617700&-110728984816423069966245765896893991877601482453715569174801000&47751944909992951034160485499982734778235628595949271138960000&92499399504781570519595347939458299088542884224606869328000000&-23368916165677269442994314666846991564283577282956230451000000&47762871511471852576044187070952438440777872791839177960000000&-83897850186841092267713738176201356522031942954466112400000000\cr
-1351209723281976538802605297703889071606362629555587092791&45325239305457343576462953756357480589591441740795953594944820&104141687489491357694257317408495876883875779940487417687370100&56013394445295195456052555118633049318801173303376655543288000&43928806144132011144005796648574152800734722604776425309230000&-52583333463842986422341946819648968524622281916459256843100000&-190189161265649279450477135329996455520381986431990693226000000&28230740167810844364671917022661043622253814284451493460000000&-41948925093420546133856869088100678261015971477233056200000000\cr
3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0}\right]\)

產生不需要同餘$N^2$的方程式
$r(x)= 1346829011992131838415424923205840084705445702496636688958$
$\displaystyle -45179677717016066583753308148255943279532835707102039947418400\left(\frac{x}{46260610}\right)$
$\displaystyle -57317453167676354735698331555650210546427932428564618523281700\left(\frac{x}{46260610}\right)^2$
$\displaystyle +55022492206313287028619713807534065142711418176206799219594000\left(\frac{x}{46260610}\right)^3$
$\displaystyle -9126018929197534844882170642391266050994818115932677074230000\left(\frac{x}{46260610}\right)^4$
$\displaystyle -74312694674165829957248058752411116787238498594388701682800000\left(\frac{x}{46260610}\right)^5$
$\displaystyle -19823407733951640707057856074266278764703362315244543316000000\left(\frac{x}{46260610}\right)^6$
$\displaystyle +138583699736138999822205248506077392755142831146437181570000000\left(\frac{x}{46260610}\right)^7$
$\displaystyle +20974462546710273066928434544050339130507985738616528100000000\left(\frac{x}{46260610}\right)^8 $

$r(x)= x^8+305655817x^7-2022600838087156x^6-350756908723576394560428x^5$
$-1992672579437965292192928201903x^4+555784194569846483233547842537557231074x^3$
$-26783305465388245970449493154965416028246066377x^2$
$-976633851499495285162761756670652273706136510242775440x$
$+1346829011992131838415424923205840084705445702496636688958$

$=(x-1379)(x^7+305657196x^6-2022179336813872x^5-350759697308881860889916x^4$
$-1993156277060554240279095396067x^3+555781446007340416729250497665006054681x^2$
$-26782539042774201848014823518529135984896661278x-976670784620835270787110169112284325384659682738677802)$
整數解為$[x=1379]$
[color=red](x)[/color]　$[x=1379]$

[color=green]驗算答案[/color]
[color=red](%i17)[/color]　[color=blue]mod((B+rhs(x[1]))^e-C,N);[/color]
[color=red](%o17)[/color]　0

bugmens 發表於 2022-3-8 14:53

1-2.刻板訊息(Stereotyped Messages)
當大部分訊息是固定的或刻板的，假設明文$m$包含兩個部分。
(1)已知部分$B=2^kb$，例如"October 19, 1995.The secret key for the day is"的ASCII值。
(2)未知部分$x$，例如"Squeamish Ossifrage"，$x$小於$\displaystyle N^{\frac{1}{3}}$。

假設RSA加密方案採用公鑰$e=3$，密文$C=M^3=(B+x)^3\pmod{N}$，若已知$B,C,N$，產生多項式$p(x)=(B+x)^3-C$，找出$x_0$滿足$p(x_0)=(B+x_0)^3-C \equiv 0\pmod{N}$，$\displaystyle |\;x_0|\;<N^{\frac{1}{3}}$

參考資料：
Coppersmith, D. Small Solutions to Polynomial Equations, and Low Exponent RSA Vulnerabilities. J. Cryptology 10, 233–260 (1997).
[url]https://link.springer.com/article/10.1007/s001459900030[/url]
[url]https://www.di.ens.fr/~fouque/ens-rennes/coppersmith.pdf[/url]

顯示數字的全部位數會造成版面凌亂，將太長的數字縮短顯示
功能表選取，編輯/設定/Worksheet/Maximum displayed number of digits調整為60

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.45.1\share\maxima\5.45.1\share目錄下
要先載入LLL.mac才能使用Coppersmith_Howgrave指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.45.1/share/maxima/5.45.1/share/LLL.mac

[color=green]明文訊息[/color]
[color=red](%i2)[/color]　[color=blue]m:"October 19,1995.The secret key for the day is";[/color]
[color=red](m)[/color]　$October 19,1995.The secret key for the day is$

[color=green]明文訊息轉成list[/color]
[color=red](%i3)[/color]　[color=blue]mlist:charlist(m);[/color]
[color=red](mlist)[/color]　$[O,c,t,o,b,e,r, ,1,9,,,1,9,9,5,.,T,h,e, ,s,e,c,r,e,t, ,k,e,y, ,f,o,r, ,t,h,e, ,d,a,y, ,i,s]$

[color=green]明文轉成數字B[/color]
[color=red](%i4)[/color]　[color=blue]B:0;[/color]
[color=red](B)[/color]　$0$

[color=green]將明文訊息按照ASCII轉換成數字[/color]
[color=red](%i6)[/color]
[color=blue]for i:1 thru length(mlist) do
(B:B*1000+cint(mlist[ i ])
)$
B;[/color]
[color=red](%o6)[/color]　$79099116111098101114[94 digits]32100097121032105115$

[color=green]密碼x長度19(通常要猜測很多次，為了簡化過程設為已知)[/color]
[color=red](%i7)[/color]　[color=blue]length:19;[/color]
[color=red](length)[/color]　$19$

[color=green]最後19位000為密碼x[/color]
[color=red](%i8)[/color]　[color=blue]B:B*1000^length;[/color]
[color=red](B)[/color]　$79099116111098101114[151 digits]00000000000000000000$

[color=green]公鑰e[/color]
[color=red](%i9)[/color]　[color=blue]e:3;[/color]
[color=red](e)[/color]　$3$

[color=green]使用RSA-230作為此次的公鑰N，因為密碼x小於上界X
[url]https://en.wikipedia.org/wiki/RSA_numbers#RSA-230[/url][/color]
[color=red](%i10)[/color]
[color=blue]N:17969491597941066732916128449573246156367561808012600070888918835531726460341490933493372247868650755230855864199929221814436684722874052065257937495694348389263171152522525654410980819170611742509702440718010364831638288518852689;[/color]
[color=red](N)[/color]　$17969491597941066732[190 digits]64831638288518852689$

[color=green]密文C[/color]
[color=red](%i11)[/color]
[color=blue]C:3601065602437181695470302568875441014033597674933932563017313054187328842620219291572818766268178751411814560562534443426266396400495371407624162345901468773333852250822392143444872355448117811583996009775475129299419544905929790;[/color]
[color=red](C)[/color]　$36010656024371816954[189 digits]29299419544905929790$

[color=green]明文M，其中x為19位密碼[/color]
[color=red](%i12)[/color]　[color=blue]M:B+x;[/color]
[color=red](M)[/color]　$x+79099116111098101114[151 digits]00000000000000000000$

[color=green]產生方程式p(x)≡(B+x)^e-C(mod N)[/color]
[color=red](%i13)[/color]　[color=blue]px:M^e-C;[/color]
[color=red](px)[/color]　$(x+79099116111098101114[151 digits]00000000000000000000)^3$
　　　$-36010656024371816954[189 digits]29299419544905929790$

[color=green]方程式p(x)同餘N[/color]
[color=red](%i14)[/color]　[color=blue]px:polymod(px,N);[/color]
[color=red](px)[/color]　$x^3$
　　　$+23729734833329430334[152 digits]00000000000000000000x^2$
　　　$+57518597415676200644[189 digits]30736530413029557356x$
　　　$-78610106704918417037[189 digits]64951518554580927445$

[color=green]參數h[/color]
[color=red](%i15)[/color]　[color=blue]h:3;[/color]
[color=red](h)[/color]　$3$

[color=green]呼叫Coppersmith_Howgrave副程式，找符合p(x)≡0(mod N)的較小的解x
執行時間需1965秒(32分鐘)[/color]
[color=red](%i18)[/color]
[color=blue]showtime:true$
x:Coppersmith_Howgrave(px,N,h);
showtime:false$[/color]
Evaluation took 0.0000 seconds (0.0000 elapsed) using 0 bytes.
參數$h=3$
$p(x)$最高次方$k=3$
$\displaystyle X=ceiling(\frac{1}{\sqrt{2}} {{(hk)}^{-1/(hk-1)}} {{N}^{(h-1)/(hk-1)}} )$
$\displaystyle =ceiling(\frac{1}{\sqrt{2}} 9^{\frac{-1}{8}} 17969491597941066732[190 digits]64831638288518852689^{\frac{1}{4}})$
$=1106212689453879191977235208036134814768946283886104135857$

$q_{uv}=N^{h−1−v}x^u p(x)^v=$
$[32290262828847459190[419digits]60277520976882530721,$
$32290262828847459190[419digits]60277520976882530721x,$
$32290262828847459190[419digits]60277520976882530721x^2,$
$17969491597941066732[190digits]64831638288518852689(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445),$
$17969491597941066732[190digits]64831638288518852689x(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445),$
$17969491597941066732[190digits]64831638288518852689x^2(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445),$
$(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445)^2,$
$x(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445)^2,$
$x^2(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445)^2]$

用$1106212689453879191977235208036134814768946283886104135857x$取代$x$,得到$q_{uv}=$
$[32290262828847459190[419digits]60277520976882530721,$
$35719898487071973003[476digits]68945401330960162897x,$
$39513804972403437655[533digits]07174654938138697729x^2,$
$17969491597941066732[190digits]64831638288518852689(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445),$
$19878079628677272620[247digits]72697393439425769473x(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445),$
$21989383927217453979[304digits]76931392169955293361x^2(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445),$
$(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445)^2,$
$1106212689453879191977235208036134814768946283886104135857x(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445)^2,$
$12237065143087845640[75digits]14878644880713124449x^2(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445)^2]$

產生矩陣
\(M=\left[\matrix{32290262828847459190[419 digits]60277520976882530721 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0\cr
0 & 35719898487071973003[476 digits]68945401330960162897 & 0 & 0 & 0 & 0 & 0 & 0 & 0\cr
0 & 0 & 39513804972403437655[533 digits]07174654938138697729 & 0 & 0 & 0 & 0 & 0 & 0\cr
-14125836519472822098[419 digits]94489721632952149605 & 11433592595586423031[476 digits]00952654252887393388 & 52180224974114632454[495 digits]00000000000000000000 & 24324935533561123862[361 digits]49738464971834145377 & 0 & 0 & 0 & 0 & 0\cr
0 & -15626179606991854661[476 digits]60211676569108886485 & 12647985215283616321[533 digits]86656469202955513516 & 57722427004923821310[552 digits]00000000000000000000 & 26908552357372882659[418 digits]46542924612696483089 & 0 & 0 & 0 & 0\cr
0 & 0 & -17285878168939820519[533 digits]81089654330431192645 & 13991361741171790418[590 digits]88089882508863743212 & 63853281218922005140[609 digits]00000000000000000000 & 29766582072559977503[475 digits]49821745201359022273 & 0 & 0 & 0\cr
61795488761586594662[418 digits]61228105756354228025 & -10003576662821081972[476 digits]14874260906612109880 & 40484972307212011736[532 digits]19137568143775384464 & 36952776573071059484[552 digits]95736854560233442230 & 84321886532206985153[571 digits]51737087375795677912 & 78616926430719870707[437 digits]00000000000000000000 & 18324486606014544982[303 digits]47263486203097090849 & 0 & 0\cr
0 & 68358953819071673294[475 digits]53451685880956792425 & -11066083444337370707[533 digits]78657042708931967160 & 44784990098426820113[589 digits]33285895980663125648 & 40877630355685238072[609 digits]16675173406681041110 & 93277940880617523876[628 digits]85134090008262090584 & 86967041623524387424[494 digits]00000000000000000000 & 20270779611300936552[360 digits]36453950823767472593 & 0\cr
0 & 0 & 75619542152448801923[532 digits]51332599109148483225 & -12241441928681489685[590 digits]25369415714902456120 & 49541724343946082466[646 digits]63054918145653160336 & 45219353414264099481[666 digits]97424893201642081270 & 10318524184826785550[686 digits]19237039307576470488 & 96204045008206368850[551 digits]00000000000000000000 & 22423793631144068882[417 digits]59771418125196067201}\right]\)

$LLL$化簡
\(B=\left[\matrix{-35743980059088545200[416 digits]80722642160047905681 & 46922824634222774487[417 digits]96446709945328871477 & 16364540563595223391[417 digits]91327750786549963386 & -97207301925654907852[417 digits]53799084107614558498 & -68006717288291680917[417 digits]14045799605521273218 & -22083850301737135483[417 digits]51281936303530818568 & 80777391656482090011[417 digits]81364384503413938164 & -18875467394270883798[417 digits]16922840533503730786 & 0\cr
-53855497698579115104[416 digits]22440422365250280904 & 74325972788911786534[417 digits]02667487696764782596 & -42360213040583351016[417 digits]52953633850159392540 & 93207789824932536615[417 digits]17899116640251965907 & 26743295137275436286[417 digits]30025365712179588699 & -19280506252185172185[417 digits]53869638507983632983 & -49522216738980310653[416 digits]09740058127199728661 & -54329652874359117291[417 digits]64740529713402819815 & 22423793631144068882[417 digits]59771418125196067201\cr
59886248145072283776[415 digits]00597316332236055074 & -13315128391293646051[417 digits]79917797014472050911 & 62558879042844919377[417 digits]09791573964335271861 & 11609344509786149688[418 digits]01042210268547527184 & -27368204832572340597[417 digits]17047835340290094121 & 17836124237718092338[417 digits]01896389102994872252 & -41032209045239051117[417 digits]16172892730225165900 & -59903924262576322974[417 digits]02209538630728871520 & -67271380893432206647[417 digits]79314254375588201603\cr
18422321777782777023[416 digits]59447344137439501243 & -21083022289790045344[417 digits]50420523383747574118 & -36876219378162584256[417 digits]55085598948970130728 & -12380026876101576575[418 digits]54404726405388353366 & 88756932911925724699[417 digits]97537235101170684352 & -14639498730317377843[418 digits]26252864402197471613 & -24797076405414559994[417 digits]60370312150796367236 & -16040594956631378629[418 digits]88876469069441734095 & 22423793631144068882[417 digits]59771418125196067201\cr
-59740829062319787233[416 digits]40688909484194485472 & 69491369706263632269[417 digits]58027265444373884189 & 12960931735222433006[418 digits]05407821747361781036 & 39543384198825880926[417 digits]32633257986499319708 & 14710427912295166891[418 digits]99414848522999747063 & -49840365686044385742[417 digits]35018273347131338824 & 20876577478866948183[417 digits]89058142685532409209 & 74627815624516244194[417 digits]75977705134307053965 & -44847587262288137765[417 digits]19542836250392134402\cr
-68384734181486838572[416 digits]00732056093284927437 & 91066074648706805896[417 digits]03099971016027027675 & -56710682936040096478[416 digits]32559138585047288553 & 72297457020480686195[417 digits]84446444836328742693 & -60533976691011414274[417 digits]31378847662774021892 & -12596396540470275328[418 digits]52090571729875618447 & -10880938062066902538[418 digits]67272557702486748080 & 21211756224520192677[418 digits]36650827112909148313 & 0\cr
-81250564085878561445[416 digits]34678304314010262958 & 10619954225570864725[418 digits]68561477549839159629 & 29714549780697273433[417 digits]69298528953401160635 & -43469171935032168882[417 digits]37163962147628359366 & -10442288961713937897[418 digits]86086266267518395545 & 49860675747404052367[416 digits]60024965193505807977 & -13253357916405795479[418 digits]68461980318400142027 & 13768422266804784107[417 digits]71514595120672325344 & 15696655541800848217[418 digits]18399926876372470407\cr
12609739358642155334[417 digits]57802314032806547340 & -17383608959896020481[418 digits]78499216381863868700 & 81673208107847127971[417 digits]29200832824127271546 & -20653954414963469692[417 digits]04471381311357994334 & -31161557914274171485[417 digits]97962853192070185042 & -84798118358121590160[417 digits]88845627108413875920 & 41678440330915146980[417 digits]79753567469752741441 & -85952558727161375791[417 digits]14248221183260863210 & 15696655541800848217[418 digits]18399926876372470407\cr
32200663351089791530[419 digits]57114456451584344136 & 12124879742313456102[418 digits]99114197642093654073 & -25995672476988127625[417 digits]61625883063609429154 & -39995121007223712365[416 digits]35899967467362592591 & -41263422151016244631[417 digits]84020433893341684519 & -41364356553922307668[417 digits]05151574811514451551 & 75825169982584058945[417 digits]71624326376214209503 & -73205120268630001090[417 digits]81663370246906550601 & 22423793631144068882[417 digits]59771418125196067201}\right]\)

產生不需要同餘$N^2$的方程式$r(x)=$
$-35743980059088545200[416 digits]80722642160047905681$
$\displaystyle +46922824634222774487[417 digits]96446709945328871477( \frac{x}{1106212689453879191977235208036134814768946283886104135857})$
$\displaystyle +16364540563595223391[417 digits]91327750786549963386( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^2$
$\displaystyle -97207301925654907852[417 digits]53799084107614558498( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^3$
$\displaystyle -68006717288291680917[417 digits]14045799605521273218( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^4$
$\displaystyle -22083850301737135483[417 digits]51281936303530818568( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^5$
$\displaystyle +80777391656482090011[417 digits]81364384503413938164( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^6$
$\displaystyle -18875467394270883798[417 digits]16922840533503730786( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^7$
$\displaystyle +0(\frac{x}{1106212689453879191977235208036134814768946283886104135857})^8$

$r(x)=$
$-931166326910674526718530634530395511188484760951215019202x^7$
$+44081667002866521292[75 digits]22469878202438872436x^6$
$-13331579738644988581[132 digits]48018398665104447624x^5$
$-45414785555369089229[189 digits]85106015860347068418x^4$
$-71809678294997445547[246 digits]13523136087532093186x^3$
$+13372929188694233984[303 digits]93165215585922633914x^2$
$+42417543282194563777[360 digits]26324257495544510661x$
$-35743980059088545200[416 digits]80722642160047905681$

$= -(x-83113117101097109105115104032079115115105102114097103101)$
$(931166326910674526718530634530395511188484760951215019202x^6$
$-43307745643175267650[75 digits]26182397092150127034x^5$
$+97321380036192344236[131 digits]32115288696559115190x^4$
$+46223653880907932101[189 digits]89490665635112272608x^3$
$+75651470252841928353[246 digits]55691765552926250594x^2$
$-70852996826996182688[302 digits]24287941312942141920x$
$-43006424624419143341[360 digits]20196969789558604581)$

整數解為$[x=83113117101097109105115104032079115115105102114097103101]$
Evaluation took 1965.2180 seconds (1977.6340 elapsed) using 132237.506 MB.}
[color=red](x)[/color]　$[x=83113117101097109105115104032079115115105102114097103101]$

[color=green]將密碼x從個位數開始每3位數分隔出一個數字[/color]
[color=red](%i19)[/color]　[color=blue]makelist(mod(floor(rhs(x[1])/1000^i),1000),i,length-1,0,-1);[/color]
[color=red](%o19)[/color]　$[83,113,117,101,97,109,105,115,104,32,79,115,115,105,102,114,97,103,101]$

[color=green]每一個數字轉換成ASCII表示法[/color]
[color=red](%i20)[/color]　[color=blue]makelist(ascii(i),i,%);[/color]
[color=red](%o20)[/color]　$[S,q,u,e,a,m,i,s,h, ,O,s,s,i,f,r,a,g,e]$

[color=green]將list組合成字串，得到密碼[/color]
[color=red](%i21)[/color]　[color=blue]simplode(%);[/color]
[color=red](%o21)[/color]　$Squeamish$ $Ossifrage$

bugmens 發表於 2022-3-17 09:42

2-1.兩個訊息有仿射關係
兩個訊息$m_1$和$m_2=\alpha m_1+\beta$有仿射關係(affine relation)
經由RSA加密，公鑰$e=3$，得到密文$\cases{c_1=m_1^3 \pmod{N} \cr c_2=m_2^3 \pmod{N}}$
若已知$c_1,c_2,\alpha,\beta,N$就可以回復明文
$\displaystyle \frac{\beta(c_2+2\alpha^3 c_1-\beta^3)}{\alpha(c_2-\alpha^3 c_1+2\beta^3)}=\frac{3\alpha^3\beta m_1^3+3\alpha^2 \beta^2 m_1^2+3\alpha \beta^3 m_1}{3 \alpha^3 \beta m_1^2+3\alpha^2 \beta^2 m_1+3 \alpha \beta^3}=m_1 \pmod{N}$
上面的式子可以從$m_1^3-c_1,(\alpha m_1+\beta)^3-c_2$計算歐幾里得演算法得到最大公因式。
若$\alpha=\beta=1$，則
$\displaystyle \frac{(m+1)^3+2m^3-1}{(m+1)^3-m^3+2}=\frac{3m^3+3m^2+3m}{3m^2+3m+3}=m \pmod{N}$

同樣RSA加密，換公鑰$e=5$，得到密文$\cases{c_1=m^5 \pmod{N}\cr c_2=(m+1)^5\pmod{N}}$
$P(m)=c_2^3-3c_1c_2^2+3c_1^2c_2-c_1^3+37c_2^2+176c_1c_2+37c_1^2+73c_2-73c_1+14$
$mP(m)=2c_2^3-1c_1c_2^2-4c_1^2c_2+3c_1^3+14c_2^2-88c_1c_2-51c_1^2-9c_2+64c_1-7$
$\displaystyle m=\frac{mP(m)}{P(m)}$
令$z$為未知的訊息$m$，則$z$滿足這兩個方程式$\cases{z^5-c_1\equiv 0\pmod{N}\cr (z+1)^5-c_2\equiv 0\pmod{N}}$
應用歐幾里得演算法找到最大公因式$gcd(z^5-c_1,(z+1)^5-c_2)\in Z/N[z]$，得到線性多項式$z-m$。

參考資料：
Coppersmith D., Franklin M., Patarin J., Reiter M. (1996) Low-Exponent RSA with Related Messages. In: Maurer U. (eds) Advances in Cryptology — EUROCRYPT ’96. EUROCRYPT 1996. Lecture Notes in Computer Science, vol 1070. Springer, Berlin, Heidelberg.
[url]https://link.springer.com/chapter/10.1007%2F3-540-68339-9_1[/url]
[url]https://link.springer.com/content/pdf/10.1007/3-540-68339-9_1.pdf[/url]

顯示數字的全部位數會造成版面凌亂，將太長的數字縮短顯示
功能表選取，編輯/設定/Worksheet/Maximum displayed number of digits調整為80

[color=green]多項式輾轉相除法副程式[/color]
[color=red](%i1)[/color]
[color=blue]GCD(fx1,fx2,var):=block([temp],
fx1:expand(fx1),
fx2:expand(fx2),
while hipow(fx2,var)#1 do
(temp:fx2,
print(fx1,"除以",fx2,"餘式",fx2:remainder(fx1,fx2,var)),
fx1:temp
),
fx2
)$[/color]

[color=green]根據密文c1,c2產生方程式[/color]
[color=red](%i3)[/color]
[color=blue]fx1:m1^3-c1;
fx2: (alpha*m1+beta)^3-c2;[/color]
[color=red](fx1)[/color]　$m_1^3-c_1$
[color=red](fx2)[/color]　$(\alpha m_1+\beta)^3-c_2$

[color=green]計算fx1和fx2輾轉相除法得到最大公因式[/color]
[color=red](%i4)[/color]　[color=blue]GCD:GCD(fx1,fx2,m1);[/color]
$m_1^3-c_1$除以$\alpha^3m_1^3+3\alpha^2\beta m_1^2+3\alpha\beta^2m_1-c_2+\beta^3$餘式$\displaystyle -\frac{3\alpha^2\beta m_1^2+3\alpha\beta^2m_1-c_2+\alpha^3c_1+\beta^3}{\alpha^3}$
$\alpha^3m_1^3+3\alpha^2\beta m_1^2+3\alpha\beta^2m_1-c_2+\beta^3$除以$\displaystyle -\frac{3\alpha^2\beta m_1^2+3\alpha\beta^2m_1-c_2+\alpha^3c_1+\beta^3}{\alpha^3}$餘式$\displaystyle\frac{(\alpha c_2-\alpha^4c_1+2\alpha\beta^3)m1-\beta c_2-2\alpha^3\beta c_1+\beta^4}{3\beta}$
[color=red](GCD)[/color]　$\displaystyle\frac{(\alpha c_2-\alpha^4c_1+2\alpha\beta^3)m1-\beta c_2-2\alpha^3\beta c_1+\beta^4}{3\beta}$

[color=green]從最大公因式，解方程式得m1[/color]
[color=red](%i5)[/color]　[color=blue]m1:solve(GCD,m1)[1];[/color]
[color=red](m1)[/color]　$\displaystyle m_1=\frac{\beta c_2+2 \alpha^3 \beta c_1-\beta^4}{\alpha c_2-\alpha^4 c_1+2 \alpha \beta^3}$

[color=green]範例取自[url=https://books.google.com.tw/books?id=KN2jkDfd4Z4C&lpg=PA183&dq=stereotyped%20messages&hl=zh-TW&pg=PA177#v=onepage&q&f=false]Cryptanalytic Attacks on RSA[/url][/color]
[color=red](%i10)[/color]
[color=blue]alpha:3;
beta:5;
N:7790302288510159542362475654705578362485767620973983941084402222135728725117099985850483876481319443405109322651368151685741199347755868542740942256445000879127232585749337061853958340278434058208881085485078737;
c1:132057584044937409231208389323398996878812486949811558724214983072091380989054308161277959733824865068687594213139826622055543700074552293693503940351187203266740911056806170880679978462212228231292575333924006;
c2:3565554769213310049242626511731772915727937147644912090997362096862084038123081043744658925329430451812652081858712220905928591327874274888835176225741122966452992998335410453929161733393892204730002674838955287;[/color]
[color=red](alpha)[/color]　$3$
[color=red](beta)[/color]　$5$
[color=red](N)[/color]　$77903022885101595423624756[159 digits]78434058208881085485078737$
[color=red](c1)[/color]　$13205758404493740923120838[158 digits]62212228231292575333924006$
[color=red](c2)[/color]　$35655547692133100492426265[159 digits]93892204730002674838955287$

[color=green]將$\alpha,\beta,c_1,c_2$代入[/color]
[color=red](%i11)[/color]　[color=blue]m1:ev(m1,[alpha=alpha,beta=beta,c1=c1,c2=c2]);[/color]
[color=red](m1)[/color]　$\displaystyle m_1=\frac{\beta c_2+2 \alpha^3 \beta c_1-\beta^4}{\alpha c_2-\alpha^4 c_1+2 \alpha \beta^3}=\frac{16978832234349095472583935[158 digits]61164325860631773696362722}{51843405275386826203986806[103 digits]08706305166524791817361975}$

[color=green]明文m1,m2[/color]
[color=red](%i13)[/color]
[color=blue]m1:ratsimp(rhs(m1)),modulus:N;
m2:alpha*m1+beta;[/color]
[color=red]warning: assigning 77903022885101595423624756[159 digits]78434058208881085485078737, a non-prime, to 'modulus'[/color]
[color=red](m1)[/color]　$200805001301070903002315180419000118050019172105011309190800151919090618010705$
[color=red](m2)[/color]　$602415003903212709006945541257000354150057516315033927572400455757271854032120$

[color=green]驗算[/color]
[color=red](%i15)[/color]
[color=blue]is(power_mod(m1,3,N)=c1);
is(power_mod(m2,3,N)=c2);[/color]
[color=red](%o14)[/color]　$true$
[color=red](%o15)[/color]　$true$

[color=green]清除m1,m2,alpha,beta,N,c1,c2設定[/color]
[color=red](%i16)[/color]　[color=blue]kill(m1,m2,alpha,beta,N,c1,c2);[/color]
[color=red](%o16)[/color]　$done$

[color=green]根據密文c1,c2產生方程式[/color]
[color=red](%i18)[/color]
[color=blue]fx1:m1^5-c1;
fx2: (m1+1)^5-c2;[/color]
[color=red](fx1)[/color]　$m_1^5-c_1$
[color=red](fx2)[/color]　$(m_1+1)^5-c_2$

[color=green]計算fx1和fx2輾轉相除法得到最大公因式[/color]
[color=red](%i19)[/color]　[color=blue]GCD:GCD(fx1,fx2,m1)[/color]
$m_1^5-c_1$除以$m_1^5+5m_1^4+10m_1^3+10m_1^2+5m_1-c_2+1$餘式$-5m_1^4-10m_1^3-10m_1^2-5m_1+c_2-c_1-1$
$m_1^5+5m_1^4+10m_1^3+10m_1^2+5m_1-c_2+1$除以$-5m_1^4-10m_1^3-10m_1^2-5m_1+c_2-c_1-1$餘式$\displaystyle \frac{10m_1^3+15m_1^2+(c_2-c_1+9)m_1-2c_2-3c_1+2}{5}$
$-5m_1^4-10m_1^3-10m_1^2-5m_1+c_2-c_1-1$除以$\displaystyle \frac{10m_1^3+15m_1^2+(c_2-c_1+9)m_1-2c_2-3c_1+2}{5}$餘式$\displaystyle \frac{(2c_2-2c_1-7)m_1^2+(-3c_2-7c_1-7)m_1+2c_2-7c_1-2}{4}$
$\displaystyle \frac{10m_1^3+15m_1^2+(c_2-c_1+9)m_1-2c_2-3c_1+2}{5}$除以$\displaystyle \frac{(2c_2-2c_1-7)m_1^2+(-3c_2-7c_1-7)m_1+2c_2-7c_1-2}{4}$餘式$\displaystyle \frac{4c_2^3+(148-12c_1)c_2^2+(12c_1^2+704c_1+292)c_2-4c_1^3+148c_1^2-292c_1+56)m_1-8c_2^3+(4c_1-56)c_2^2+(16c_1^2+352c_1+36)c_2-12c_1^3+204c_1^2-256c_1+28}{20c_2^2+(-40c_1-140)c_2+20c_1^2+140c_1+245}$
[color=red](GCD)[/color]　$\displaystyle \frac{4c_2^3+(148-12c_1)c_2^2+(12c_1^2+704c_1+292)c_2-4c_1^3+148c_1^2-292c_1+56)m_1-8c_2^3+(4c_1-56)c_2^2+(16c_1^2+352c_1+36)c_2-12c_1^3+204c_1^2-256c_1+28}{20c_2^2+(-40c_1-140)c_2+20c_1^2+140c_1+245}$

[color=green]從最大公因式，解方程式得m1[/color]
[color=red](%i20)[/color]　[color=blue]m1:solve(GCD,m1)[1];[/color]
[color=red](m1)[/color]　$\displaystyle m_1=\frac{2c_2^3+(14-c_1)c_2^2+(-4c_1^2-88c_1-9)c_2+3c_1^3-51c_1^2+64c_1-7}{c_2^3+(37-3c_1)c_2^2+(3c_1^2+176c_1+73)c_2-c_1^3+37c_1^2-73c_1+14}$

[color=green]範例取自[url=https://books.google.com.tw/books?id=KN2jkDfd4Z4C&lpg=PA183&dq=stereotyped%20messages&hl=zh-TW&pg=PA179#v=onepage&q&f=false]Cryptanalytic Attacks on RSA[/url][/color]
[color=red](%i23)[/color]
[color=blue]c1:18796237015415790;
c2:7290180156009373;
N:35480779745861123;[/color]
[color=red](c1)[/color]　$18796237015415790$
[color=red](c2)[/color]　$7290180156009373$
[color=red](N)[/color]　$35480779745861123$

[color=green]將c1,c2代入[/color]
[color=red](%i24)[/color]　[color=blue]m1:ev(m1,[c1=c1,c2=c2]);[/color]
[color=red](m1)[/color]　$\displaystyle m_1=\frac{2c_2^3+(14-c_1)c_2^2+(-4c_1^2-88c_1-9)c_2+3c_1^3-51c_1^2+64c_1-7}{c_2^3+(37-3c_1)c_2^2+(3c_1^2+176c_1+73)c_2-c_1^3+37c_1^2-73c_1+14}=-\frac{43297460062121981374915003596042374969361963498}{7019720390981513672602639591832073102833439091}$

[color=green]將分數m_1同餘N[/color]
[color=red](%i25)[/color]　[color=blue]m1:ratsimp(rhs(m1)),modulus:N;[/color]
[color=red]warning: assigning 35480779745861123, a non-prime, to 'modulus'[/color]
[color=red](m1)[/color]　$-16036924398274761$

[color=green]明文m1,m2[/color]
[color=red](%i27)[/color]
[color=blue]m1:mod(m1,N);
m2:m1+1;[/color]
[color=red](m1)[/color]　$19443855347586362$
[color=red](m2)[/color]　$19443855347586363$

[color=green]驗算[/color]
[color=red](%i29)[/color]
[color=blue]is(power_mod(m1,5,N)=c1);
is(power_mod(m2,5,N)=c2);[/color]
[color=red](%o28)[/color]　$true$
[color=red](%o29)[/color]　$true$

bugmens 發表於 2022-8-23 18:10

2-2.兩個訊息有仿射關係
上一篇文章提到兩個訊息$m_1$和$m_2=\alpha m_1+\beta$有仿射關係的話就可以回復明文，但實務上兩個訊息的$\alpha$和$\beta$值不易得知。

改成明文$M$向左平移$k$位元，各加上隨機補綴值$T_1$和$T_2$(假設$T_1<T_2$)後$e=3$次方同餘$N$得到密文$c_1,c_2$
$c_1\equiv m_1^3=(2^kM+T_1)^3\pmod{N}$
$c_1\equiv m_2^3=(2^kM+T_2)^3\pmod{N}$
若2個補綴值$T_1$和$T_2$很接近，設$t$為兩個補綴值的差，且$t<N^{\frac{1}{9}}$
$t=T_2-T_1$，$t=(2^kM+T_2)-(2^kM+T_1)$，$t=m_2-m_1$，$m_2=m_1+t$
得到兩個同餘方程式，
$\cases{c_1\equiv m_1^3\pmod{N}\cr c_2\equiv m_2^3\pmod{N}}$，$\cases{m_1^3-c1\equiv 0\pmod{N}\cr (m_1+t)^3-c_2\equiv 0\pmod{N}}$
利用Resultant消去共同變數$m_1$，得到$t$的9次方程式。
$Res_{m_1}(m_1^3-c_1,(m_1+t)^3-c_2)=t^9+(3c_1-3c_2)t^6+(3c_1^2+21c_1c_2+3c_2^2)t^3+(c_1-c_2)^3\equiv 0\pmod{N}$
因為$t<N^{\frac{1}{9}}$，可利用Coppersmith-Howgrave方法求得$t$較小的解。
再利用上一篇輾轉相除法求得$m_1=2^kM+T_1$的解，再將後面$k$位元刪除得到明文$M$。
$\displaystyle m_1\equiv \frac{t(c_2+2c_1-t^3)}{c_2-c_1+2t^3}=\frac{t((m_1+t)^3+2m_1^3-t^3)}{(m_1+t)^3-m_1^3+2t^3}=\frac{t(3m_1^3+3m_1^2t+3m_1t^2)}{3m_1^2t+3m_1t^2+3t^3}\pmod{N}$

本篇文章先介紹要如何計算Resultant(結式)。

參考資料：
D. Coppersmith. Finding a small root of a univariate modular equation. In Proceedings of Eurocrypt 1996, volume 1070 of Lecture Notes in Computer Science, pages 155–165. Springer, 1996.
[url]https://link.springer.com/chapter/10.1007/3-540-68339-9_14[/url]
[url]https://isc.tamu.edu/resources/preprints/1996/1996-02.pdf[/url]
[url]https://canvas.mit.edu/courses/7568/files/1221337/download?download_frd=1[/url][table][tr][td][align=center]公式[/align][/td][td][align=center]範例[/align][/td][/tr]
[tr][td]設$f(x)=a_nx^n+a_{n-1}x^{n-1}+\ldots+a_0$和
$g(x)=b_mx^m+b_{m-1}x^{m-1}+\ldots+b_0$
是次數為$n$和$m$的多項式
設$f(x)$和$g(x)$的Sylvester矩陣為
$Syl(f,g)=\left[\matrix{a_n&a_{n-1}&\ldots&\ldots&a_0&0&0\cr
0&a_n&a_{n-1}&\ldots&a_1&a_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&a_n&a_{n-1}&\ldots&a_0\cr
b_m&b_{m-1}&\ldots&\ldots&b_0&0&0\cr
0&b_m&b_{m-1}&\ldots&b_1&b_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&b_m&b_{m-1}&\ldots&b_0}\right] \matrix{　\cr 　 \cr f(x)取m列\cr 　\cr 　\cr　\cr g(x)取n列\cr　}$
則$f(x)$和$g(x)$的Resultant為Sylvester矩陣的行列式值
$Res(f,g)=det(Syl(f,g))$
$Res(f,g)=\left|\matrix{a_n&a_{n-1}&\ldots&\ldots&a_0&0&0\cr
0&a_n&a_{n-1}&\ldots&a_1&a_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&a_n&a_{n-1}&\ldots&a_0\cr
b_m&b_{m-1}&\ldots&\ldots&b_0&0&0\cr
0&b_m&b_{m-1}&\ldots&b_1&b_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&b_m&b_{m-1}&\ldots&b_0}\right|$
[/td][td]$f(x)=1x^3+2x^2+3x+4$
$g(x)=5x^2+6x+7$
$f(x)$和$g(x)$的Sylvester矩陣為
$Syl(f,g)=\left[\ \matrix{1&2 &3 &4 &0\cr 0 &1&2 &3 &4 \cr 5&6&7&0&0 \cr 0&5&6&7&0 \cr 0&0&5&6&7} \right] \matrix{f(x)取2列\cr　\cr 　 \cr g(x)取3列 \cr　}$
$f(x)$和$g(x)$的Resultant為
$Res(f,g)= \left|\ \matrix{1&2 &3 &4 &0\cr 0 &1&2 &3 &4 \cr 5&6&7&0&0 \cr 0&5&6&7&0 \cr 0&0&5&6&7} \right|=832 $
超過3階行列式不能用交叉相乘方式計算，而降階方式計算量又太大，實務上可採用PA=LU分解，再個別計算矩陣$P,L,U$的行列式值，$det(P)\cdot det(A)=det(L)\cdot det(U)$，進而得到矩陣$A$的行列式值。
參考資料：[url]https://ccjou.wordpress.com/2012/04/13/palu-%E5%88%86%E8%A7%A3/[/url]
$P=\left[ \matrix{1&0&0&0&0\cr 0&1&0&0&0\cr 0&0&0&1&0\cr 0&0&1&0&0\cr 0&0&0&0&1}\right]$，$det(P)=-1$
$L=\left[ \matrix{\displaystyle 1&0&0&0&0\cr 0&1&0&0&0\cr 0&5&1&0&0\cr 5&-4&0&1&0\cr 0&0&-\frac{5}{4}&\frac{1}{2}&1}\right]$，$det(L)=1\cdot 1\cdot 1\cdot 1\cdot 1=1$
$U=\left[ \matrix{1&2&3&4&0\cr 0&1&2&3&4\cr 0&0&-4&-8&-20\cr 0&0&0&-8&16\cr 0&0&0&0&-26}\right]$，$det(U)=1\cdot 1\cdot (-4)\cdot(-8)\cdot(-26)=-832$
$\displaystyle Res(f,g)=\frac{det(L)\cdot det(U)}{det(P)}=\frac{1\cdot (-832)}{-1}=832$[/td][/tr]
[tr][td]判斷是否有共同根
若$Res(f,g)=0$，則$f,g$有共同根
[證明]
設$x=x_0$是$f(x)=0,g(x)=0$的共同根，則$f(x_0)=g(x_0)=0$
$\left[\matrix{a_n&a_{n-1}&\ldots&\ldots&a_0&0&0\cr
0&a_n&a_{n-1}&\ldots&a_1&a_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&a_n&a_{n-1}&\ldots&a_0\cr
b_m&b_{m-1}&\ldots&\ldots&b_0&0&0\cr
0&b_m&b_{m-1}&\ldots&b_1&b_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&b_m&b_{m-1}&\ldots&b_0}\right]
\left[\matrix{x_0^{n+m-1}\cr x_0^{n+m-2}\cr \vdots \cr x_0^n \cr x_0^{n-1}\cr \vdots \cr x_0 \cr 1}\right]=\left[\matrix{f(x_0)x_0^{m-1}\cr f(x_0)x_0^{m-2}\cr \vdots \cr f(x_0)x_0 \cr f(x_0)\cr g(x_0)x_0^{n-1} \cr g(x_0)x_0^{n-2}\cr \vdots \cr g(x_0)x_0 \cr g(x_0)} \right]=0$
$Syl(f,g)x=0$是齊次方程組
若$x$有非0解，則$Syl(f,g)$的行列式值要為0，得到
$Res(f,g)=\left|\matrix{a_n&a_{n-1}&\ldots&\ldots&a_0&0&0\cr
0&a_n&a_{n-1}&\ldots&a_1&a_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&a_n&a_{n-1}&\ldots&a_0\cr
b_m&b_{m-1}&\ldots&\ldots&b_0&0&0\cr
0&b_m&b_{m-1}&\ldots&b_1&b_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&b_m&b_{m-1}&\ldots&b_0}\right|=0$[/td][td]$f(x)=(x^2-1)(x^2+x+2)=x^4+x^3+x^2-x-2$
$g(x)=(x^2-1)(x^3+x^2+x-1)=x^5+x^4-2x^2-x+1$有共同根
設$x=x_0$是$f(x)=0,g(x)=0$的共同根，則$f(x_0)=g(x_0)=0$
$\left[\matrix{1&1&1&-1&-2&0&0&0&0\cr
0&1&1&1&-1&-2&0&0&0\cr
0&0&1&1&1&-1&-2&0&0\cr
0&0&0&1&1&1&-1&-2&0\cr
0&0&0&0&1&1&1&-1&-2\cr
1&1&0&-2&-1&1&0&0&0\cr
0&1&1&0&-2&-1&1&0&0\cr
0&0&1&1&0&-2&-1&1&0\cr
0&0&0&1&1&0&-2&-1&1}\right]
\left[\matrix{x_0^8\cr x_0^7\cr x_0^6\cr x_0^5\cr x_0^4\cr x_0^3\cr x_0^2\cr x_0^1\cr 1} \right]=
\left[\matrix{f(x_0)\cdot x_0^4\cr f(x_0)\cdot x_0^3\cr f(x_0)\cdot x_0^2\cr f(x_0)\cdot x_0\cr f(x_0)\cr g(x_0)\cdot x_0^3\cr g(x_0)\cdot x_0^2\cr g(x_0)\cdot x_0\cr g(x_0)} \right]=0$
$Syl(f,g)x=0$是齊次方程組
若$x$有非0解，則$Syl(f,g)$的行列式值要為0，得到
$Res(f,g)=\left|\ \matrix{1&1&1&-1&-2&0&0&0&0\cr
0&1&1&1&-1&-2&0&0&0\cr
0&0&1&1&1&-1&-2&0&0\cr
0&0&0&1&1&1&-1&-2&0\cr
0&0&0&0&1&1&1&-1&-2\cr
1&1&0&-2&-1&1&0&0&0\cr
0&1&1&0&-2&-1&1&0&0\cr
0&0&1&1&0&-2&-1&1&0\cr
0&0&0&1&1&0&-2&-1&1}\right|=0$[/td][/tr]
[tr][td]兩變數方項式消除共同變數
$f(x,y)=0,g(x,y)=0$為兩變數方程式，已知$f(x)$和$g(x)$有共同根，可利用Resultant消除共同變數[/td][td]設$f(x,y)=x^2y^2-25x^2+9=0$
$g(x,y)=4x+y=0$
若要消去$x$變數，先以$x$為變數降冪排列
$f(x,y)=(y^2-25)x^2+0x+9$，$g(x,y)=4x+y$
計算$f(x,y)$和$g(x,y)$的Resultant
$Res_x(f,g)=\left|\ \matrix{y^2-25&0&9 \cr 4&y&0 \cr 0&4&y} \right|\ =y^4-25y^2+144=0$
解得$y=\pm 3,\pm 4$，代回$g(x,y)=0$
得$\displaystyle (x,y)=(1,-4),(-1,4),(\frac{3}{4},-3),(-\frac{3}{4},3)$

若要消去$y$變數，先以$y$為變數降冪排列
$f(x,y)=x^2y^2+0y+(-25x^2+9),g(x,y)=y+4x$
計算$f(x,y)$和$g(x,y)$的Resultant
$Res_y(f,g)=\left|\ \matrix{x^2&0&-25x^2+9 \cr 1&4x&0 \cr 0&1&4x} \right|\ =16x^4-25x^2+9=0 $
解得$\displaystyle x=\pm \frac{3}{4},\pm 1$，代回$g(x,y)=0$
得$\displaystyle (x,y)=(1,-4),(-1,4),(\frac{3}{4},-3),(-\frac{3}{4},3)$
範例出處
[url]http://buzzard.ups.edu/courses/2016spring/projects/woody-resultants-ups-434-2016.pdf[/url][/td][/tr]
[/table]

[color=green]取多項式P的x的各項係數[/color]
[color=red](%i1)[/color]
[color=blue]coeffs(P,x):=block (local(l),l:[],
  for i from hipow(P,x) step -1 thru 0 do l:cons(coeff(P,x,i),l),
  reverse(l));[/color]
[color=red](%o1)[/color]　coeffs(P,x):=block(local(l),l:[],for i from hipow(P,x) step -1 thru 0 do l:cons(coeff(P,x,i),l),reverse(l))

[color=green]計算多項式P和Q的Sylvester矩陣
副程式出處[url]http://www.lpthe.jussieu.fr/~talon/subresultant.mac[/url][/color]
[color=red](%i2)[/color]
[color=blue]result(P,Q,x):=block(local(mat,len1,len2,ll1,ll2),
  len1:hipow(P,x)+1,
  len2:hipow(Q,x)+1, /* assume len1 >= len2 */
  mat:zeromatrix(len1+len2-2,len1+len2-2),
  ll1:coeffs(P,x),
  ll2:coeffs(Q,x),
  for i from 1 thru len2-1 do (
for j from i thru i+len1-1 do (
   mat[i,j]:ll1[j-i+1])),
  for i from len2 thru len2+len1-2 do (
for j from i-len2+1 thru i do (
   mat[i,j]:ll2[j-i+len2])),
  mat)$[/color]

[color=green]第2個例子[/color]
[color=red](%i5)[/color]
[color=blue]f:x^3+2*x^2+3*x+4;
g:5*x^2+6*x+7;
result(f,g,x);[/color]
[color=red](f)[/color]　$x^3+2x^2+3x+4$
[color=red](g)[/color]　$5x^2+6x+7$
[color=red](%o5)[/color]　$\left[\matrix{1&2&3&4&0\cr
0&1&2&3&4\cr
5&6&7&0&0\cr
0&5&6&7&0\cr
0&0&5&6&7}\right]$

[color=green]計算LU分解[/color]
[color=red](%i6)[/color]　[color=blue][P,L,U]:get_lu_factors(lu_factor(%,generalring));[/color]
[color=red](%o6)[/color]　$[\left[\matrix{1&0&0&0&0\cr 0&1&0&0&0\cr 0&0&0&1&0\cr 0&0&1&0&0\cr 0&0&0&0&1} \right],\left[\matrix{\displaystyle 1&0&0&0&0\cr 0&1&0&0&0\cr 0&5&1&0&0\cr 5&-4&0&1&0\cr 0&0&-\frac{5}{4}&\frac{1}{2}&1} \right],\left[\matrix{1&2&3&4&0\cr 0&1&2&3&4\cr 0&0&-4&-8&-20\cr 0&0&0&-8&16\cr 0&0&0&0&-26} \right]]$

[color=green]計算矩陣P,L,U的行列式值[/color]
[color=red](%i9)[/color]
[color=blue]detP:determinant(P);
detL:determinant(L);
detU:determinant(U);[/color]
[color=red](detP)[/color]　$-1$
[color=red](detL)[/color]　1
[color=red](detU)[/color]　$-832$

[color=green]計算行列式值[/color]
[color=red](%i10)[/color]　[color=blue]detL*detU/detP;[/color]
[color=red](%o10)[/color]　832

[color=green]第3個例子[/color]
[color=red](%i14)[/color]
[color=blue]f:x^4+x^3+x^2-x-2;
g:x^5+x^4-2x^2-x+1;
result(f,g,x);
determinant(%);[/color]
[color=red](f)[/color]　$x^4+x^3+x^2-x-2$
[color=red](g)[/color]　$x^5+x^4-2*x^2-x+1$
[color=red](%o13)[/color]　$\left[\matrix{1&1&1&-1&-2&0&0&0&0\cr
0&1&1&1&-1&-2&0&0&0\cr
0&0&1&1&1&-1&-2&0&0\cr
0&0&0&1&1&1&-1&-2&0\cr
0&0&0&0&1&1&1&-1&-2\cr
1&1&0&-2&-1&1&0&0&0\cr
0&1&1&0&-2&-1&1&0&0\cr
0&0&1&1&0&-2&-1&1&0\cr
0&0&0&1&1&0&-2&-1&1}\right]$
[color=red](%o14)[/color]　$0$

[color=green]第4個例子[/color]
[color=red](%i16)[/color]
[color=blue]f:x^2*y^2-25*x^2+9;
g:4*x+y;[/color]
[color=red](f)[/color]　$x^2y^2-25x^2+9$
[color=red](g)[/color]　$y+4x$

[color=green]消掉共同變數x[/color]
[color=red](%i19)[/color]
[color=blue]result(f,g,x);
determinant(%);
ratsimp(%);[/color]
[color=red](%o17)[/color]　$\left[\matrix{y^2-25&0&9\cr 4&y&0\cr 0&4&y}\right]$
[color=red](%o18)[/color]　$y^2(y^2-25)+144$
[color=red](%o19)[/color]　$y^4-25y^2+144$

[color=green]先解出y[/color]
[color=red](%i20)[/color]　[color=blue]solve(%,y);[/color]
[color=red](%o20)[/color]　$[y=-4,y=4,y=-3,y=3]$

[color=green]將y代回g(x,y)=0求x[/color]
[color=red](%i21)[/color]　[color=blue]map(lambda([y],[solve(ev(g,y),x)[1],y]),%);[/color]
[color=red](%o21)[/color]　$\displaystyle [[x=1,y=-4],[x=-1,y=4],[x=\frac{3}{4},y=-3],[x=-\frac{3}{4},y=3]]$

[color=green]消掉共同變數y[/color]
[color=red](%i23)[/color]
[color=blue]result(f,g,y);
determinant(%);[/color]
[color=red](%o22)[/color]　$\left[\matrix{x^2&0&9-25x^2\cr 1&4x&0\cr 0&1&4x}\right]$
[color=red](%o23)[/color]　$16x^4-25x^2+9$

[color=green]先解出x[/color]
[color=red](%i24)[/color]　[color=blue]solve(%,x);[/color]
[color=red](%o24)[/color]　　$\displaystyle [x=-1,x=1,x=-\frac{3}{4},x=\frac{3}{4}]$

[color=green]將x代回g(x,y)=0求y[/color]
[color=red](%i25)[/color]　[color=blue]map(lambda([x],[x,solve(ev(g,x),y)[1]]),%);[/color]
[color=red](%o25)[/color]　$\displaystyle [[x=-1,y=4],[x=1,y=-4],[x=-\frac{3}{4},y=3],[x=\frac{3}{4},y=-3]]$

[color=green]第1個例子[/color]
[color=red](%i30)[/color]
[color=blue]f:m1^3-c1;
g: (m1+t)^3-c2;
result(f,expand(g),m1);
determinant(%);
ratsimp(%);[/color]
[color=red](f)[/color]　$m1^3-c1$
[color=red](g)[/color]　$(t+m1)^3-c2$
[color=red](%o28)[/color]　$\left[\matrix{1&0&0&-c1&0&0\cr 0&1&0&0&-c1&0\cr 0&0&1&0&0&-c1\cr 1&3t&3t^2&t^3-c2&0&0\cr 0&1&3t&3t^2&t^3-c2&0\cr 0&0&1&3t&3t^2&t^3-c2}\right]$
[color=red](%o29)[/color]　$(t^3-c2)^3+c1((t^3-c2)^2+c1(10t^3-c2)-9t^3(t^3-c2))+c1((t^3-c2)^2-c1(8t^3+c2)+c1(t^3-c2+c1))+c1(3t^2(9t^4-3t(t^3-c2))-(t^3-c2)(8t^3+c2))$
[color=red](%o30)[/color]　$t^9+(3c1-3c2)t^6+(3c2^2+21c1c2+3c1^2)t^3-c2^3+3c1c2^2-3c1^2c2+c1^3$

[color=green]也可以使用maxima內建指令計算resultant[/color]
[color=red](%i31)[/color]　[color=blue]resultant(f,g,m1);[/color]
[color=red](%o31)[/color]　$t^9+c1(3t^6+21c2t^3+3c2^2)-3c2t^6+c1^2(3t^3-3c2)+3c2^2t^3-c2^3+c1^3$

[color=green]整理成t的多項式[/color]
[color=red](%i32)[/color]　[color=blue]ratsimp(%);[/color]
[color=red](%o32)[/color]　$t^9+(3c1-3c2)t^6+(3c2^2+21c1c2+3c1^2)t^3-c2^3+3c1c2^2-3c1^2c2+c1^3$

bugmens 發表於 2022-9-3 19:37

2-3.兩個訊息有仿射關係
設明文$M$乘$10^5$倍，各加上隨機補綴值$T_1$和$T_2$(假設$0\le T_1,T_2<10^5,T_1<T_2$)後$e=3$次方同餘$N$得到密文$c_1,c_2$。
$c1=1881676371789154860897069000$
$c2=1881678004162711039676405223$
$N=54957464841358314276864542898551$
若2個補綴值$T_1$和$T_2$很接近，設$t$為兩個補綴值的差，$t$未知但足夠小($t<N^{\frac{1}{9}}$)。
將密文$c_1,c_2$，公鑰$N$代入9次同餘方程式
$t^9+(3c_1-3c_2)t^6+(3c_1^2+21c_1c_2+3c_2^2)t^3+(c_1-c_2)^3\equiv 0\pmod{N}$

雖然論文說能找到比$N^{\frac{1}{9}}=3362$還小的解，但以Coppersmith_Howgrave()副程式精算的上界$X$卻小很多。
$\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})$
設$h=3$，9次方程式$k=9$，計算出$X=172$
而且會產生$27 \times 27$的超大矩陣，導致LLL化簡的時間大幅增加還無法求得較小的解。

換另一個作法，令$t^3=x$，先解3次同餘方程式，不僅Coppersmith_Howgrave()副程式精算的上界$X$提高很多。
$x^3+(3c_1-3c_2)x^2+(3c_1^2+21c_1c_2+3c_2^2)x+(c_1-c_2)^3\equiv 0\pmod{N}$
設$h=3$，3次方程式$k=3$，計算出$X=46260610$
而且產生$9\times 9$較小的矩陣，LLL化簡的時間變得更短了

所得到的較小$x$的解，再解一次3次同餘方程式，得到兩個補綴值的差$t$。
$t^3-x\equiv 0\pmod{N}$

再將密文$c_1,c_2$，補綴值的差$t$，公鑰$N$代入以下公式得到有補綴值的$m_1$，再將後5位補綴值刪除得到明文$M$。
$\displaystyle m_1\equiv \frac{t(c_2+2c_1-t^3)}{c_2-c_1+2t^3}\pmod{N}$

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.46.0\share\maxima\5.46.0\share目錄下
要先載入LLL.mac才能使用Coppersmith_Howgrave指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.46.0/share/maxima/5.46.0/share/LLL.mac

[color=green]已知密文$c_1,c_2$，公鑰$N$[/color]
[color=red](%i4)[/color]
[color=blue]c1:1881676371789154860897069000;
c2:1881678004162711039676405223;
N:54957464841358314276864542898551;[/color]
[color=red](c1)[/color]　1881676371789154860897069000
[color=red](c2)[/color]　1881678004162711039676405223
[color=red](N)[/color]　54957464841358314276864542898551

[color=green]9次同餘方程式[/color]
[color=red](%i5)[/color]　[color=blue]fx:x^9+(3*c1-3*c2)*x^6+(3*c1^2+21*c1*c2+3*c2^2)*x^3+(c1-c2)^3;[/color]
[color=red](fx)[/color]　$x^9-4897120668536338008669x^6+95599144073213399280057649148373498671072396308207166187x^3$
$-4349693466736349905369332025355097289037604766707550608234921567$

[color=green]同餘方程式係數同餘N，讓係數變小[/color]
[color=red](%i6)[/color]　[color=blue]fx:polymod(fx,N);[/color]
[color=red](fx)[/color]　$x^9-4897120668536338008669x^6-1516451737447758219766669752498x^3-21000738238808374545647388458802$

[color=green]參數h[/color]
[color=red](%i7)[/color]　[color=blue]h:3;[/color]
[color=red](h)[/color]　3

[color=green]利用Coppersmith_Howgrave方法解9次同餘方程式，執行時間需2262秒(37分鐘)
但執行結果無法求得較小的整數解，故省略執行過程[/color]
[color=red](%i10)[/color]
[color=blue]showtime:true$
Coppersmith_Howgrave(fx,N,h);
showtime:false$[/color]
...
整數解為[]
Evaluation took 2262.6870 seconds (2264.0150 elapsed) using 420496.373 MB.
[color=red](%o9)[/color]　[]

[color=green]令t^3=x，化簡成3次同餘方程式[/color]
[color=red](%i11)[/color]　[color=blue]fx:x^3+(3*c1-3*c2)*x^2+(3*c1^2+21*c1*c2+3*c2^2)*x+(c1-c2)^3;[/color]
[color=red](fx)[/color]　$x^3-4897120668536338008669x^2+95599144073213399280057649148373498671072396308207166187x$
$-4349693466736349905369332025355097289037604766707550608234921567$

[color=green]同餘方程式係數同餘N，讓係數變小[/color]
[color=red](%i12)[/color]　[color=blue]fx:polymod(fx,N);[/color]
[color=red](fx)[/color]　$x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802$

[color=green]利用Coppersmith_Howgrave方法解3次同餘方程式，執行時間需43秒[/color]
[color=red](%i15)[/color]
[color=blue]showtime:true$
X:Coppersmith_Howgrave(fx,N,h);
showtime:false$[/color]
Evaluation took 0.0000 seconds (0.0000 elapsed) using 0 bytes.
參數$h=3$
$p(x)$最高次方$k=3$
$\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}}9^{-1/8}54957464841358314276864542898551^{1/4})=46260610$
$q_uv=N^{h-1-v} x^u p(x)^v =$ $[3020322941789135243826751301254310584993059920451586964677899601,$
$3020322941789135243826751301254310584993059920451586964677899601x,$
$3020322941789135243826751301254310584993059920451586964677899601x^2,$
$54957464841358314276864542898551(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802),$
$54957464841358314276864542898551x(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802),$
$54957464841358314276864542898551x^2(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802),$
$(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802)^2,$
$x(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802)^2,$
$x^2(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802)^2]$
用$46260610x$取代$x$,得到$q_{uv}=$ $[3020322941789135243826751301254310584993059920451586964677899601,$
$139721981684159887751924249514318172791235797686641888454048089061016610x,$
$6463624103118063744935544456324562407407970654820642611436221569296955598732100x^2,$
$54957464841358314276864542898551(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802),$
$2542365847614788847019462641858137376110x(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802),$
$117611394953827177084317023684568968482648027100x^2(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802),$
$(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802)^(2),$
$46260610x(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802)^(2),$
$2140044037572100x^2(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802)^(2)]$
產生矩陣\(M=\left[ \matrix{
3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0\cr
0&139721981684159887751924249514318172791235797686641888454048089061016610&0&0&0&0&0&0&0\cr
0&0&6463624103118063744935544456324562407407970654820642611436221569296955598732100&0&0&0&0&0&0\cr
-1154147333401880370164435877744830779893335235336308145728995902&-3855375106843289059874469643405077531431008453876682145059536838022780&-575957193083777435966023818707724430220694882620408968134835546929900&5440774873514967046498526949032608069078072148942531000&0&0&0&0&0\cr
0&-53391559673044361070832604010361296224641422921151169969392245114020220&-178352004221385726316119489130401363701292623991492180806562660444404996695800&-26644131085943325292024201127948743853911779893898517315388054650660801239000&251693564521475219700920220763687359166473755234092339003910000&0&0&0&0\cr
0&0&-2469926119326432700196969469407759883742609255600435024997766588244094929534200&-8250672510003878744676740400060736629653654574347063094341880675381046234195692438000&-1232573756955700653437467678941596939415709824077480689105413794852905568404895790000&11643497827837801763248586973862843084330167466119804398647668985100000&0&0&0\cr
441031006574948269107459443949256719868815747806770028851275204&2946486839047310595109751478204161934049771268347937188112057574543120&4921301076215693158799367543245210199690179969531456795727185981205628668000&1470393112007528062187159841915196407503917007629683675986668119372838320000&109831529494789146606929429768530109268611975609482301299443587987461650000&-2075045274790487347904810593080778841186998131216420673800000&9800949035846008678895673107522190930361000000&0&0\cr
0&20402363393071117647355229427353424907730536471147343664377590214914440&136306278531300406989240120330126235607922189234249266563748531753485202503200&227662389779394457098885610164724803415889536400306605558985017074020917615167480000&68021282301266572748895948454500554080939778162323820958185619069740318114575200000&5080873551661937743415985648044361658132643844999773042316053040888648280606500000&-95992860189425566911358759970378608468403657618931662386599018000000&453397880977148227551007964314572140974967380210000000&0\cr
0&0&943825776005139675748417799999320121820808332782523517793742593671973092208400&6305611591687860920570511402945041036226201306511803963291610965520595093771558952000&10531801025252553016013278646442369888149133646495387760188037870704622801637392876962800000&3146706012238795427973303402033752877122263511053778975056451231393819657574298642872000000&235044309832747753792446979829777477365827565182434950799096426463863811536307859965000000&-4440688268007542274915272165073296358699518927682926250318126398080980000000&20974462546710273066928434544050339130507985738616528100000000}\right]\)
LLL化簡\(B=\left[ \matrix{
53771676921999198037128719975410481845009948321580737058118762&50209380384868519769271355772363021078882998018525986723096380&107113429339000465042631199484653568414097906566121374434204800&2566158289017059510580947933126354061025546078929008772549000&-39201258910319328503256252507864134476510009966583646884840000&-82244768124108488515911014612606850013994967332618611133000000&-103326720791445976823937028600478023227439055205294880233000000&37553747697339884108136344819118362708215810289041024760000000&-41948925093420546133856869088100678261015971477233056200000000\cr
145771311156080366680612542702670552709050420859148668552121201&-102701813735090026820390486307494510321459974199722868939788630&55690597658188982675500688460805070018767816245101070397610800&-3690675191418901829302352712732398605405813417421315444807000&-34161730786036250811133667107244245173497899683329768637600000&105158149470961723712865498187081390865505368625840232003900000&-83943991120073620894214705274131521444270306664078709465000000&-94290002110963796909267598874077903051034921264274818610000000&0\cr
22520257569452314079351935267514264370266330796992552972684997&-98310513164562058062910678303618723610419189844159039543246600&-59216755675973590492737933555662165421890387526607433485560200&210122354709341487106669358644005820317705567891681532969573000&-13547462576968605065539206672838828517502007656710102017580000&23570869821207231876579884845247791136173699754579501358900000&-40641684543556222622266012007342445503983888770262907798000000&-86958932882212997194203757223689795368058144049335172070000000&41948925093420546133856869088100678261015971477233056200000000\cr
169015127177354263666121860022442922657381338158956682760146316&-44086339219025359808922118654836582121338928607019431900103130&-55743427083965516899322695992901696889154913782390199199450100&-99213756448548832412671199081590293096668700399267187647555000&-13681783036472695133702522618982681148717527439219162384970000&-15336537742431604945023054843850719026627918786732999429600000&64672345006900325309865538762091565046333246270689577751000000&-71951332896677550420724086465591699219582263948746051800000000&62923387640130819200785303632151017391523957215849584300000000\cr
-111109391058117478677425543043666767886469428988351808979162264&68706199548070844584789292006960471026818898889658819004932390&114242801459017508543027293838247104016630443508968997031447000&-70229925147280191228538106815486527561582710206602914483698000&-108177296750967223863314840883237590333571940265343423758290000&21114534120011920453814163485385935919207972703328940545600000&-34780235497393011659779194620008032778904564753918395174000000&44536869417475438776116536835516252809621296087125152680000000&83897850186841092267713738176201356522031942954466112400000000\cr
32124330345979841767629832716536687416322338071176926036776624&27164161165425888332075134727974947827481095848187898522695730&-79639511287230298148663766719580830450559479484044659434682900&-51041393060884297450399678845972688262211525661235763838740000&-120857089745132822141399493042839109949450984516626943707450000&220466029767922832433728342036436413650585457627045150329700000&-42081776027182400361358030886271577560506458471894525675000000&58148929768074224345419762221788597120206147540057861770000000&-41948925093420546133856869088100678261015971477233056200000000\cr
-118279971490860306266688062364858934470851326591670377750842105&186394623214470748860705331927751369982342478110034345905919190&-5844542338433954468770696410970613047578620794759879329291700&-31690810413815853326709322936928777204830797244545090618294000&36631940618043663684819094023611438217838817287345595588310000&14670122074875238001436616319545787277339265229080644956400000&-87941416624880050595555558070529584290459598827529416836000000&-58985200396438287348022673963584538334771708074420956690000000&62923387640130819200785303632151017391523957215849584300000000\cr
-67402575181872320450341662740231249645051561595949203267092646&81687875727598274014317606405009186128237310267665643776123970&-60606071715445114152730683837370692931748434259046928181917500&118448345919188327186093480437680808892299725583302023014092000&5659950991122719764062671142382391292964286805841933824120000&61863373560034972019278274616457949997753618484681115789000000&87493980444210846078712251695585839215963143393159467086000000&-110345238655812995600366365368792036283900354142468092020000000&-125846775280261638401570607264302034783047914431699168600000000\cr
391536656683468813127560730295755766606487863741754115343991921&447549940911495565399271813369673072505177321547345359598698170&345431307115038022995995779076001023195500573892855741305309800&330776015310331719481270882134135987680304349298242517737362000&334129783160230133456909028931418304394164386380225530980110000&298169048606388347296126093056185837124427112397441890970200000&317606145581069503748397520803157118676806368270962392206000000&313838224166290677083070069124989059103490292778965585030000000&440463713480915734405497125425057121740667700510947090100000000}\right]\)
產生不需要同餘$N^2$的方程式
$r(x)=53771676921999198037128719975410481845009948321580737058118762 $
$\displaystyle +50209380384868519769271355772363021078882998018525986723096380 ( \frac{x}{46260610} ) $
$\displaystyle +107113429339000465042631199484653568414097906566121374434204800 ( \frac{x}{46260610} )^2 $
$\displaystyle +2566158289017059510580947933126354061025546078929008772549000 (\frac{x}{46260610})^3 $
$\displaystyle -39201258910319328503256252507864134476510009966583646884840000 (\frac{x}{46260610})^4 $
$\displaystyle -82244768124108488515911014612606850013994967332618611133000000 (\frac{x}{46260610})^5 $
$\displaystyle -103326720791445976823937028600478023227439055205294880233000000 (\frac{x}{46260610})^6 $
$\displaystyle +37553747697339884108136344819118362708215810289041024760000000 (\frac{x}{46260610})^7 $
$\displaystyle -41948925093420546133856869088100678261015971477233056200000000 (\frac{x}{46260610})^8 $

$r(x)= -2x^8+82827356x^7-10542521995935153x^6-388196401064276818832330x^5-8559622143684325599618510860324x^4$
$+25920858191087824461843813370140390129x^3+50051974379238314010577044980314319102425126688x^2+1085359237261863165428889843267588150672526756965072158x+53771676921999198037128719975410481845009948321580737058118762$
$ = -(x-45499293)(2x^7+8171230x^6+10914307183875543x^5+884789661515435025323429x^4+48816926196345927839271626696021x^3$
$+2195214770175831075654032836258741023024x^2+49828745646919485619110961668243162515263595344x+1181813460749801058164326201187576295856068539825019634) $
整數解為$[x=45499293]$
Evaluation took 43.1100 seconds (43.1220 elapsed) using 5541.766 MB.
[color=red](X)[/color]　$[x=45499293]$

[color=green]再解一次3次同餘方程式[/color]
[color=red](%i16)[/color]　[color=blue]fx:x^3-rhs(X[1]);[/color]
[color=red](fx)[/color]　$x^3-45499293$

[color=green]利用Coppersmith_Howgrave方法解3次同餘方程式，執行時間需0.328秒[/color]
[color=red](%i19)[/color]
[color=blue]showtime:true$
X:Coppersmith_Howgrave(fx,N,h);
showtime:false$[/color]
Evaluation took 0.0000 seconds (0.0000 elapsed) using 0 bytes.
參數$h=3$
p(x)最高次方$k=3$
$\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}}9^{-1/8}54957464841358314276864542898551^{1/4})=46260610$
$q_{uv}=N^{h-1-v} x^u p(x)^v =$
$[3020322941789135243826751301254310584993059920451586964677899601,$
$3020322941789135243826751301254310584993059920451586964677899601x,$
$3020322941789135243826751301254310584993059920451586964677899601x^2,$
$54957464841358314276864542898551(x^3-45499293),$
$54957464841358314276864542898551x(x^3-45499293),$
$54957464841358314276864542898551x^2(x^3-45499293),$
$(x^3-45499293)^2,$
$x(x^3-45499293)^2,$
$x^2(x^3-45499293)^2]$
用$46260610x$取代$x$,得到$q_uv=$
$[3020322941789135243826751301254310584993059920451586964677899601,$
$139721981684159887751924249514318172791235797686641888454048089061016610x,$
$6463624103118063744935544456324562407407970654820642611436221569296955598732100x^2,$
$54957464841358314276864542898551(98999742604948264981000x^3-45499293),$
$2542365847614788847019462641858137376110x(98999742604948264981000x^3-45499293),$
$117611394953827177084317023684568968482648027100x^2(98999742604948264981000x^3-45499293),$
$(98999742604948264981000x^3-45499293)^2,$
$46260610x(98999742604948264981000x^3-45499293)^2,$
$2140044037572100x^2(98999742604948264981000x^3-45499293)^2] $
產生矩陣\(M=\left[ \matrix{
3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0\cr
0&139721981684159887751924249514318172791235797686641888454048089061016610&0&0&0&0&0&0&0\cr
0&0&6463624103118063744935544456324562407407970654820642611436221569296955598732100&0&0&0&0&0&0\cr
-2500525795354160459269142958652241224443&0&0&5440774873514967046498526949032608069078072148942531000&0&0&0&0&0\cr
0&-115675848613818628883670707444457456909880090230&0&0&251693564521475219700920220763687359166473755234092339003910000&0&0&0&0\cr
0&0&-5351235319142904201522225965512143075699768000894840300&0&0&11643497827837801763248586973862843084330167466119804398647668985100000&0&0&0\cr
2070185663499849&0&0&-9008836591414248716424316866000&0&0&9800949035846008678895673107522190930361000000&0&0\cr
0&95768051606757749647890&0&0&-416754276109143908313505917054448260000&0&0&453397880977148227551007964314572140974967380210000000&0\cr
0&0&4430288485840093620938676612900&0&0&-19279307032917423776366854961548179721038600000&0&0&20974462546710273066928434544050339130507985738616528100000000}\right]\)
LLL化簡\(B=\left[ \matrix{
2070185663499849&0&0&-9008836591414248716424316866000&0&0&9800949035846008678895673107522190930361000000&0&0\cr
0&95768051606757749647890&0&0&-416754276109143908313505917054448260000&0&0&453397880977148227551007964314572140974967380210000000&0\cr
-2500525795354160459269142958652241224443&0&0&5440774873514967046498526949032608069078072148942531000&0&0&0&0&0\cr
0&0&4430288485840093620938676612900&0&0&-19279307032917423776366854961548179721038600000&0&0&20974462546710273066928434544050339130507985738616528100000000\cr
0&-115675848613818628883670707444457456909880090230&0&0&251693564521475219700920220763687359166473755234092339003910000&0&0&0&0\cr
3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0\cr
0&0&-5351235319142904201522225965512143075699768000894840300&0&0&11643497827837801763248586973862843084330167466119804398647668985100000&0&0&0\cr
0&139721981684159887751924249514318172791235797686641888454048089061016610&0&0&0&0&0&0&0\cr
0&0&6463624103118063744935544456324562407407970654820642611436221569296955598732100&0&0&0&0&0&0}\right]\)
產生不需要同餘$N^2$的方程式
$\displaystyle r(x)= 2070185663499849 + 0 ( \frac{x}{46260610} ) + 0 (\frac{x}{46260610})^2 $
$\displaystyle -9008836591414248716424316866000 (\frac{x}{46260610})^3 + 0 (\frac{x}{46260610})^4 + 0 (\frac{x}{46260610})^5$
$\displaystyle +9800949035846008678895673107522190930361000000 (\frac{x}{46260610})^6 + 0 (\frac{x}{46260610})^7 + 0 (\frac{x}{46260610})^8 $
$r(x)=x^6-90998586x^3+2070185663499849=(x-357)^2(x^2+357x+127449)^2 $
整數解為$ [x=357] $
Evaluation took 0.3280 seconds (0.3280 elapsed) using 88.429 MB.
[color=red](X)[/color]　$[x=357]$

[color=green]從密文$c_1,c_2$，兩個補綴值的差$t=T_2-T_1$求得加上補綴值得明文$m_1$[/color]
[color=red](%i20)[/color]　[color=blue]m1:t*(c2+2*c1-t^3)/(c2-c1+2*t^3);[/color]
[color=red](m1)[/color]　$\displaystyle \frac{t(5645030747741020761470543223-t^3)}{2t^3+1632373556178779336223}$

[color=green]將$t$值帶入$m_1$公式[/color]
[color=red](%i21)[/color]　[color=blue]ev(m1,t=rhs(X[1]));[/color]
[color=red](%o21)[/color]　$1234567890$

[color=green]將後5位補綴值刪除，得到明文M[/color]
[color=red](%i22)[/color]　[color=blue]M:floor(%/10^5);[/color]
[color=red](M)[/color]　$12345$

bugmens 發表於 2023-2-15 14:58

[table][tr][td][align=center]方法[/align][/td][td][align=center]範例[/align][/td][/tr]
[tr][td=2,1][b][align=center]問題敘述[/align][/b][/td][/tr]
[tr][td]相同的明文$m$，為明文加上隨機補綴值後加密成$k$個密文$c_i$。
其中$\displaystyle \alpha<\frac{k-2}{6k-3}<\frac{1}{6}$，$\displaystyle |\; t_i|\;\le \frac{1}{2}N^{\alpha}$
$A_0\equiv m^3\pmod N$，第0個直接三次方不加補綴
$A_i\equiv (m+t_i)^3 \pmod N$，第$i$個加上補綴後三次方
$c_i\equiv A_i-A_0\equiv 3m^2t_i+3mt_i^2+t_i^3 \pmod N$，第$i$個減第0個得到密文$c_i$

已知$c_i,N$，則透過Coppersmith方法可以回復補綴值$t_i$和明文$m$。[/td][td]明文$m=25152118001609140014150009191379$
公鑰$N=54957464841358314276864542898551$
出自[url=https://books.google.com.tw/books?id=KN2jkDfd4Z4C&pg=PA185&lpg=PA185&dq=54957464841358314276864542898551&source=bl&ots=D-eF01Mk7k&sig=ACfU3U3e1s5rzEs5Srl6H5GH6TBUqJevGA&hl=zh-TW&sa=X&ved=2ahUKEwi_-96n7Zb9AhXCO3AKHeXECB4Q6AF6BAgIEAM#v=onepage&q&f=false]Cryptanalytic Attacks on RSA[/url]
$k=4$，$\displaystyle \alpha=\frac{1}{11}$，$\displaystyle \alpha<\frac{4-2}{6\cdot 4-3}<\frac{1}{6}$
$t_1=761,t_2=683,t_3=714,t_4=756$
其中$t_1,t_2$為質數，可以解出明文$m$
但$t_3=2\cdot 3 \cdot 7\cdot 17,t_4=2^2\cdot 3^3 \cdot 7$可以分解成小質數乘積，反而無法解出明文$m$
$A_0\equiv m^3 \equiv 37393323096087665763922106857101\pmod{N}$
$A_1\equiv (m+761)^3\equiv  21904263018805857488488858542023\pmod{N}$
$A_2\equiv (m+683)^3\equiv  37153632560891277497054197384710\pmod{N}$
$A_3\equiv (m+714)^3\equiv  18092792378564256587234068711460\pmod{N}$
$A_4\equiv (m+756)^3\equiv  39662861356261303674301781451309\pmod{N}$
密文
$c_1\equiv A_1-A_0\equiv 39468404764076506001431294583473\pmod{N}$
$c_2\equiv A_2-A_0\equiv 54717774306161926009996633426160\pmod{N}$
$c_3\equiv A_3-A_0\equiv 35656934123834905100176504752910\pmod{N}$
$c_4\equiv A_4-A_0\equiv 2269538260173637910379674594208\pmod{N}$[/td][/tr]
[tr][td=2,1][b][align=center]步驟1：利用恆等式建立矩陣$M$的右上角區塊[/align][/b][/td][/tr]
[tr][td]設下標$i<j<l$，定義$d_{ij}=t_i t_j(t_i-t_j)$，$e_{ijl}=-t_it_jt_l(t_i-t_j)(t_j-t_l)(t_l-t_i)$
$\displaystyle C_2^k$個線性獨立數量$d_{ij}$滿足$|\;d_{ij}|\;<N^{3\alpha}$
$\displaystyle C_3^k$個線性獨立數量$e_{ijl}$滿足$|\;e_{ijl}|\;<N^{6\alpha}$
滿足恆等式$d_{ij}c_l+d_{jl}c_i-d_{il}c_j\equiv e_{ijl}\pmod{N}$
右上角$C_2^k\times C_3^k$區塊為
以數對$(i,j),i<j$決定哪一列，以數對$(i,j,l),i<j<l$決定哪一行
第$(i,j,l)$行，第$\displaystyle(i,j)=\frac{1}{2}(2k-i)(i-1)+j-i$列放$c_l$
第$(i,j,l)$行，第$\displaystyle(j,l)=\frac{1}{2}(2k-j)(j-1)+l-j$列放$c_i$
第$(i,j,l)$行，第$\displaystyle(i,l)=\frac{1}{2}(2k-i)(i-1)+l-i$列放$-c_j$
－－－－－－－－－－－－－－－－－－－－－－
數對$(i,j)$在第$\displaystyle \frac{1}{2}(2k-i)(i-1)+j-i$列
[證明]
$\matrix{d_{12}&d_{13}&d_{14}&&\ldots&&d_{1k}&k-1個\cr
&d_{23}&d_{24}&&&&d_{2k}&k-2個\cr
&&&\ldots&&&&\cr
&&&d_{i-1,i}&\ldots&&d_{i-1,k}&k-i+1個\cr
&&&&d_{i,i+1}&\ldots&d_{i,j}&j-i個}$
$(i,j)=(k-1)+(k-2)+\ldots+(k-i+1)+(j-1)$
$\displaystyle =\frac{1}{2}(k-1+k-i+1)(i-1)+(j-i)$
$\displaystyle =\frac{1}{2}(2k-i)(i-1)+j-i$[/td][td]$(1,2,3)$，$d_{12}c_3+d_{23}c_1-d_{13}c_2\equiv e_{123}\pmod{N}$
$(1,2,4)$，$d_{12}c_4+d_{24}c_1-d_{14}c_2\equiv e_{124}\pmod{N}$
$(1,3,4)$，$d_{13}c_4+d_{34}c_1-d_{14}c_3\equiv e_{134}\pmod{N}$
$(2,3,4)$，$d_{23}c_4+d_{34}c_2-d_{24}c_3\equiv e_{234}\pmod{N}$
寫成矩陣形式
$\left[\matrix{d_{12}& d_{13}& d_{14}& d_{23}& d_{24}& d_{34}}\right]
\left[\matrix{c_3&c_4&&\cr
-c_2&&c_4&\cr
&-c_2&-c_3&\cr
c_1&&&c_4\cr
&c_1&&-c_3\cr
&&c_1&c_2}\right]\equiv
\left[\matrix{e_{123}\cr e_{124}\cr e_{134}\cr e_{234}}\right]\pmod{N}$
第1行
第$\displaystyle(1,2)=\frac{1}{2}(2\times4-1)(1-1)+2-1=1$列放$c_3$
第$\displaystyle(2,3)=\frac{1}{2}(2\times4-2)(2-1)+3-2=4$列放$c_1$
第$\displaystyle(1,3)=\frac{1}{2}(2\times4-1)(1-1)+3-1=2$列放$-c_2$
第2行
第$\displaystyle(1,2)=\frac{1}{2}(2\times4-1)(1-1)+2-1=1$列放$c_4$
第$\displaystyle(2,4)=\frac{1}{2}(2\times4-2)(2-1)+4-2=5$列放$c_1$
第$\displaystyle(1,4)=\frac{1}{2}(2\times4-1)(1-1)+4-1=3$列放$-c_2$
第3行
第$\displaystyle(1,3)=\frac{1}{2}(2\times4-1)(1-1)+3-1=2$列放$c_4$
第$\displaystyle(3,4)=\frac{1}{2}(2\times4-3)(3-1)+4-3=6$列放$c_1$
第$\displaystyle(1,4)=\frac{1}{2}(2\times4-1)(1-1)+4-1=3$列放$-c_3$
第4行
第$\displaystyle(2,3)=\frac{1}{2}(2\times4-2)(2-1)+3-2=4$列放$c_4$
第$\displaystyle(3,4)=\frac{1}{2}(2\times4-3)(3-1)+4-3=6$列放$c_2$
第$\displaystyle(2,4)=\frac{1}{2}(2\times4-2)(2-1)+4-2=5$列放$-c_3$[/td][/tr]
[tr][td=2,1][b][align=center]步驟2：建立矩陣$M$，利用LLL找到較短的$s$向量[/align][/b][/td][/tr]
[tr][td]矩陣$M$為$C_2^k+C_2^k$大小的方陣，
左上角$C_2^k\times C_2^k$區塊為單位矩陣乘上近似$N^{3\alpha}$的整數值。
左下角$C_3^k\times C_2^k$區塊為$0$矩陣。
右下角$C_3^k\times C_3^k$區塊為單位矩陣乘上$N$。
右上角$C_2^k\times C_3^k$區塊為步驟1的係數矩陣
－－－－－－－－－－－－－－－－－－－－－－
設列向量$r$前$C_2^k$個元是$d_{ij}$，後$C_3^k$個元是$\displaystyle \frac{e_{ijl}-(d_{ij}c_l+d_{jl}c_i-d_{il}c_j)}{N}$
計算$rM=s$
列向量$s$前$C_2^k$個元是$d_{ij}N^{3\alpha}$，後$C_3^k$個元是$e_{ijl}$，每個元都小於$N^{6\alpha}$
希望透過lattice化簡演算法找到這一列向量。
因為矩陣$M$為上三角矩陣，行列式值為對角線$C_2^k$個$N^{3\alpha}$和$C_3^k$個$N$相乘
$\displaystyle det(M)=N^{3\alpha C_2^k+C_3^k}$，因為$\displaystyle \alpha<\frac{k-2}{6k-2}$，所以還會大於$\displaystyle  (N^{6\alpha})^{C_2^k+C_3^k}$
所以$s$是由矩陣$M$個列向量所產生的較短向量，找到$s$的難度取決於它在短元素中的rank，若$|\;t_i|\;$足夠小於$N^{\alpha}$，然後我們希望$s$是整個lattice中最短元素，透過lattice化簡演算法能有效地回復$s$。我們在這裡不提供效率估計或成功機率，將這個方法視為啟發式攻擊(不一定100%成功)。
－－－－－－－－－－－－－－－－－－－－－－
當$\displaystyle \alpha<\frac{k-2}{6k-2}$時，$3\alpha C_2^k+C_3^k>6\alpha(C_2^k+C_3^k)$
[證明]
$(3\alpha C_2^k+C_3^k)-6\alpha(C_2^k+C_3^k)$
$=(1-6\alpha)C_3^k-3\alpha C_2^k$
$\displaystyle =(1-6\alpha)\left[\frac{k(k-1)(k-2)}{6}-\frac{k(k-1)}{2}\right]$
$\displaystyle =\frac{k(k-1)}{2}\left[(1-6\alpha)\frac{k-2}{3}-3\alpha \right]$
$\displaystyle \frac{k(k-1)}{2}>0$為正，還需要$\displaystyle (1-6\alpha)\frac{k-2}{3}-3\alpha>0$亦為正
$\displaystyle \frac{1-6\alpha}{\alpha}>\frac{9}{k-2}$
$\displaystyle \frac{1}{\alpha}-6>\frac{9}{k-2}$
$\displaystyle \frac{1}{\alpha}>\frac{9}{k-2}+\frac{6k-12}{k-2}=\frac{6k-3}{k-2}$
$\displaystyle \alpha<\frac{k-2}{6k-3}$就是當初的條件
步驟可以逆推回去
[/td][td]$M=\left[\matrix{N^{3\alpha}&&&&&&c_3&c_4&&\cr
&N^{3\alpha}&&&&&-c_2&&c_4&\cr
&&N^{3\alpha}&&&&&-c_2&-c_3&\cr
&&&N^{3\alpha}&&&c_1&&&c_4\cr
&&&&N^{3\alpha}&&&c_1&&-c_3\cr
&&&&&N^{3\alpha}&&&c_1&c_2\cr
&&&&&&N&&&\cr
&&0&&&&&N&&\cr
&&&&&&&&N&\cr
&&&&&&&&&N}\right]$
$r=[\displaystyle d_{12},d_{13},d_{14},d_{23},d_{24},d_{34},$
　　$\displaystyle \frac{e_{123}-(d_{12}c_3+d_{23}c_1-d_{13}c_2)}{N},$
　　$\displaystyle \frac{e_{124}-(d_{12}c_4+d_{24}c_1-d_{14}c_2)}{N},$
　　$\displaystyle \frac{e_{134}-(d_{13}c_4+d_{34}c_1-d_{14}c_3)}{N},$
　　$\displaystyle \frac{e_{234}-(d_{23}c_4+d_{34}c_2-d_{24}c_3)}{N}]$
計算$rM=s$
$s=[d_{12}N^{3\alpha},d_{13}N^{3\alpha},d_{14}N^{3\alpha},d_{23}N^{3\alpha},d_{24}N^{3\alpha},d_{34}N^{3\alpha},$
　　$e_{123},e_{124},e_{134},e_{234}]$
利用lattice化簡演算法找到短向量$s$，若真的找到$s$，從$r=sM^{-1}$得到$r$向量。[/td][/tr]
[tr][td=2,1][b][align=center]步驟3：再用Franklin和Reiter的技巧回復明文$m$[/align][/b][/td][/tr]
[tr][td]利用$r$向量計算最大公因數來回復$t_i$
$gcd(d_{1,2},d_{1,3},\ldots,d_{1,k})=gcd\{\;t_1t_2(t_1-t_2),t_1t_3(t_1-t_3),\ldots,t_1t_k(t_1-t_k) \}\;$
$=t_1\times gcd\{\; t_2(t_1-t_2),t_3(t_1-t_3),\ldots,t_k(t_1-t_k) \}\;$
希望後面的gcd足夠小而可以暴力搜尋找到$t_i$，再用Franklin和Reiter的技巧回復明文$m$。
$c_1\equiv 3m^2t_1+3mt_1^2+t_1^3\pmod{N}$
$c_2\equiv 3m^2t_2+3mt_2^2+t_2^3\pmod{N}$
$\displaystyle m \equiv -\frac{t_1t_2^3+(c_1-t_1^3)t_2-c_2t_1}{3t_1t_2^2-3t_1^2t_2}\pmod{N}$[/td][td]計算$gcd(r_1,r_2,r_3)$得到$t_1$
計算$gcd(r_1,r_4,r_5)$得到$t_2$
計算$gcd(r_2,r_4,r_6)$得到$t_3$
計算$gcd(r_3,r_5,r_6)$得到$t_4$
再用Franklin和Reiter的技巧回復明文$m$[/td][/tr][/table]

參考資料：
D. Coppersmith. Finding a small root of a univariate modular equation. In Proceedings of Eurocrypt 1996, volume 1070 of Lecture Notes in Computer Science, pages 155–165. Springer, 1996.
[url]https://link.springer.com/chapter/10.1007/3-540-68339-9_14[/url]

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.46.0\share\maxima\5.46.0\share目錄下
要先載入LLL.mac才能使用LLL指令[/color]
[color=red](%i1)[/color]　[color=blue]load("LLL.mac");[/color]
[color=red](%o1)[/color]　C:/maxima-5.46.0/share/maxima/5.46.0/LLL.mac

[color=green]公鑰N[/color]
[color=red](%i2)[/color]　[color=blue]N:54957464841358314276864542898551;[/color]
[color=red](N)[/color]　54957464841358314276864542898551

[color=green]密文$c_1,c_2,c_3,c_4$[/color]
[color=red](%i3)[/color]
[color=blue]c:[39468404764076506001431294583473,
54717774306161926009996633426160,
35656934123834905100176504752910,
2269538260173637910379674594208];[/color]
[color=red](c)[/color]　$[39468404764076506001431294583473,$
$54717774306161926009996633426160,$
$35656934123834905100176504752910,$
$2269538260173637910379674594208]$

[color=green]有$k=4$個密文[/color]
[color=red](%i4)[/color]　[color=blue]k:length(c);[/color]
[color=red](k)[/color]　4

[color=green]取$\displaystyle \alpha=\frac{1}{11}$[/color]
[color=red](%i5)[/color]　[color=blue]alpha:1/ceiling((6*k-3)/(k-2));[/color]
[color=red](alpha)[/color]　$\displaystyle \frac{1}{11}$

[color=green]檢查是否符合$\displaystyle \alpha<\frac{k-2}{6k-3}$[/color]
[color=red](%i6)[/color]　[color=blue]is(alpha<(k-2)/(6*k-3));[/color]
[color=red](%o6)[/color]　$true$

[color=green]從集合$S$中任選$n$個的組合[/color]
[color=red](%i7)[/color]
[color=blue]Combination(L,n):=block
([c:[],s],
if length(L)>n then
  (for r in L do
   (s:delete(r,L),
   c:unique(append(c,Combination(s,n)))
   )
  )
else
  (c:[L]),
return(c)
)$[/color]

[color=green]從$1\sim k$中任選3個的組合[/color]
[color=red](%i8)[/color]　[color=blue]S:Combination(create_list(i,i,1,k),3);[/color]
[color=red](S)[/color]　$[[1,2,3],[1,2,4],[1,3,4],[2,3,4]]$

[color=green]恆等式的係數矩陣(初始值設為0)[/color]
[color=red](%i9)[/color]　[color=blue]CoefficientMatrix:zeromatrix(k*(k-1)/2,k*(k-1)*(k-2)/6);[/color]
[color=red](CoefficientMatrix)[/color]　$\left[\matrix{0&0&0&0\cr 0&0&0&0\cr 0&0&0&0\cr 0&0&0&0\cr 0&0&0&0\cr 0&0&0&0}\right]$

[color=green]恆等式的係數填入矩陣[/color]
[color=red](%i10)[/color]
[color=blue]for column:1 thru length(S) do
  ([i,j,l]:S[column],
print("d",i,j,"c",l,"+d",j,l,"c",i,"-d",i,l,"c",j,"=e",i,j,l,"mod(N)"),
dij_position: (2*k-i)*(i-1)/2+j-i,
CoefficientMatrix[dij_position][column]:'c[l],
djl_position: (2*k-j)*(j-1)/2+l-j,
CoefficientMatrix[djl_position][column]:'c[ i ],
dil_position: (2*k-i)*(i-1)/2+l-i,
CoefficientMatrix[dil_position][column]:-'c[j]
  );[/color]
$d12c3+d23c1-d13c2=e123\pmod{N}$
$d12c4+d24c1-d14c2=e124\pmod{N}$
$d13c4+d34c1-d14c3=e134\pmod{N}$
$d23c4+d34c2-d24c3=e234\pmod{N}$
[color=red](%o10)[/color]　$done$

[color=green]得到恆等式的係數矩陣[/color]
[color=red](%i11)[/color]　[color=blue]CoefficientMatrix;[/color]
[color=red](%o11)[/color]　$\left[\matrix{c_3&c_4&0&0\cr -c_2&0&c_4&0\cr 0&-c_2&-c_3&0\cr c_1&0&0&c_4\cr 0&c_1&0&-c_3 \cr 0&0&c_1&c_2}\right]$

[color=green]單位矩陣乘上$N^{3\alpha}$[/color]
[color=red](%i12)[/color]　[color=blue]NalphaMatrix:round('N^(3*'alpha))*ident(k*(k-1)/2);[/color]
[color=red](NalphaMatrix)[/color]　$\left[\matrix{
round(N^{3\alpha})&0&0&0&0&0\cr
0&round(N^{3\alpha})&0&0&0&0\cr
0&0&round(N^{3\alpha})&0&0&0\cr
0&0&0&round(N^{3\alpha})&0&0\cr
0&0&0&0&round(N^{3\alpha})&0\cr
0&0&0&0&0&round(N^{3\alpha})}\right]$

[color=green]單位矩陣乘上$N$[/color]
[color=red](%i13)[/color]　[color=blue]NMatrix:'N*ident(k*(k-1)*(k-2)/6);[/color]
[color=red](NMatrix)[/color]　$\left[\matrix{
N&0&0&0\cr
0&N&0&0\cr
0&0&N&0\cr
0&0&0&N}\right]$

[color=green]零矩陣[/color]
[color=red](%i14)[/color]　[color=blue]ZeroMatrix:zeromatrix(k*(k-1)*(k-2)/6,k*(k-1)/2);[/color]
[color=red](ZeroMatrix)[/color]　$\left[\matrix{
0&0&0&0&0&0\cr
0&0&0&0&0&0\cr
0&0&0&0&0&0\cr
0&0&0&0&0&0}\right]$

[color=green]將4個子矩陣合併為矩陣$M$[/color]
[color=red](%i15)[/color]　[color=blue]M:addrow(addcol(NalphaMatrix,CoefficientMatrix),
               addcol(ZeroMatrix,NMatrix));[/color]
[color=red](M)[/color]　$\left[\matrix{
round(N^{3\alpha})&0&0&0&0&0&c_3&c_4&0&0\cr
0&round(N^{3\alpha})&0&0&0&0&-c_2&0&c_4&0\cr
0&0&round(N^{3\alpha})&0&0&0&0&-c_2&-c_3&0\cr
0&0&0&round(N^{3\alpha})&0&0&c_1&0&0&c_4\cr
0&0&0&0&round(N^{3\alpha})&0&0&c_1&0&-c_3\cr
0&0&0&0&0&round(N^{3\alpha})&0&0&c_1&c_2\cr
0&0&0&0&0&0&N&0&0&0\cr
0&0&0&0&0&0&0&N&0&0\cr
0&0&0&0&0&0&0&0&N&0\cr
0&0&0&0&0&0&0&0&0&N}\right]$

[color=green]將秘文$c_i$、公鑰$N$和$\alpha$代入矩陣$M$[/color]
[color=red](%i16)[/color]　[color=blue]M:ev(M,append(create_list('c[i ]=c[ i ],i,1,k),['N=N,'alpha=alpha]));[/color]
[color=red](M)[/color]　$\left[\matrix{
453284549&0&0&0&0&0&35656934123834905100176504752910&2269538260173637910379674594208&0&0\cr
0&453284549&0&0&0&0&-54717774306161926009996633426160&0&2269538260173637910379674594208&0\cr
0&0&453284549&0&0&0&0&-54717774306161926009996633426160&-35656934123834905100176504752910&0\cr
0&0&0&453284549&0&0&39468404764076506001431294583473&0&0&2269538260173637910379674594208\cr
0&0&0&0&453284549&0&0&39468404764076506001431294583473&0&-35656934123834905100176504752910\cr
0&0&0&0&0&453284549&0&0&39468404764076506001431294583473&54717774306161926009996633426160\cr
0&0&0&0&0&0&54957464841358314276864542898551&0&0&0\cr
0&0&0&0&0&0&0&54957464841358314276864542898551&0&0\cr
0&0&0&0&0&0&0&0&54957464841358314276864542898551&0\cr
0&0&0&0&0&0&0&0&0&54957464841358314276864542898551}\right]$

[color=green]用LLL進行化簡[/color]
[color=red](%i17)[/color]　[color=blue]B: LLL(M);[/color]
[color=red](B)[/color]　\(\left[\matrix{
3062806981544531&1929302787225877&217318211327070&-1142089856961263&-2847639605402466&-1712730228981912&-7029209321862&-1864504228860&-675725901480&-5840140628952\cr
30350192335087291&-33755294424101878&-35992078252296415&10262189034662282&-12649485090783171&26238535675026248&45236596803297303&32667816209644487&17312818708413949&29899743372135217\cr
-105442779364366051&-35112147780672047&15105397548793484&-162848150710657127&-47818354180209784&-39252485567286516&93004125926333727&66987628433829075&35630166688401243&61279750174710207\cr
1463179406660001&-38794361299156843&127104398505831225&15663924344526657&-53193847940963451&49664226773200368&34028664295792700&-108825608856904341&-70649517214082037&72089239243509663\cr
3555015074767161&-238087723867355568&-173132241548157991&-194306209012687083&-142531522469114792&82794656207822923&-190601615804163537&-137506222531495333&-73344681040746143&-126138894058078265\cr
-195888746853505215&-146909831017677869&61301299463938392&224903490834995215&-303473180577620820&-157213305662347620&-69229181322847560&222932053809272745&145526846414244939&-148701738837887865\cr
307004212366900391&12863118098726871&599044032676087473&-259437126504168679&178098884431111932&513690572043907629&-143869831596583000&457614818638557519&299900502491764839&-303250617849528111\cr
1991487835630480536&-3276384603102473239&1317877116205579554&-212626855403276543&2241302488597860594&-3546671373603670004&4710859391231467810&-3897062285598526116&3293990032544411069&-4885714390931151907\cr
3040490414277923020&-5012515185936123906&2047825263139913024&-333778398019756331&3453617971057334454&-5468786420936785769&3167236119733748050&8002984534870019480&-15326812883649580004&-4476135453415756279\cr
-10796555276199580276&17895467629929799515&-7198812808408856722&1270730505249622124&-12198909881552966272&19372609181153480002&26360591268575871440&7060175662321356&-17588138285651759645&-29785375118608432724}\right]\)

[color=green]取第一列較短的向量$s$[/color]
[color=red](%i18)[/color]　[color=blue]s:B[1];[/color]
[color=red](s)[/color]　$\left[\matrix{3062806981544531&1929302787225877&217318211327070&-1142089856961263&-2847639605402466&-1712730228981912&-7029209321862&-1864504228860&-675725901480&-5840140628952}\right]$

[color=green]計算$r=sM^{-1}$得到向量$r$[/color]
[color=red](%i19)[/color]　[color=blue]r:s.invert(M);[/color]
[color=red](r)[/color]　$\left[\matrix{6756919&4256273&479430&-2519587&-6282234&-3778488&1663229&4709970&2848860&-209916}\right]$

[color=green]從向量$r$計算最大公因數得到補綴值$t_i$
其中$t_1=761,t_2=683$為質數，可以解出明文$m$
但$t_3=714=2\cdot 3 \cdot 7\cdot 17,t_4=756=2^2\cdot 3^3 \cdot 7$可以分解成小質數乘積，反而無法解出明文$m$
其中119僅是714的因數，126僅是756的因數[/color]
[color=red](%i21)[/color]
[color=blue]t:create_list(0,i,1,k)$
for i:1 thru k do
  (dij:[],
for j:1 thru k do
   (if i<j then
      (print("取d",i,j,"=r[",index: (2*k-i-2)*(i-1)/2+j-1,"]=",r[1,index]),
      dij:append(dij,[r[1,index]])
      ),
   if i>j then
      (print("取d",j,i,"=r[",index: (2*k-j-2)*(j-1)/2+i-1,"]=",r[1,index]),
      dij:append(dij,[r[1,index]])
      )
   ),
print("t",i,"=gcd(",dij,")=",t[ i ]:lreduce('gcd,dij))
  );[/color]
取$d_{12}=r[1]=6756919$
取$d_{13}=r[2]=4256273$
取$d_{14}=r[3]=479430$
$t_1=gcd([6756919,4256273,479430])=761$
取$d_{12}=r[1]=6756919$
取$d_{23}=r[4]=-2519587$
取$d_{24}=r[5]=-6282234$
$t_2=gcd([6756919,-2519587,-6282234])=683$
取$d_{13}=r[2]=4256273$
取$d_{23}=r[4]=-2519587$
取$d_{34}=r[6]=-3778488$
$t_3=gcd([4256273,-2519587,-3778488])=119$
取$d_{14}=r[3]=479430$
取$d_{24}=r[5]=-6282234$
取$d_{34}=r[6]=-3778488$
$t_4=gcd([479430,-6282234,-3778488])=126$
[color=red](%o21)[/color]　$done$　

[color=green]使用Franklin和Reiter的兩個訊息有仿射關係，利用輾轉相除法找出關係式
[url]https://math.pro/db/viewthread.php?tid=3498&page=2#pid23631[/url][/color]
[color=red](%i22)[/color]
[color=blue]GCD(fx1,fx2,var):=block([temp],
fx1:expand(fx1),
fx2:expand(fx2),
while hipow(fx2,var)#1 do
  (temp:fx2,
print(fx1,"除以",fx2,"餘式",fx2:remainder(fx1,fx2,var)),
fx1:temp
  ),
fx2
)$[/color]

[color=green]兩個多項式有相同的$m$[/color]
[color=red](%i24)[/color]
[color=blue]fx1: (m+t1)^3-m^3-c1;
fx2: (m+t2)^3-m^3-c2;[/color]
[color=red](fx1)[/color]　$(t1+m)^3-m^3-c1$
[color=red](fx2)[/color]　$(t2+m)^3-m^3-c2$

[color=green]使用Franklin和Reiter輾轉相除法得到因式[/color]
[color=red](%i25)[/color]　[color=blue]GCD:GCD(fx1,fx2,m);[/color]
$t1^3+3mt1^2+3m^2t1-c1$除以$t2^3+3mt2^2+3m^2t2-c2$餘式$\displaystyle -\frac{t1t2^3+m(3t1t2^2-3t1^2t2)+(c1-t1^3)t2-c2t1}{t2}$
[color=red](GCD)[/color]　$\displaystyle -\frac{t1t2^3+m(3t1t2^2-3t1^2t2)+(c1-t1^3)t2-c2t1}{t2}$

[color=green]得到明文$m$和祕文$c_1,c_2$和補綴值$t_1,t_2$的關係式[/color]
[color=red](%i26)[/color]　[color=blue]m:solve(GCD,m)[1];[/color]
[color=red](m)[/color]　$\displaystyle m=-\frac{t1t2^3+(c1-t1^3)t2-c2t1}{3t1t2^2-3t1^2t2}$

[color=green]將祕文$c_1,c_2$和補綴值$t_1,t_2$的值代入關係式[/color]
[color=red](%i27)[/color]　[color=blue]m:ev(m,['t1=t[1],'t2=t[2],'c1=c[1],'c2=c[2]]);[/color]
[color=red](m)[/color]　$\displaystyle m=-\frac{t1t2^3+(c1-t1^3)t2-c2t1}{3t1t2^2-3t1^2t2}=-\frac{14683305793124972094629922378741917}{121624542}$

[color=green]同餘$N$後得到明文$m$[/color]
[color=red](%i28)[/color]　[color=blue]m:ratsimp(rhs(m)),modulus:N;[/color]
[color=red]warning: assigning 54957464841358314276864542898551, a non-prime, to 'modulus'[/color]
[color=red](m)[/color]　$25152118001609140014150009191379$

[color=green]最後4位數為密碼[/color]
[color=red](%i29)[/color]　[color=blue]PinNumber:mod(m,10000);[/color]
[color=red](PinNumber)[/color]　$1379$

[color=green]剩下的位數為訊息[/color]
[color=red](%i30)[/color]　[color=blue]m:floor(m/10000);[/color]
[color=red](m)[/color]　$2515211800160914001415000919$

[color=green]以每兩位數字轉換成對應的英文字母
空白$=00,A=01,B=02,\ldots,Z=26$[/color]
[color=red](%i33)[/color]
[color=blue]Message: PinNumber$
while m#0 do
  (char:ascii(mod(m,100)+cint("A")-1),
Message:concat(char,Message),
m:floor(m/100)
  )$
Message;[/color]
[color=red](%o33)[/color]　$YOUR@PIN@NO@IS1379$

[color=green]將@取代為空白[/color]
[color=red](%i34)[/color]　[color=blue]Message:ssubst(" ","@",Message);[/color]
[color=red](Message)[/color]　$YOUR$ $PIN$ $NO$ $IS1379$

bugmens 發表於 2023-7-12 06:50

3-1.針對大的$r$，分解RSA公鑰$n=p^rq$
在RSA加密演算法中，為了加快解密速度，採用Quisquater-Couvreur方法，先各別計算$m_p\equiv c^{d_p}\pmod{p}$和$m_q\equiv c^{d_q}\pmod{q}$，再利用中國餘數定理將$m_p$和$m_q$組合出明文$m$，範例請見[url]https://math.pro/db/viewthread.php?tid=1500&page=1#pid7268[/url]。
若公鑰$e$取較小的數，但仍要考慮到低次方攻擊，加密過程可以減少計算而且快速，另一方面，解密的私鑰$d$的位元數必須要比公鑰$n$位元數的$\displaystyle \frac{1}{4}$還大以避免Wiener攻擊，所以解密過程變成是整個RSA中計算量最大的。
所以Takagi提出另一種RSA類型的加密演算法，將公鑰$n$從原本的$pq$改為$p^rq$，以減少解密過程時的計算量，以下是原本的RSA加密演算法和Takagi所提出的RSA方案的比較表。[table][tr][td][align=center]RSA　$n=pq$[/align][/td][td][align=center]RSA　$n=p^rq$[/align][/td][/tr]
[tr][td=2,1][b][align=center]產生公鑰和私鑰[/align][/b][/td][/tr]
[tr][td]產生兩個隨機質數$p,q$，$n=pq$
計算$\phi(n)=(p-1)(q-1)$
找$e,d$符合$ed\equiv 1 \pmod{\phi(n)}$和$GCD(e,p)=1$
$e,n$是公鑰，$d,p,q$是私鑰[/td][td]產生兩個隨機質數$p,q$，$n=p^r q$
計算$L=LCM(p-1.q-1)$
找$e,d$符合$ed \equiv 1\pmod{L}$和$GCD(e,p)=1$
$e,n$是公鑰，$d,p,q$是私鑰[/td][/tr]
[tr][td=2,1][b][align=center]加密[/align][/b][/td][/tr]
[tr][td]$c\equiv m^e \pmod{n}$
$m$為明文，$c$為密文[/td][td]相同[/td][/tr]
[tr][td=2,1][b][align=center]解密[/align][/b][/td][/tr]
[tr][td]$m\equiv c^d \pmod{n}$[/td][td]無法使用$m\equiv c^d \pmod{n}$來回復明文[/td][/tr]
[tr][td=2,1][b][align=center]利用中國餘數定理快速解密[/align][/b][/td][/tr]
[tr][td]$m\equiv c^d \pmod{pq}$
分解成$m_p\equiv c^d \pmod{p}$，$m_q\equiv c^d\pmod{q}$
設$d_p\equiv d\pmod{p-1}$，$m_p\equiv c^{d_p}\pmod{p}$
設$d_q\equiv d\pmod{q-1}$，$m_q\equiv c^{d_q}\pmod{q}$
利用中國餘數定理
$m\equiv \left(m_p\cdot q(q^{-1}\pmod{p})+m_q\cdot p(p^{-1}\pmod{q})\right)\pmod{n}$[/td]
[td]$m_q\equiv c^d\pmod{q}$
設$d_q\equiv d\pmod{q-1}$，$m_q\equiv c^{d_q}\pmod{q}$
利用中國餘數定理
$m\equiv (m_p\cdot q(q^{-1}\pmod{p^r})+m_q\cdot p^r(p^{-r}\pmod{q}))\pmod{n}$
$m_p\equiv m\pmod{p^r}$的$m_p$無法用$m_p\equiv c^d\pmod{p^r}$直接計算，改用以下的方法計算$m_p$[/td][/tr][/table]
假設密文$c$經$p^r$同餘後為$c_p$，明文$m$經$p^r$同餘後為$m_p$，密文$c_p$和明文$m_p$的關係為$c_p\equiv m_p^e \pmod{p^r}$。
設明文$m_p$以$p$進位表示成
$m_p\equiv K_0+pK_1+p^2K_2+\ldots+p^{r-1}K_{r-1}\pmod{p^r}$。
代入$c_p\equiv m_p^e\pmod{p^r}$
得到$c_p\equiv (K_0+pK_1+p^2K_2+\ldots+p^{r-1}K_{r-1})^e\pmod{p^r}$
設關係式
$c_p\equiv (\bbox[border:1px solid black]{K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1}}+\bbox[border:1px solid black]{p^iK_i})^e\pmod{p^{i+1}}$，$i=1,2,\ldots,r-1$
利用二項式定理展開
$c_p\equiv C_0^e(K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^e(p^iK_i)^0$
　　$+C_1^e(K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^{e-1}(p^iK_i)^1$
　　$+C_2^e(K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^{e-2}(p^iK_i)^2$　超過$p^{i+1}$
　　　　　...
　　$+C_e^e(K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^{0}(p^iK_i)^e$超過$p^{i+1}$$\pmod{p^{i+1}}$
化簡後
$c_p\equiv (K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^e+e(K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^{e-1}p^iK_i\pmod{p^{i+1}}$
定義$A_i=K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1}$，
　　$F_i=(A_i)^e\pmod{p^{i+1}}$，
　　$(K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^{e-1}=F_iA_i^{-1}$
關係式為$c_p\equiv F_i+eF_iA_i^{-1}p^iK_{i}\pmod{p^{i+1}}$，$i=1,2,\ldots,r-1$
移項可得$\displaystyle K_{i}\equiv \frac{(c_p-F_i)(eF_i)^{-1}A_i}{p^i}\pmod{p^{i+1}}$，$i=1,2,\ldots,r-1$
就可以計算出$K_1,K_2,\ldots,K_{r-1}$的值，$K_0\equiv c^{d_p}\pmod{p}$，進而求出$m_p=K_0+pK_1+p^2K_2+\ldots+p^{r-1}K_{r-1}$。

範例的$p=61,q=53,e=17$出自
[url]https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Example[/url]

設$r=3$
公鑰$n=p^rq=61^3\cdot 53=12029993$
$L=LCM(p-1,q-1)=LCM(60,52)=780$
私鑰$d\equiv e^{-1}\pmod{L}\equiv 17^{-1}\equiv 413\pmod{780}$
設明文$m=1234567$
密文$c\equiv m^e\pmod{n}$
　　　$\equiv 1234567^{17}\pmod{12029993}$
　　　$\equiv 10259995$

其他私鑰$d$方案
[table][tr][td]$L=LCM(p-1,q-1)$
$d\equiv e^{-1}\pmod{L}$[/td][td]$\phi(n)=p^{r-1}(p-1)(q-1)$
$d\equiv e^{-1}\pmod{\phi(n)}$[/td][td]$\lambda(n)=LCM(p^{r-1}(p-1),(q-1))$
$d\equiv e^{-1}\pmod{\lambda(n)}$[/td][/tr]
[tr][td]$L=LCM(60,52)=780$
$d\equiv 17^{-1}\equiv 413\pmod{L}$
私鑰$d$較小，但不能直接計算$m\equiv c^d \pmod{n}$來回復明文，改用以下的中國餘數定理來加速解密。[/td][td]$\phi(n)=61^2\cdot 60\cdot 52=11609520$
$d\equiv 17^{-1}\equiv 682913\pmod{\phi(n)}$
雖然可以直接計算$m\equiv c^d \pmod{n}$來回復明文，
但解密速度會比$n=pq$且使用中國餘數定理的RSA還慢，變成使用$n=p^rq$的RSA沒有顯著的優點。[/td][td]$\lambda(n)=LCM(61^2\cdot 60,52)=2902380$
$d\equiv 17^{-1}\equiv 682913\pmod{\lambda(n)}$
雖然可以直接計算$m\equiv c^d \pmod{n}$來回復明文，
但解密速度會比$n=pq$且使用中國餘數定理的RSA還慢，變成使用$n=p^rq$的RSA沒有顯著的優點。[/td][/tr][/table]
使用中國餘數定理解密。[table][tr][td][align=center]虛擬碼[/align][/td][td][align=center]範例[/align][/td][/tr]
[tr][td]
$A_i=K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1}$改成遞迴關係式$A_{i+1}=A_i+p^iK_i$
$F_i=(A_i)^e\pmod{p^{i+1}}$
計算$\displaystyle K_{i}\equiv \frac{(c_p-F_i)(eF_i)^{-1}A_i}{p^i}\pmod{p^{i+1}}$，$i=1,2,\ldots,r-1$
分解成
$E_i=c-F_i\pmod{p^{i+1}}$
$\displaystyle B_i=\frac{E_i}{p^i}$
$K_i=[(eF_i)^{-1}A_iB_i]\pmod{p}$
－－－－－－－－－－－－－－－－
解密
輸入：$d,p,q,e,r,c$
輸出：$m$
(1)　$d_p=d\pmod{p-1}$
　　$d_q=d\pmod{q-1}$
(2)　$K_0=c^{d_p}\pmod{p}$
　　$m_q=c^{d_q}\pmod{q}$
(3)　$A_1=K_0$
　　for $i=1$ to $(r-1)$ do
　　　$F_i=A_i^e \pmod{p^{i+1}}$
　　　$E_i=(c-F_i)\pmod{p^{i+1}}$
　　　$\displaystyle B_i=\frac{E_i}{p^i}$為整數
　　　$K_i=[(eF_i)^{-1}A_iB_i]\pmod{p}$
　　　$A_{i+1}=A_i+p^iK_i$為整數
(4)　$m_p=A_r$
(5)　$p_1=[(p^r)^{-1}]\pmod{q}$
　　$q_1=[q^{-1}]\pmod{p^r}$
(6)　$m=[q_1qm_p+p_1p^rm_q]\pmod{p^rq}$[/td]
[td]輸入：$d=413$，$p=61$，$q=53$，$e=17$，$r=3$，$c=10259995$
輸出：$m=1234567$
(1)$d_p\equiv 413\pmod{60}\equiv 53$
　$d_q\equiv 413\pmod{52}\equiv 49$
(2)$K_0\equiv 10259995^{53}\equiv 49\pmod{61}$
　$m_q\equiv 10259995^{49}\equiv 38\pmod{53}$
(3)$A_1=49$
當$i=1$時
　$F_1=A_1^e= 49^{17}  = 527 \pmod{61 ^2}$
　$E_1=(c-F_1)=(10259995-527)=671 \pmod{61 ^2}$
　$\displaystyle B_1=\frac{E_1}{p}=\frac{671}{61}=11$
　$K_1=(eF_1)^{-1} A_1B_1=( 17 \cdot 527 )^{-1} 49 \cdot 11 = 47 \pmod{61}$
　$A_2=A_1+p \cdot K_1= 49 + 61  \cdot 47 = 2916$
當$i=2$時
　$F_2=A_2^e= 2916^{17}= 57013 \pmod{61^3}$
　$E_2=(c-F_2)=(10259995-57013)= 215818 \pmod{61 ^3}$
　$\displaystyle B_2=\frac{E_2}{p^2}=\frac{215818}{3721}= 58$
　$K_2=(eF_2)^{-1} A_2B_2=( 17 \cdot 57013 )^{-1} 2916 \cdot 58 = 26 \pmod{61}$
　$A_3=A_2+p^2 \cdot K_2= 2916 + 61 ^2 \cdot 26 = 99662$
(4)$m_p=A_r=99662$
(5)$p_1\equiv 61^{-3}\equiv 50\pmod{53}$
　$q_1\equiv 53^{-1}\equiv 12848 \pmod{61^3}$
(6)$m\equiv [12848\cdot 53\cdot 99662+50\cdot 61^3 \cdot 38]\pmod{61^3\cdot 53}$
　　$\equiv 1234567 \pmod{61^3\cdot 53}$[/td][/tr][/table]
註：
1.論文的$A[0]$index從0開始，但maxima的list從1開始，所以將$A_{i-1}$改為$A_i$和$A_i$改為$A_{i+1}$和$A_{r-1}$改為$A_r$。
2.原論文公鑰$n=p^kq$，順應分解RSA公鑰$n=p^rq$論文，符號$k$另有他用，$p$的次方改為$r$。

參考資料：
Takagi, T. (1998). Fast RSA-type cryptosystem modulo p k q . In: Krawczyk, H. (eds) Advances in Cryptology — CRYPTO '98. CRYPTO 1998. Lecture Notes in Computer Science, vol 1462. Springer, Berlin, Heidelberg. [url]https://doi.org/10.1007/BFb0055738[/url]
[url]https://link.springer.com/chapter/10.1007/bfb0055738[/url]
[url]https://link.springer.com/content/pdf/10.1007/bfb0055738.pdf?pdf=inline%20link[/url]

[color=green]選兩個不同的質數[/color]
[color=red](%i2)[/color]
[color=blue]p:61;
q:53;[/color]
[color=red](p)[/color]　$61$
[color=red](q)[/color]　$53$

[color=green]公鑰$n=p^rq$[/color]
[color=red](%i4)[/color]
[color=blue]r:3;
n:p^r*q;[/color]
[color=red](r)[/color]　$3$
[color=red](n)[/color]　$12029993$

[color=green]公鑰$e$[/color]
[color=red](%i5)[/color]　[color=blue]e:17;[/color]
[color=red](e)[/color]　$17$

[color=green]私鑰$d$[/color]
[color=red](%i6)[/color]　[color=blue]d:inv_mod(e,lcm(p-1,q-1));[/color]
[color=red](d)[/color]　$413$

[color=green]明文$m$[/color]
[color=red](%i7)[/color]　[color=blue]m:1234567;[/color]
[color=red](m)[/color]　$1234567$

[color=green]用$m^e\pmod{n}$進行加密，密文為$c$[/color]
[color=red](%i8)[/color]　[color=blue]c:power_mod(m,e,n);[/color]
[color=red](c)[/color]　$10259995$

[color=green]用$c^d\pmod{n}$直接計算$m\equiv c^d\pmod(n)$無法得到原訊息$m$[/color]
[color=red](%i9)[/color]　[color=blue]m:power_mod(c,d,n);[/color]
[color=red](m)[/color]　$2330554$

[color=green]利用中國餘數定理才能解密
各變數初始化[/color]
[color=red](%i18)[/color]
[color=blue]dp:mod(d,p-1);
dq:mod(d,q-1);
K:create_list(0,i,1,r);
K[1]:power_mod(c,dp,p);
mq:power_mod(c,dq,q);
A:create_list(0,i,1,r);
B:create_list(0,i,1,r);
F:create_list(0,i,1,r);
A[1]:K[1];[/color]
[color=red](dp)[/color]　$53$
[color=red](dq)[/color]　$49$
[color=red](K)[/color]　$[0,0,0]$
[color=red](K[1])[/color]　$49$
[color=red](mq)[/color]　$38$
[color=red](A)[/color]　$[0,0,0]$
[color=red](B)[/color]　$[0,0,0]$
[color=red](F)[/color]　$[0,0,0]$
[color=red](A[1])[/color]　$49$

[color=green]利用$F_i=(A_i)^e$，$\displaystyle K_i\equiv \frac{(c-F_i)(eF_i)^{-1}A_i}{p^i}\pmod{p^{i+1}}$，$i=1,2,\ldots,r-1$，求$K_i$值[/color]
[color=red](%i9)[/color]
[color=blue]for i:1 thru r-1 do
  (print("F[",i,"]=A[",i,"]"^"e=",A[ i ],""^e," =",F[ i ]:power_mod(A[ i ],e,p^(i+1)),"(mod",p,""^(i+1),")"),
print("E[",i,"]=(c-F[",i,"])=(",c,"-",F[ i ],")=",E[ i ]:mod(c-F[ i ],p^(i+1)),"(mod",p,""^(i+1),")"),
print("B[",i,"]=E[",i,"]/p"^i,"=",E[ i ],"/",p^i,"=",B[ i ]:E[ i ]/p^i),
print("K[",i,"]=(eF[",i,"])"^"-1","A[",i,"]B[",i,"]=(",e,"*",F[ i ],")"^"-1",A[ i ],"*",B[ i ],"=",
         K[ i ]:mod(inv_mod(e*F[ i ],p)*A[ i ]*B[ i ],p),"(mod",p,")"),
print("A[",i+1,"]=A[",i,"]+p"^i,"*K[",i,"]=",A[ i ],"+",p,""^i,"*",K[ i ],"=",A[i+1]:A[ i ]+p^i*K[ i ]),
print("－－－－－－")
  )$[/color]
$F[1]=A[1]^e=49^{17}=527\pmod{61^2}$
$E[1]=(c-F[1])=(10259995-527)=671\pmod{61^2}$
$B[1]=E[1]/p=671/61=11$
$K[1]=(eF[1])^{-1}A[1]B[1]=(17*527)^{-1}49*11=47\pmod{61}$
$A[2]=A[1]+p*K[1]=49+61*47=2916$
－－－－－－
$F[2]=A[2]^e=2916^{17}=57013\pmod{61^3}$
$E[2]=(c-F[2])=(10259995-57013)=215818\pmod{61^3}$
$B[2]=E[2]/p^2=215818/3721=58$
$K[2]=(eF[2])^{-1}A[2]B[2]=(17*57013)^{-1}2916*58=26\pmod{61}$
$A[3]=A[2]+p^2*K[2]=2916+61^2*26=99662$
－－－－－－

[color=green]得到明文$m$[/color]
[color=red](%i23)[/color]
[color=blue]mp:A[r];
p1:inv_mod(p^r,q);
q1:inv_mod(q,p^r);
m:mod(q1*q*mp+p1*p^r*mq,p^r*q);[/color]
[color=red](mp)[/color]　$99662$
[color=red](p1)[/color]　$50$
[color=red](q1)[/color]　$12848$
[color=red](m)[/color]　$1234567$

bugmens 發表於 2024-2-10 11:17

3-2.針對大的$r$，分解RSA公鑰$n=p^rq$[table][tr][td][align=center]方法[/align][/td][td][align=center]範例[/align][/td][/tr]
[tr][td=2,1][b][align=center]問題敘述[/align][/b][/td][/tr]
[tr][td]定理
令$N=p^rq$，對某些的$c$，$q<p^c$。
若已知$N,r,c$由執行時間為$\displaystyle exp\left(\frac{c+1}{r+c}\cdot logp\right)\cdot O(\gamma)$的演算法能分解出因數$p$。
其中$\gamma$是矩陣維度$O(r^2)$，矩陣元素大小為$O(\gamma logN)$執行LLL所需的時間。
這個演算法是決定性的和需要多項式的空間。
[證明]
$N=p^rq$，對某些的$c$，$q<p^c$
令$d=2r(r+c)$，由引理1可知整數$P$滿足$|\; P-p|\;<p^{1-\frac{c+1}{r+c}}$
就能在$O((logN)^2d^4)$的時間內找到$N$的分解。[/td][td]$197213=61^2 \cdot 53$要找出$197213$的因數$61$
$N=197213$，$r=2$，$p=61$，$q=53$
假設$c=1$，$53<61^c$
矩陣維度$d=2r(r+c)=2\cdot 2(2+1)=12$
論文範例取較小的$d$值，$d=9$[/td][/tr]
[tr][td=2,1][b][align=center]步驟1：列舉因數$p$的近似值$P$[/align][/b][/td][/tr]
[tr][td]令$\displaystyle ε=\frac{c+1}{r+c}$
For $k=1,2,\ldots,\frac{log_2N}{r}$ do
　For $j=0,1,\ldots,2^{ε}$ do
　　(設$P=2^k+j\cdot 2^{(1-ε)k}$
　　使用近似的$P$，執行引理1的演算法
　　)[/td][td]$ \displaystyle ε=\frac{c+1}{r+c}=\frac{1+1}{2+1}=\frac{2}{3}$
$\displaystyle k=5,j=9,P=2^5+9*2^{(1-2/3)5}=59$
取$P=59$當作因數$p$的近似值[/td][/tr]
[tr][td=2,1][b]引理1：
給定$N=p^r q$和假設$q<p^c$對某些$c$，更進一步假設$P$是符合$\displaystyle |\; P-p|\;<p^{1-\frac{c}{r+c}-2\frac{r}{d}}$的整數
從$N,r,c$和$P$使用維度$d$的lattice執行LLL方法，能計算出因數$p$。[/b][/td][/tr]
[tr][td=2,1][b][align=center]步驟2.設同餘方程式，計算參數$X$[/align][/b][/td][/tr]
[tr][td]設同餘方程式為$f(x)=(P+x)^r\equiv 0 \pmod{p^r}$
且$p(x)$為monic(最高次方項係數為1)。
利用LLL方法可以找出比邊界$X$還小的解$x_0=p-P$($\displaystyle |\;x_0|\;<X$)
使得$f(x_0)\equiv 0 \pmod{p^r}$，進而得到公鑰$N$的一個因數$p=P+x_0$。[/td][td]$f(x)=(35+x)^2 \equiv 0\pmod{p^2}$
$\displaystyle X=p^{1-\frac{c+1}{r+c}}=p^{1-ε}$
因為$p$未知，假設$p,q$相近，$\displaystyle N=p^rq\approx p^{r+1}$，$\displaystyle p\approx N^{\frac{1}{r+1}}$
$\displaystyle X\approx N^{\frac{1-ε}{r+1}}= N^{\frac{1-2/3}{2+1}}=197213^{\frac{1}{9}}\approx 3.875$
取$X=3$[/td][/tr]
[tr][td=2,1][b][align=center]步驟3.產生矩陣$M$[/align][/b][/td][/tr]
[tr][td]$g_{i,k}(xX)=N^{m-k}(xX)^i f(xX)^k$
$g_{i,k}(xX)$，$i=0,1,\ldots,r-1$和$k=0,1,\ldots,m-1$
$g_{j,m}(xX)$，$j=0,1,\ldots,d-mr-1$
注意到對所有$i,k$，$g_{i,k}(x_0)\equiv 0\pmod{p^{rm}}$
[證明]
$g_{i,k}(x_0)=N^{m-k}(x_0X)^i(P+x_0)^{rk}$
　　　$=(p^rq)^{m-k}(x_0X)^i(p)^{rk}$
　　　$=p^{rm}(q^{m-k}(x_0X)^i)$
　　　$\equiv 0\pmod{p^{rm}}$
注意到對所有$j,m$，$g_{j,m}(x_0)\equiv 0\pmod{p^{rm}}$
[證明]
$g_{j,m}(x_0)=N^{m-m}(x_0X)^j(P+x_0)^{rm}$
　　　$=(x_0X)^jp^{rm}$
　　　$\equiv 0\pmod{p^{rm}}$
將$g_{i,k}(xX),g_{j,m}(xX)$多項式依$x$次方形成係數矩陣$M$。
令$M$是$L$的基底向量所形成的矩陣，注意到$M$為下三角矩陣，所以$L$的行列式值為$M$的對角線元素相乘，得到
$\displaystyle det(M)=\left(\prod_{k=0}^{m-1}\prod_{i=0}^{r-1}N^{m-k}\right)\left(\prod_{j=0}^{d-1}X^j\right)$
$\displaystyle =\left(\prod_{i=0}^{r-1}N^m\cdot N^{m-1}\ldots N^1\right) \cdot (X^0 \cdot X^1 \ldots X^{d-1})$
$\displaystyle =\left(\prod_{i=0}^{r-1}N^{m(m+1)/2}\right)X^{d(d-1)/2}$
$\displaystyle =N^{rm(m+1)/2}X^{d(d-1)/2}$
$\displaystyle <N^{rm(m+1)/2}X^{d^2/2}$[/td][td]$r=2$
$\displaystyle m=\lfloor\; \frac{d}{r+c}-\frac{1}{2} \rfloor\;=\lfloor\; \frac{12}{2+1}-\frac{1}{2} \rfloor\;=3$
$d=9$
產生$g_{i,k}(xX)$多項式
$i=0,k=0,g_{0,0}(xX)=N^3(xX)^0f(xX)^0=$$\bbox[border:1px solid black]{N^3}$
$i=1,k=0,g_{1,0}(xX)=N^3(xX)^1f(xX)^0=$$\bbox[border:1px solid black]{N^3X}x$
$i=0,k=1,g_{0,1}(xX)=N^2(xX)^0f(xX)^1=N^2(P+Xx)^2$
$=N^2P^2+2N^2PXx+$$\bbox[border:1px solid black]{N^2X^2}x^2$
$i=1,k=1,g_{1,1}(xX)=N^2(xX)^1f(xX)^1=N^2Xx(P+Xx)^2$
$=N^2P^2Xx+2N^2PX^2x^2+\bbox[border:1px solid black]{N^2X^3}x^3$
$i=0,k=2,g_{0,2}(xX)=N(xX)^0f(xX)^2=N(P+Xx)^4$
$=NP^4+4NP^3Xx+6NP^2X^2x^2+4NPX^3x^3+\bbox[border:1px solid black]{NX^4}x^4$
$i=1,k=2,g_{1,2}(xX)=N(xX)^1f(xX)^2=NXx(P+Xx)^4$
$=NP^4Xx+4NP^3X^2x^2+6NP^2X^3x^3+4NPX^4x^4+\bbox[border:1px solid black]{NX^5}x^5$
產生$g_{j,m}(xX)$多項式
$j=0,g_{0,3}(xX)=(xX)^0f(xX)^3=(P+Xx)^6$
$=P^6+6P^5Xx+15P^4X^2x^2+20P^3X^3x^3+15P^2X^4x^4+6PX^5x^5+\bbox[border:1px solid black]{X^6}x^6$
$j=1,g_{1,3}(xX)=(xX)f(xX)^3=Xx(P+Xx)^6$
$=P^6Xx+6P^5X^2x^2+15P^4X^3x^3+20P^3X^4x^4+15P^2X^5x^5+6PX^6x^6+\bbox[border:1px solid black]{X^7}x^7$
$j=2,g_{2,3}(xX)=(xX)^2f(xX)^3=X^2x^2(P+Xx)^6$
$=P^6X^2x^2+6P^5X^3x^3+15P^4X^4x^4+20P^3X^5x^5+15P^2X^6x^6+6PX^7x^7+\bbox[border:1px solid black]{X^8}x^8$[/td][/tr]
[tr][td=2,1]$M=\matrix{&\matrix{1　&x　&x^2　&x^3&　x^4　&　x^5&　x^6&　x^7&　x^8}\cr
\matrix{g_{0,0}(xX)\cr g_{1,0}(xX)\cr g_{0,1}(xX)\cr g_{1,1}(xX)\cr g_{0,2}(xX)\cr g_{1,2}(xX)\cr g_{0,3}(xX)\cr g_{1,3}(xX)\cr g_{2,3}(xX)}&\left[\matrix{N^3&&&&&&&&\cr
0&XN^3&&&&&&&\cr
*&*&X^2N^2&&&&&&\cr
0&*&*&X^3N^2&&&&&\cr
*&*&*&*&X^4N&&&&\cr
0&*&*&*&*&X^5N&&&\cr
*&*&*&*&*&*&X^6&&\cr
0&*&*&*&*&*&*&X^7&\cr
0&0&*&*&*&*&*&*&X^8}\right]}$
*代表非零數字
$det(M)=N^3 \cdot XN^3 \cdot X^2N^2\cdot X^3N^2\cdot X^4N\cdot X^5N\cdot X^6\cdot X^7\cdot X^8$
　　　$=N^{2\cdot(3+2+1)}X^{0+1+2+\ldots+7+8}$
　　　$=N^{12}X^{36}$[/td][/tr]
[tr][td=2,1][b][align=center]步驟4.經LLL化簡後的短向量產生不需要同餘$p^{rm}$的方程式，得到公鑰$N$的因數$p$[/align][/b][/td][/tr]
[tr][td]矩陣$M$經LLL化簡為$B$
$B=LLL(M)$
lattice經LLL化簡後第一行$b_1$為整個lattice中較短向量
所形成的方程式不需要再同餘$p^{rm}$
－－－－－－－－－－－－－－－－－－－
令$h(x)\in Z[x]$是次方為$n$的多項式，假設
(1)$h(x_0)\equiv 0\pmod{p^{rm}}$，$r,m$為正整數，$|\;x_0|\;<X$
(2)$\displaystyle \Vert\;h(xX)\Vert\;<\frac{p^{rm}}{\sqrt{d}}$
則在整數下$h(x_0)=0$。
[證明]
$\displaystyle |\;h(x_0)|\;=|\;\sum a_ix_0^i|\;=|\;\sum a_i X^i \left(\frac{x_0}{X}\right)^i|\;$
$\displaystyle \le \sum |\;a_iX^i \left(\frac{x_0}{X}\right)^i|\;\le \sum |\;a_i X^i|\;$
$\le \sqrt{d} \Vert\;h(xX)\Vert\;<p^{rm}$
因為$h(x_0)\equiv 0\pmod{p^{rm}}$，所以$h(x_0)=0$
－－－－－－－－－－－－－－－－－－－
向量$b_1$是由多項式$g_{i,k}(xX)$係數的線性組合而成$h(xX)$，$\Vert\;b_1 \Vert\;=\Vert\;h(xX) \Vert\;$
$h(x)$也會是多項式$g_{i,k}(x)$的線性組合，因為$g_{i,k}(x_0)\equiv 0\pmod{p^{rm}}$，所以$h(x_0)\equiv 0\pmod{p^{rm}}$

假設lattice $L$經LLL化簡後向量$b_1,b_2,\ldots,b_n$，則$\Vert\;b_1 \Vert\;\le 2^{(n-1)/4}\cdot(det(L))^{1/n}$。
證明在[url]https://math.pro/db/viewthread.php?tid=3498&page=1#pid23067[/url]
論文將$2^{(n-1)/4}$改成$2^{d/2}$，$d$為lattice矩陣維度
$\Vert\;b_1 \Vert\;\le 2^{d/2}\cdot(det(L))^{1/d}$
$\Vert\;b_1 \Vert\;^d\le 2^{d^2/2}\cdot det(L)$
將行列式值$ det(L)<N^{rm(m+1)/2}X^{d^2/2}$代入得到
$\Vert\;b_1 \Vert\;^d\le 2^{d^2/2}N^{rm(m+1)/2}X^{d^2/2}$
向量$b_1$是某個$h(xX)$多項式的係數向量，滿足$\Vert\;b_1 \Vert\;=\Vert\;h(xX) \Vert\;$
更進一步，因為$h(xX)$是$g_{i,k}(xX)$多項式的線性組合，
所以$h(x)$也是$g_{i,k}(x)$多項式的線性組合
將$\Vert\;b_1 \Vert\;=\Vert\;h(xX) \Vert\;$代入
$\Vert\;h(xX) \Vert\;^d\le 2^{d^2/2}\cdot N^{rm(m+1)/2}X^{d^2/2}$
若$\displaystyle \Vert\;h(xX)\Vert\;<\frac{p^{rm}}{\sqrt{d}}$，分母的$\sqrt{d}$在接下來計算中影響較小，為了簡化就忽略了。
$\displaystyle \Vert\;h(xX)\Vert\;^d\le 2^{d^2/2}\cdot N^{rm(m+1)/2}X^{d^2/2}<p^{rmd}$
$(2X)^{d^2/2}<p^{rmd}N^{-rm(m+1)/2}$
假設對某個$c$，$q<p^c$，$N=p^rq<p^{r+c}$
$(2X)^{d^2/2}<p^{rmd}p^{-r(r+c)m(m+1)/2}$
$(2X)^{d^2/2}<p^{rmd-r(r+c)m(m+1)/2}$
為了讓$X$值越大越好，可以取較弱的近似$P$值
利用配方法求$p$的最大次方$rmd-r(r+c)m(m+1)/2$
$\displaystyle =rmd-\frac{r}{2}(r+c)m(m+1)$
$\displaystyle =-\frac{r}{2}\left[(r+c)m^2+(r+c-2d)m\right]$
$\displaystyle =-\frac{r}{2}(r+c)\left(m^2+\frac{r+c-2d}{r+c}m\right)$
$\displaystyle =-\frac{r}{2}(r+c)\left(m+\frac{r+c-2d}{2(r+c)}\right)^2+\frac{r}{2}(r+c)\left(\frac{r+c-2d}{2(r+c)}\right)^2$
$\displaystyle =\frac{r}{2}(r+c)\left(m+\frac{1}{2}-\frac{d}{r+c}\right)^2+\frac{r}{2}(r+c)\left(\frac{r+c-2d}{2(r+c)}\right)^2$
$m$的最佳值在$\displaystyle m_0=\lfloor\; \frac{d}{r+c}-\frac{1}{2} \rfloor\;$
我們也許能選$d_0$使得$\displaystyle \frac{d_0}{r+c}-\frac{1}{2}$在$\displaystyle \frac{1}{2r+c}$的整數範圍內。
將$m=m_0$和$d=d_0$代入和繁瑣的計算後得到
$\displaystyle X<\frac{1}{2}p^{1-\frac{c}{r+c}-\frac{r}{d}(1+\delta)}$，其中$\displaystyle \delta=\frac{1}{r+c}-\frac{r+c}{4d}$
因為$\delta<1$我們得到稍微弱但更吸引人的界限
$\displaystyle X<p^{1-\frac{c}{r+c}-2\frac{r}{d}}$
令$d=2r(r+c)$
$\displaystyle X<p^{1-\frac{c}{r+c}-2\frac{r}{2r(r+c)}}$
$\displaystyle X<p^{1-\frac{c+1}{r+c}}$[/td][td]lattice經LLL化簡後第一行$b_1$為整個lattice中較短向量
$b_1=[83412628,-91271724,-27587799,-100623168,$
　　$[-100709649,89252928,78155361,202680225,228782070]$
產生不需要同餘$p^{rm}$的方程式
$\displaystyle h(x)=83412628-91271724 \left(\frac{x}{3}\right)-27587799 \left(\frac{x}{3}\right)^2$
　　$\displaystyle-100623168 \left(\frac{x}{3}\right)^3-100709649 \left(\frac{x}{3}\right)^4+89252928 \left(\frac{x}{3}\right)^5$
　　$\displaystyle+78155361\left(\frac{x}{3}\right)^6+202680225\left(\frac{x}{3}\right)^7+228782070 \left(\frac{x}{3}\right)^8$

　　$=83412628-30423908x-3065311x^2-3726784x^3$
　　$-1243329x^4+367296x^5+107209x^6+92675x^7+34870x^8$

　　$=(-2+x)^2(20853157+13247180x+7267563x^2+$
　　$3024072x^3+896349x^4+232155x^5+34870x^6)$
得到整數解$x=2$
得到因數$p=P+x=59+2=61$
$N$可分解成$197213=61^2 \cdot 53$[/td][/tr][/table]

參考資料：
Boneh, D., Durfee, G., Howgrave-Graham, N. (1999). Factoring N = p r q for Large r . In: Wiener, M. (eds) Advances in Cryptology — CRYPTO’ 99. CRYPTO 1999. Lecture Notes in Computer Science, vol 1666. Springer, Berlin, Heidelberg. [url]https://doi.org/10.1007/3-540-48405-1_21[/url]
[url]https://link.springer.com/chapter/10.1007/3-540-48405-1_21#chapter-info[/url]

[color=green]請下載[url=https://math.pro/db/attachment.php?aid=4282&k=9cf4654f63fb7d81b995fe3c87ae424a&t=1510060241]LLL.zip[/url]，解壓縮後將LLL.mac放到C:\maxima-5.46.0\share\maxima\5.46.0\share目錄下
要先載入LLL.mac才能使用LLL指令[/color]
[color=blue]load("LLL.mac");[/color]
C:/maxima-5.47.0/share/maxima/5.47.0/share/LLL.mac

[color=green]要因數分解的公鑰$N$[/color]
[color=blue]N:197213;[/color]
$197213$

[color=green]$N=p^r q$，因數$p$的次方$r$[/color]
[color=blue]r:2;[/color]
$2$

[color=green]假設$q<p^c$[/color]
[color=blue]c:1;[/color]
$1$

[color=green]矩陣維度[/color]
[color=blue]d:2*r*(r+c);[/color]
$12$

[color=green]參數$m$[/color]
[color=blue]m:floor(d/(r+c)-1/2);[/color]
$3$

[color=green]為了論文範例將矩陣維度改為9[/color]
[color=blue]d:9;[/color]
$9$

[color=green]列舉$P$的ε[/color]
[color=blue]epsilon: (c+1)/(r+c);[/color]
$\displaystyle \frac{2}{3}$

[color=green]列舉因數$p$的近似值$P$[/color]
[color=blue]for k:1 thru floor(log(N)/(log(2)*r)) do
  (steps:floor(float(2^(epsilon*k))),
for j:0 thru steps do
   (P:2^k+j*floor(float(2^((1-epsilon)*k))),
   print("k=",k,",j=",j,",P=2"^k,"+",j,"*2"^((1-epsilon)*k),"=",P)
   )
  );[/color]

$k=1,j=0,P=2+0*2^{1/3}=2$
$k=1,j=1,P=2+1*2^{1/3}=3$
$k=2,j=0,P=2^2+0*2^{2/3}=4$
$k=2,j=1,P=2^2+1*2^{2/3}=5$
$k=2,j=2,P=2^2+2*2^{2/3}=6$
$k=3,j=0,P=2^3+0*2=8$
$k=3,j=1,P=2^3+1*2=10$
$k=3,j=2,P=2^3+2*2=12$
$k=3,j=3,P=2^3+3*2=14$
$k=3,j=4,P=2^3+4*2=16$
$k=4,j=0,P=2^4+0*2^{4/3}=16$
$k=4,j=1,P=2^4+1*2^{4/3}=18$
$k=4,j=2,P=2^4+2*2^{4/3}=20$
$k=4,j=3,P=2^4+3*2^{4/3}=22$
$k=4,j=4,P=2^4+4*2^{4/3}=24$
$k=4,j=5,P=2^4+5*2^{4/3}=26$
$k=4,j=6,P=2^4+6*2^{4/3}=28$
$k=5,j=0,P=2^5+0*2^{5/3}=32$
$k=5,j=1,P=2^5+1*2^{5/3}=35$
$k=5,j=2,P=2^5+2*2^{5/3}=38$
$k=5,j=3,P=2^5+3*2^{5/3}=41$
$k=5,j=4,P=2^5+4*2^{5/3}=44$
$k=5,j=5,P=2^5+5*2^{5/3}=47$
$k=5,j=6,P=2^5+6*2^{5/3}=50$
$k=5,j=7,P=2^5+7*2^{5/3}=53$
$k=5,j=8,P=2^5+8*2^{5/3}=56$
$\bbox[border:1px solid black]{k=5,j=9,P=2^5+9*2^{5/3}=59}$
$k=5,j=10,P=2^5+10*2^{5/3}=62$
$k=6,j=0,P=2^6+0*2^2=64$
$k=6,j=1,P=2^6+1*2^2=68$
$k=6,j=2,P=2^6+2*2^2=72$
$k=6,j=3,P=2^6+3*2^2=76$
$k=6,j=4,P=2^6+4*2^2=80$
$k=6,j=5,P=2^6+5*2^2=84$
$k=6,j=6,P=2^6+6*2^2=88$
$k=6,j=7,P=2^6+7*2^2=92$
$k=6,j=8,P=2^6+8*2^2=96$
$k=6,j=9,P=2^6+9*2^2=100$
$k=6,j=10,P=2^6+10*2^2=104$
$k=6,j=11,P=2^6+11*2^2=108$
$k=6,j=12,P=2^6+12*2^2=112$
$k=6,j=13,P=2^6+13*2^2=116$
$k=6,j=14,P=2^6+14*2^2=120$
$k=6,j=15,P=2^6+15*2^2=124$
$k=6,j=16,P=2^6+16*2^2=128$
$k=7,j=0,P=2^7+0*2^{7/3}=128$
$k=7,j=1,P=2^7+1*2^{7/3}=133$
$k=7,j=2,P=2^7+2*2^{7/3}=138$
$k=7,j=3,P=2^7+3*2^{7/3}=143$
$k=7,j=4,P=2^7+4*2^{7/3}=148$
$k=7,j=5,P=2^7+5*2^{7/3}=153$
$k=7,j=6,P=2^7+6*2^{7/3}=158$
$k=7,j=7,P=2^7+7*2^{7/3}=163$
$k=7,j=8,P=2^7+8*2^{7/3}=168$
$k=7,j=9,P=2^7+9*2^{7/3}=173$
$k=7,j=10,P=2^7+10*2^{7/3}=178$
$k=7,j=11,P=2^7+11*2^{7/3}=183$
$k=7,j=12,P=2^7+12*2^{7/3}=188$
$k=7,j=13,P=2^7+13*2^{7/3}=193$
$k=7,j=14,P=2^7+14*2^{7/3}=198$
$k=7,j=15,P=2^7+15*2^{7/3}=203$
$k=7,j=16,P=2^7+16*2^{7/3}=208$
$k=7,j=17,P=2^7+17*2^{7/3}=213$
$k=7,j=18,P=2^7+18*2^{7/3}=218$
$k=7,j=19,P=2^7+19*2^{7/3}=223$
$k=7,j=20,P=2^7+20*2^{7/3}=228$
$k=7,j=21,P=2^7+21*2^{7/3}=233$
$k=7,j=22,P=2^7+22*2^{7/3}=238$
$k=7,j=23,P=2^7+23*2^{7/3}=243$
$k=7,j=24,P=2^7+24*2^{7/3}=248$
$k=7,j=25,P=2^7+25*2^{7/3}=253$
$k=8,j=0,P=2^8+0*2^{8/3}=256$
$k=8,j=1,P=2^8+1*2^{8/3}=262$
$k=8,j=2,P=2^8+2*2^{8/3}=268$
$k=8,j=3,P=2^8+3*2^{8/3}=274$
$k=8,j=4,P=2^8+4*2^{8/3}=280$
$k=8,j=5,P=2^8+5*2^{8/3}=286$
$k=8,j=6,P=2^8+6*2^{8/3}=292$
$k=8,j=7,P=2^8+7*2^{8/3}=298$
$k=8,j=8,P=2^8+8*2^{8/3}=304$
$k=8,j=9,P=2^8+9*2^{8/3}=310$
$k=8,j=10,P=2^8+10*2^{8/3}=316$
$k=8,j=11,P=2^8+11*2^{8/3}=322$
$k=8,j=12,P=2^8+12*2^{8/3}=328$
$k=8,j=13,P=2^8+13*2^{8/3}=334$
$k=8,j=14,P=2^8+14*2^{8/3}=340$
$k=8,j=15,P=2^8+15*2^{8/3}=346$
$k=8,j=16,P=2^8+16*2^{8/3}=352$
$k=8,j=17,P=2^8+17*2^{8/3}=358$
$k=8,j=18,P=2^8+18*2^{8/3}=364$
$k=8,j=19,P=2^8+19*2^{8/3}=370$
$k=8,j=20,P=2^8+20*2^{8/3}=376$
$k=8,j=21,P=2^8+21*2^{8/3}=382$
$k=8,j=22,P=2^8+22*2^{8/3}=388$
$k=8,j=23,P=2^8+23*2^{8/3}=394$
$k=8,j=24,P=2^8+24*2^{8/3}=400$
$k=8,j=25,P=2^8+25*2^{8/3}=406$
$k=8,j=26,P=2^8+26*2^{8/3}=412$
$k=8,j=27,P=2^8+27*2^{8/3}=418$
$k=8,j=28,P=2^8+28*2^{8/3}=424$
$k=8,j=29,P=2^8+29*2^{8/3}=430$
$k=8,j=30,P=2^8+30*2^{8/3}=436$
$k=8,j=31,P=2^8+31*2^{8/3}=442$
$k=8,j=32,P=2^8+32*2^{8/3}=448$
$k=8,j=33,P=2^8+33*2^{8/3}=454$
$k=8,j=34,P=2^8+34*2^{8/3}=460$
$k=8,j=35,P=2^8+35*2^{8/3}=466$
$k=8,j=36,P=2^8+36*2^{8/3}=472$
$k=8,j=37,P=2^8+37*2^{8/3}=478$
$k=8,j=38,P=2^8+38*2^{8/3}=484$
$k=8,j=39,P=2^8+39*2^{8/3}=490$
$k=8,j=40,P=2^8+40*2^{8/3}=496$
done

[color=green]要試驗很多次才能找到合適的近似值$P$，為了簡化過程選擇$P=59$[/color]
[color=blue]P:59;[/color]
$59$

[color=green]希望能找到$|\;x|\;<X$，$f(x)\equiv 0\pmod{p^r}$[/color]
[color=blue]X:floor(N^((1-epsilon)/(r+1)));[/color]
$3$

[color=green]同餘方程式$f(x)=(P+x)^r\equiv 0\pmod{p^r}$[/color]
[color=blue]fx: ('P+x)^r;[/color]
$(x+P)^2$

[color=green]將$x$以$Xx$代替，$f(Xx)=(P+Xx)^r \equiv 0\pmod{p^r}$[/color]
[color=blue]fXx:subst(x=x*'X,fx);[/color]
$(Xx+P)^2$

[color=green]以$x$升冪排序顯示[/color]
[color=blue]powerdisp:true;[/color]
$true$

[color=green]$g(xX)$多項式[/color]
[color=blue]gxX:[];[/color]
[]

[color=green]產生$g_{i,k}(xX)=N^{m-k}(Xx)^if^k(xX)$多項式，$i=0,\ldots,r-1$，$k=0,\ldots,m-1$[/color]
[color=blue]for k:0 thru m-1 do
  (for i:0 thru r-1 do
   (print("i=",i,",k=",k,",g",i,",",k,"(xX)=N"^(m-k),"*","(xX)"^i,"*","f(xX)"^k,"=",gik:'N^(m-k)*(x*'X)^i*fXx^k,"=",expand(gik)),
   gxX:append(gxX,[gik])
   )
  );[/color]
$i=0,k=0,g_{0,0}(xX)=N^3*1*1=N^3=N^3$
$i=1,k=0,g_{1,0}(xX)=N^3*(xX)*1=N^3Xx=N^3Xx$
$i=0,k=1,g_{0,1}(xX)=N^2*1*f(xX)=N^2(P+Xx)^2=N^2P^2+2N^2PXx+N^2X^2x^2$
$i=1,k=1,g_{1,1}(xX)=N^2*(xX)*f(xX)=N^2Xx(P+Xx)^2=N^2P^2Xx+2N^2PX^2x^2+N^2X^3x^3$
$i=0,k=2,g_{0,2}(xX)=N*1*f(xX)^2=N(P+Xx)^4=NP^4+4NP^3Xx+6NP^2X^2x^2+4NPX^3x^3+NX^4x^4$
$i=1,k=2,g_{1,2}(xX)=N*(xX)*f(xX)^2=NXx(P+Xx)^4=NP^4Xx+4NP^3X^2x^2+6NP^2X^3x^3+4NPX^4x^4+NX^5x^5$
done

[color=green]產生$g_{j,m}=x^jf^m(xX)$多項式，$j=0,\ldots,d-mr-1$[/color]
[color=blue]for j:0 thru d-m*r-1 do
  (print("j=",j,",g",j,",",m,"(xX)=","(xX)"^j,"*f(xX)"^m,"=",gim: (x*'X)^j*fXx^m,"=",expand(gim)),
gxX:append(gxX,[gim])
  );[/color]
$j=0,g_{0,3}(xX)=1*f(xX)^3=(P+Xx)^6=P^6+6P^5Xx+15P^4X^2x^2+20P^3X^3x^3+15P^2X^4x^4+6PX^5x^5+X^6x^6$
$j=1,g_{1,3}(xX)=(xX)*f(xX)^3=Xx(P+Xx)^6=P^6Xx+6P^5X^2x^2+15P^4X^3x^3+20P^3X^4x^4+15P^2X^5x^5+6PX^6x^6+X^7x^7$
$j=2,g_{2,3}(xX)=(xX)^2*f(xX)^3=X^2x^2(P+Xx)^6=P^6X^2x^2+6P^5X^3x^3+15P^4X^4x^4+20P^3X^5x^5+15P^2X^6x^6+6PX^7x^7+X^8x^8$
done

[color=green]全部的$g(xX)$多項式[/color]
[color=blue]gxX;[/color]
$[N^3,N^3Xx,N^2(P+Xx)^2,N^2Xx(P+Xx)^2,N(P+Xx)^4,NXx(P+Xx)^4,(P+Xx)^6,Xx(P+Xx)^6,X^2x^2(P+Xx)^6]$

[color=green]$x^1,\ldots,x^{d-1}$[/color]
[color=blue]xpower:create_list(x^i,i,1,d-1);[/color]
$[x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]$

[color=green]取$g(xX)$多項式係數(常數項在最後一行)[/color]
[color=blue]M:augcoefmatrix(gxX,xpower);[/color]
$\left[\matrix{0&0&0&0&0&0&0&0&N^3\cr
N^3X&0&0&0&0&0&0&0&0\cr
2N^2PX&N^2X^2&0&0&0&0&0&0&N^2P^2\cr
N^2P^2X&2N^2PX^2&N^2X^3&0&0&0&0&0&0\cr
4NP^3X&6NP^2X^2&4NPX^3&NX^4&0&0&0&0&NP^4\cr
NP^4X&4NP^3X^2&6NP^2X^3&4NPX^4&NX^5&0&0&0&0\cr
6P^5X&15P^4X^2&20P^3X^3&15P^2X^4&6PX^5&X^6&0&0& P^6\cr
P^6X&6P^5X^2&15P^4X^3&20P^3X^4&15P^2X^5&6P X^6&X^7&0&0\cr
0& P^6X^2&6P^5X^3&15P^4X^4&20P^3X^5&15P^2X^6&6PX^7&X^8&0}\right]$

[color=green]將常數項移到第一行[/color]
[color=blue]M:addcol(col(M,d),submatrix(M,d));[/color]
$\left[\matrix{N^3&0&0&0&0&0&0&0&0\cr
0&N^3X&0&0&0&0&0&0&0\cr
N^2P^2&2N^2PX&N^2X^2&0&0&0&0&0&0\cr
0&N^2P^2X&2N^2PX^2&N^2X^3&0&0&0&0&0\cr
NP^4&4NP^3X&6NP^2X^2&4NPX^3&NX^4&0&0&0&0\cr
0&NP^4X&4NP^3X^2&6NP^2X^3&4NPX^4&NX^5&0&0&0\cr
P^6&6P^5X&15P^4X^2&20P^3X^3&15P^2X^4&6PX^5&X^6&0&0\cr
0& P^6X&6P^5X^2&15P^4X^3&20P^3X^4&15P^2X^5&6PX^6&X^7&0\cr
0&0& P^6X^2&6P^5X^3&15P^4X^4&20P^3X^5&15P^2X^6&6PX^7&X^8}\right]$

[color=green]將$N=197213,X=3$代入矩陣$M$[/color]
[color=blue]M:ev(M,[N=N,P=P,X=X]);[/color]
$\left[\matrix{7670198773742597&0&0&0&0&0&0&0&0\cr
0&23010596321227791&0&0&0&0&0&0&0\cr
135386419411489&13768110448626&350036706321&0&0&0&0&0&0\cr
0&406159258234467&41304331345878&1050110118963&0&0&0&0&0\cr
2389701114893&486040904724&37070916462&1256641236&15974253&0&0&0&0\cr
0&7169103344679&1458122714172&111212749386&3769923708&47922759&0&0&0\cr
42180533641&12868637382&1635843735&110904660&4229415&86022&729&0&0\cr
0&126541600923&38605912146&4907531205&332713980&12688245&258066&2187&0\cr
0&0&379624802769&115817736438&14722593615&998141940&38064735&774198&6561}\right]$

[color=green]LLL化簡[/color]
[color=blue]B: LLL(M);[/color]
$\left[\matrix{83412628&-91271724&-27587799&-100623168&-100709649&89252928&78155361&202680225&228782070\cr
164609528&-217976916&-267622146&110184705&219274371&225169146&-62478216&-7989111&-216513\cr
-78834856&97014168&-7341966&273951288&-166154733&-57299643&-299831139&-30143421&120564936\cr
-148796076&254769516&149231061&-295864218&87910272&28543023&-249134292&82347111&-96958458\cr
1763788&20402880&-16597377&-47384811&-126043452&287403633&82562166&-398327058&234910044\cr
23658984&-157701924&142819218&-8117631&410281605&-146082852&-373406193&-393869952&369922302\cr
-92491784&338523084&-376090650&50862033&300067821&-401077818&111970026&-180821160&337996476\cr
524968778&-114638199&-300863016&-411132456&-492107157&-216884061&-403226667&-322669980&-332078454\cr
28705084293&19003686300&12994353171&8305795458&5569771815&3738017241&2182968630&1375264332&1161841563}\right]$

[color=green]找出因數$p$[/color]
[color=blue]for i:1 thru d do
  (print("第",i,"列向量B[",i,"]=",B[ i ]),
print("產生不需要同餘p"^"rm","=p"^(r*m),"的方程式h(x)"),
printList:["h(x)=",B[ i ][1]],
for j:2 thru d do
(if B[ i ][j]>=0 then printList:append(printList,["+"]),/*若係數為正則補印+號*/
   printList:append(printList,[B[ i ][j],"(",x/X,")"^(j-1)])
),
apply(print,printList),/*再用apply(print,)將全部內容印在同一行*/
print("h(x)=",hx:sum(B[ i ][j+1]*(x/X)^j,j,0,d-1),"=",factor(hx)),
print("整數解為",integerx:sublist(solve(hx,x),lambda([x],integerp(rhs(x))))),
if length(integerx)>0 then/*若有整數解*/
   (for x in integerx do
      (print("當整數解",x,"時，可能的因數p=P+x=",P,"+",rhs(x),"=",p: P+rhs(x)),
      if mod(N,p^r)=0 then
         (print("N可被p"^r,"整除，N可分解成",N,"=",p,""^r,"*",q:N/(p^r)),
         i:d/*將i設為d，直接結束for迴圈*/
         )
      else
         (print("N無法被p"^r,"整除"))
      )
   ),
print("－－－－－－－－－")
  );[/color]
第1列向量$B[1]=\left[83412628,-91271724,-27587799,-100623168,-100709649,89252928,78155361,202680225,228782070\right]$
產生不需要同餘$p^{rm}=p^6$的方程式$h(x)$
$\displaystyle h(x)=83412628-91271724\left(\frac{x}{3}\right)-27587799\left(\frac{x}{3}\right)^2-100623168\left(\frac{x}{3}\right)^3-100709649\left(\frac{x}{3}\right)^4+89252928\left(\frac{x}{3}\right)^5+78155361\left(\frac{x}{3}\right)^6+202680225\left(\frac{x}{3}\right)^7+228782070\left(\frac{x}{3}\right)^8$
$h(x)=83412628-30423908x-3065311x^2-3726784x^3-1243329x^4+367296x^5+107209x^6+92675x^7+34870x^8$
$=(-2+x)^2(20853157+13247180x+7267563x^2+3024072x^3+896349x^4+232155x^5+34870x^6)$
整數解為$[x=2]$
當整數解$x=2$時，可能的因數$p=P+x=59+2=61$
$N$可被$p^2$整除，$N$可分解成$197213=61^2 *53$
done

頁: [1]

Math Pro 數學補給站's Archiver

用Maxima學密碼學-Lattice Reduction應用2-找出同餘方程式較小的解